Chapter 4. Domain 4.0: Assessments & Audits

To secure a network, it is important to identify the normal operating parameters so that you can recognize atypical variations from this baseline operational level. The first step toward minimizing the potential damage that may result from unauthorized access attempts is the detection and identification of an unauthorized intrusion. Intrusion detection requires a detailed understanding of all operational aspects of the network, along with a means to identify variations and bring these changes to the attention of the proper responsible parties. Auditing is done to protect the validity and reliability of organizational information and systems. As a security professional, you can audit a vast amount of data. Auditing can create a large repository of information that has to be filtered through. Monitoring can be as simple or complex as you want to make it. Many organizations monitor an extensive amount of information, whereas others may monitor little or nothing. As a prospective security professional, you should also take every opportunity you may find to expand your skill base beyond these basic foundational elements. The following list includes the key areas from Domain 4 that you need to master for the exam:

image Conduct risk assessments and implement risk mitigation.

image Carry out vulnerability assessments using common tools.

image Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

image Use monitoring tools on systems and networks and detect security-related anomalies.

image Compare and contrast various types of monitoring methodologies.

image Execute proper logging procedures and evaluate the results.

image Conduct periodic audits of system security settings.

Practice Questions

Objective 4.1: Conduct risk assessments and implement risk mitigation.

1. Metrics for security baselines and hardening efforts rely on which of the following?

image A. Mitigation of threats and attacks

image B. Identification of security measures and policies

image C. Identification of vulnerability and risk

image D. Mitigation of vulnerability and risk

Quick Answer: 229

Detailed Answer: 232

2. When the risk of equipment loss is covered by a full-replacement insurance policy, which of the following best describes the risk?

image A. Accepted

image B. Transferred

image C. Eliminated

image D. Mitigated

Quick Answer: 229

Detailed Answer: 232

3. An organization removes legacy dial-up telephony modem devices to prevent war-dialing attacks. Which of the following best describes the risk?

image A. Accepted

image B. Transferred

image C. Eliminated

image D. Mitigated

Quick Answer: 229

Detailed Answer: 232

4. When an organization installs a firewall to prevent attacks, which of the following best describes the risk?

image A. Accepted

image B. Transferred

image C. Eliminated

image D. Mitigated

Quick Answer: 229

Detailed Answer: 232

5. When an organization decides the cost of an IDS is too expensive to implement, which of the following best describes the risk?

image A. Accepted

image B. Transferred

image C. Eliminated

image D. Mitigated

Quick Answer: 229

Detailed Answer: 232

6. Which of the following best describes the primary purpose of a risk assessment?

image A. To collect user logins and passwords for administrative purposes

image B. To scan the network to find and address vulnerabilities

image C. To properly store and protect personally identifiable information

image D. To identify existing threats and potential mitigation mechanisms

Quick Answer: 229

Detailed Answer: 233

7. Which of the following is the correct formula for calculating annual loss expectancy?

image A. SLE × ARO

image B. ALE × SLE

image C. ALE × ARO

image D. CLE × SLE

Quick Answer: 229

Detailed Answer: 233

8. Which of the following best describes how single loss expectancy is calculated?

image A. Loss prevented minus the total cost of the solution

image B. Asset value multiplied by the threat exposure factor

image C. Threat factor multiplied by potential vulnerability

image D. Annualized rate of occurrence multiplied by threat factor

Quick Answer: 229

Detailed Answer: 233

9. An organization has identified and reduced risk to a level that is comfortable and then implemented controls to maintain that level. Which of the following best describes this action?

image A. Risk management

image B. Risk acceptance

image C. Risk analysis

image D. Risk transference

Quick Answer: 229

Detailed Answer: 233

10. An organization identified risks, estimated the impact of potential threats, and identified ways to reduce the risk without the cost of the prevention outweighing the risk. Which of the following best describes this action?

image A. Risk management

image B. Risk acceptance

image C. Risk analysis

image D. Risk transference

Quick Answer: 229

Detailed Answer: 233

11. Which of the following best describes risk?

image A. Probability of threat exposure

image B. Cumulative loss expectancy

image C. Possibility of loss or danger

image D. Mitigation of loss or danger

Quick Answer: 229

Detailed Answer: 233

12. During the process of risk assessment, which of the following would be reviewed? (Select all correct answers.)

image A. Audit policies

image B. Access methods

image C. Financial records

image D. Hiring procedures

Quick Answer: 229

Detailed Answer: 234

13. Which of the following best describes return on investment?

image A. Estimating the impact of potential threats and identifying ways to reduce the risk

image B. Implemented controls to maintain a level of risk that is comfortable for the organization

image C. A measure of how effectively a company uses the money invested in its operations

image D. The ratio of money realized on an investment relative to the amount of money invested

Quick Answer: 229

Detailed Answer: 234

14. When the return on investment is calculated, if the result is a negative number, which of the following is true?

image A. Less money was spent than the loss prevented.

image B. More money was spent than the loss prevented.

image C. The money spent was not a worthwhile investment.

image D. The money spent was an excellent investment.

Quick Answer: 229

Detailed Answer: 234

15. Which of the following best describes exposure factor or probability?

image A. The weakness that allows an attacker to violate the integrity of a system

image B. The actual amount of loss prevented by implementing a total cost solution

image C. The percentage of loss that a realized threat could have on a certain asset

image D. The estimated possibility of a specific threat taking place in a one-year period

Quick Answer: 229

Detailed Answer: 234

Objective 4.2: Carry out vulnerability assessments using common tools.

1. Which of the following is a software utility that will scan a single machine or a range of IP addresses checking for a response on service connections?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 234

2. Which of the following is a software utility that will scan a range of IP addresses testing for the present of known weaknesses in software configuration and accessible services?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 234

3. Which of the following is a software utility that is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 235

4. Which of the following is a software utility that is used to conduct network assessments over a range of IP addresses and compiles a listing of all systems, devices, and hardware present within a network segment?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 235

5. Which of the following best describes the purpose of OVAL?

image A. An abstract description for layered communications and computer network protocol design

image B. A family of standards dealing with local area networks and metropolitan area networks

image C. An international standard setting body composed of representatives from various national standards organizations

image D. An international language for representing vulnerability information allowing the development of vulnerability test tools

Quick Answer: 229

Detailed Answer: 235

6. An administrator working in the Department of Homeland Security needs to document standards for the assessment process of systems. Which of the following would be most useful to the administrator?

image A. OVAL

image B. IEEE

image C. ISO

image D. ISSA

Quick Answer: 229

Detailed Answer: 235

7. An organization wants to select an assessment tool for creating an inventory of services hosted on networked systems. Which of the following should the organization choose?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 235

8. An organization wants to select an assessment tool that will examine individual protocols and specific endpoints. Which of the following should the organization choose?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 236

9. An organization wants to select an assessment tool for checking particular versions and patch levels of a service. Which of the following should the organization choose?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 236

10. An organization wants to select an assessment tool that will create graphical details suitable for reporting on network configurations. Which of the following should the organization choose?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 236

11. An organization wants to select an assessment tool that will directly test user logon password strength. Which of the following should the organization choose?

image A. Password Locker

image B. Password generator

image C. Password cracker

image D. Password keychain

Quick Answer: 229

Detailed Answer: 236

12. Which of the following best describes the difference between a port scanner and a vulnerability scanner?

image A. Port scanners only test for the availability of services; vulnerability scanners check for a particular version or patch level of a service.

image B. Port scanners compile a listing of all hardware present within a network segment; vulnerability scanners check for the availability of services.

image C. Vulnerability scanners only test for the availability of services; port scanners check for a particular version or patch level of a service.

image D. Vulnerability scanners compile a listing of all hardware present within a network segment; port scanners test for the availability of services.

Quick Answer: 229

Detailed Answer: 236

13. When using a password cracker to test mandatory complexity guidelines, which of the following should the password cracker provide?

image A. The password only

image B. The password and hash value

image C. The username and password

image D. The strength of the password

Quick Answer: 229

Detailed Answer: 237

14. An organization wants to select an assessment tool that will report information used to identify single points of failure. Which of the following should the organization choose?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 237

15. Which of the following tools is often referred to as a packet sniffer?

image A. Port scanner

image B. Network mapper

image C. Protocol analyzer

image D. Vulnerability scanner

Quick Answer: 229

Detailed Answer: 237

Objective 4.3: Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

1. Which of the following is best described as a friendly attack against a network to test the security measures put into place?

image A. Vulnerability assessment

image B. Penetration test

image C. Security assessment

image D. Compliance test

Quick Answer: 229

Detailed Answer: 237

2. Which of the following are the most serious downsides to conducting a penetration test? (Select all correct answers.)

image A. They can cause some disruption to network operations.

image B. The help desk can be flooded by affected users.

image C. They can generate false data in IDS systems.

image D. External users can have difficulty accessing resources.

Quick Answer: 229

Detailed Answer: 237

3. Which of the following is true about inexperienced internal systems administrators performing penetration tests against the organizational network? (Select all correct answers.)

image A. It is a safe practice.

image B. It is a bad practice.

image C. It may be a violation of privacy laws.

image D. It does not violate any privacy laws.

Quick Answer: 229

Detailed Answer: 238

4. Which of the following is true about the relationship between vulnerability assessment and penetration testing?

image A. They are inversely related.

image B. They are contradictory.

image C. They are separate functions.

image D. They are complementary.

Quick Answer: 229

Detailed Answer: 238

5. Which of the following is the main security risk of penetration testing?

image A. It can conceal aggression that is unrelated to the test.

image B. It can affect user connectivity and resource access.

image C. It can disrupt the normal business environment.

image D. It can weaken the network’s security level.

Quick Answer: 229

Detailed Answer: 238

Objective 4.4: Use monitoring tools on systems and networks and detect security-related anomalies.

1. Which of the following would most likely be used as a troubleshooting tool to tell whether a route is available to a host?

image A. tracert

image B. netstat

image C. nslookup

image D. ping

Quick Answer: 230

Detailed Answer: 238

2. Which of the following would most likely be used as a troubleshooting tool in a Windows environment to test the connectivity path a packet takes to arrive at the destination?

image A. tracert

image B. netstat

image C. nslookup

image D. ping

Quick Answer: 230

Detailed Answer: 238

3. Which of the following would most likely be used to troubleshoot a Domain Name System (DNS) server database?

image A. tracert

image B. netstat

image C. nslookup

image D. ping

Quick Answer: 230

Detailed Answer: 238

4. Which of the following would most likely be used to display all the ports on which the computer is currently listening?

image A. tracert

image B. netstat

image C. nslookup

image D. ping

Quick Answer: 230

Detailed Answer: 239

5. Which of the following is used in a Windows environment to verify the Transmission Control Protocol/Internet Protocol (TCP/IP) configuration?

image A. traceroute

image B. ipconfig

image C. netstat

image D. ifconfig

Quick Answer: 230

Detailed Answer: 239

6. Which of the following is the most likely reason the ping command returns a time out when trying to contact an external host?

image A. The host is unavailable.

image B. DNS traffic is blocked.

image C. The host network is unavailable.

image D. ICMP traffic is blocked.

Quick Answer: 230

Detailed Answer: 239

7. Which of the following best describes benchmarking?

image A. A measuring of normal activity

image B. The improving of system performance

image C. Determining how much load a server can handle

image D. Spreading work between two or more computers

Quick Answer: 230

Detailed Answer: 239

8. Which of the following best describes a baseline?

image A. A measure of normal activity

image B. The improvement of system performance

image C. A comparison of how much load a server can handle

image D. The distribution of work between two or more computers

Quick Answer: 230

Detailed Answer: 239

9. Which of the following protocols is used by the ping utility?

image A. ICMP

image B. SNMP

image C. SMTP

image D. NNTP

Quick Answer: 230

Detailed Answer: 239

10. Which of the following is used for tracking and viewing the utilization of operating system resources?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 239

11. Which of the following is used for system monitoring by allowing an administrator to view actions that occur on the system?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 240

12. Which of the following is Microsoft’s version of a protocol analyzer that comes with Windows Server operating systems?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 240

13. Which of the following gives you an instant history view of CPU and memory usage?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 240

14. The network administrator for the organization attempts to access the security log in Event Viewer on the file server, but the log file does not contain any entries. Which of the following is the most likely reason the security log is missing?

image A. Logging is not enabled.

image B. The security log is not shared.

image C. Auditing is not enabled.

image D. The security log is not stored on the server.

Quick Answer: 230

Detailed Answer: 240

15. Which of the following is an application layer protocol used to collect statistics from TCP/IP devices?

image A. ICMP

image B. SNMP

image C. SMTP

image D. NNTP

Quick Answer: 230

Detailed Answer: 240

16. At which of the following levels should the operating system be monitored to detect rootkits?

image A. Kernel

image B. Network

image C. Application

image D. Shell

Quick Answer: 230

Detailed Answer: 240

17. An organization is concerned about unauthorized users attempting to access network resources. Which of the following tools will the organization use to monitor user access activity?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 240

18. An organization is concerned about high I/O and CPU usage on the servers. Which of the following tools will the organization use to monitor resource activity?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 241

19. An organization is concerned about high memory and CPU usage on the local user machines. Which of the following tools will the organization use to spot check resource activity?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 241

20. An organization is having internal network connectivity issues and would like to implement a packet sniffer. Which of the following tools will the organization use to conduct this activity?

image A. Event Viewer

image B. Performance console

image C. Network Monitor

image D. Task Manager

Quick Answer: 230

Detailed Answer: 241

21. Several users appear to be having internal network connectivity issues. The systems administrator is not exactly sure where the problem lies. Upon going to a workstation and opening a command prompt, which of the following commands would most likely be typed first?

image A. tracert

image B. netstat

image C. nslookup

image D. ipconfig

Quick Answer: 230

Detailed Answer: 241

22. The users appear to be having connectivity issues to a vendor’s web hosted application. The systems administrator is not exactly sure where the problem lies. Upon going to a workstation and opening a command prompt, which of the following commands would most likely be typed first?

image A. tracert

image B. netstat

image C. nslookup

image D. ipconfig

Quick Answer: 230

Detailed Answer: 241

23. No one seems to be able to contact the intranet using DNS names but the intranet can be contacted by using the IP address. After opening a command prompt, which of the following commands would most likely be typed first?

image A. tracert

image B. netstat

image C. nslookup

image D. ipconfig

Quick Answer: 230

Detailed Answer: 241

24. A user reports slowness and intermittent odd activity on their workstation. After opening a command prompt, which of the following commands would most likely be typed first?

image A. tracert

image B. netstat

image C. nslookup

image D. ipconfig

Quick Answer: 230

Detailed Answer: 241

25. Which of the following is true about baselines? (Select all correct answers.)

image A. An initial baseline should be done for the network but not applications.

image B. Baselines must be updated on a regular basis.

image C. Baselines do not need to be updated when new technology is added.

image D. Baselines must be updated when the network has changed.

Quick Answer: 230

Detailed Answer: 242

Objective 4.5: Compare and contrast various types of monitoring methodologies.

1. Which of the following best describes behavior-based monitoring?

image A. Looks at patterns of access that have been established

image B. Looks at the way certain executable files make a computer act

image C. Looks for specific byte sequences that appear in attack traffic

image D. Looks for traffic behavior that is new or unusual

Quick Answer: 230

Detailed Answer: 242

2. Which of the following best describes anomaly-based monitoring?

image A. Looks at patterns of access that have been established

image B. Looks at the way certain executable files make a computer act

image C. Looks for specific byte sequences that appear in attack traffic

image D. Looks for traffic behavior that is new or unusual

Quick Answer: 230

Detailed Answer: 242

3. Which of the following best describes signature-based monitoring?

image A. Looks at patterns of access that have been established

image B. Looks at the way certain executable files make a computer act

image C. Looks for specific byte sequences that appear in attack traffic

image D. Looks for traffic behavior that is new or unusual principal

Quick Answer: 230

Detailed Answer: 242

4. An organization is concerned about buffer overflow attacks. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 242

5. An organization is concerned about internal misuse. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 243

6. An organization is concerned about system compromises from older known attacks on unpatched systems. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 243

7. An organization wants to implement a monitoring solution that returns few false positives and does not use a lot of system resources. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring up

Quick Answer: 230

Detailed Answer: 243

8. An organization wants to implement a monitoring solution that can be used in a mixed operating system environment and not dependent on OS-specific mechanisms. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 243

9. An organization wants to implement a monitoring solution that includes video surveillance. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 243

10. An organization wants to implement a monitoring solution that does not require a lot of software updating and can be self-learning. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 244

11. An organization wants to implement a monitoring solution that returns a low number of false positives. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 244

12. An organization that issues credit cards requires spending profiles for their customers. Which of the following monitoring methods will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 244

13. An organization requires a monitoring solution that determines if program is malicious by inspecting the stream of system calls that the program issues to the operating system. Which of the following monitoring method will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 244

14. Which of the following are disadvantages of using a behavior-based monitoring solution? (Select all correct answers.)

image A. The rule sets need constant updating.

image B. It can generate false positives.

image C. File checking is quite slow.

image D. It is based on passive monitoring.

Quick Answer: 230

Detailed Answer: 244

15. Which of the following are disadvantages of using a signature-based monitoring solution? (Select all correct answers.)

image A. The rule sets need constant updating.

image B. It can generate false positives.

image C. File checking is quite slow.

image D. It is based on passive monitoring.

Quick Answer: 230

Detailed Answer: 244

16. Which of the following are advantages of using a behavior-based monitoring solution? (Select all correct answers.)

image A. Can monitor for malware activities

image B. Triggers a low number of false positives

image C. Can identify polymorphic viruses

image D. Uses very few system resources

Quick Answer: 230

Detailed Answer: 245

17. Which of the following are advantages of using a signature-based monitoring solution? (Select all correct answers.)

image A. Can monitor for malware activities

image B. Triggers a low number of false positives

image C. Can identify polymorphic viruses

image D. Uses very few system resources

Quick Answer: 230

Detailed Answer: 245

18. An organization requires a monitoring solution for a highly secure environment in which the individual use patterns for each user profile can be identified. Which of the following monitoring method will best suit the organization?

image A. Signature-based monitoring

image B. Anomaly-based monitoring

image C. Performance-based monitoring

image D. Behavior-based monitoring

Quick Answer: 230

Detailed Answer: 245

19. Which of the following types of attacks are anomaly-based monitoring solutions best at detecting? (Select all correct answers.)

image A. DoS attacks based on payloads

image B. Protocol and port exploitation

image C. Documented malicious software

image D. Known intrusive activity

Quick Answer: 230

Detailed Answer: 245

20. Which of the following types of attacks are signature-based monitoring solutions best at detecting? (Select all correct answers.)

image A. DoS attacks based on payloads or volume

image B. Protocol and port exploitation

image C. Documented malicious software

image D. Known intrusive activity

Quick Answer: 230

Detailed Answer: 245

Objective 4.6: Execute proper logging procedures and evaluate the results.

1. Which of the following best describes system logging?

image A. The process of measuring the performance of a network

image B. The process of collecting data to be used for monitoring

image C. The process of tracking users and actions on the network

image D. The process of observing of the state of a system

Quick Answer: 230

Detailed Answer: 245

2. To get an accurate view of a network, which of the following must precede logging?

image A. Baselining

image B. Auditing

image C. Monitoring

image D. Archiving

Quick Answer: 230

Detailed Answer: 245

3. Which of the following best describes the way logging should be implemented?

image A. Only the user events should be logged.

image B. Only pertinent events should be logged.

image C. All events should be logged so nothing is missed.

image D. Nothing should be logged until there is a need for it.

Quick Answer: 230

Detailed Answer: 245

4. Which of the following would be considered a best practice for improved server performance when deciding where to store log files?

image A. Store in the system directory of a machine in the DMZ

image B. Store in the system directory on the local machine

image C. Store on a nonsystem striped or mirrored disk volume

image D. Store on a nonsystem disk volume on the local machine

Quick Answer: 230

Detailed Answer: 246

5. Which of the following would be considered a best security practice when deciding where to store log files?

image A. Stored in the system directory on the local machine

image B. Stored in a data directory on a server in the Intranet

image C. Stored in the system directory of a machine in the DMZ

image D. Stored in a centralized repository of an offline volume

Quick Answer: 230

Detailed Answer: 246

6. An organization requires the implementation of an enterprise application logging strategy. Which of the following would be a critical analysis consideration when choosing a solution?

image A. A proprietary custom-built solution

image B. Already built-in application logging solutions

image C. A solution that uses standard protocols and formats

image D. A variety of solutions that each use different formats

Quick Answer: 230

Detailed Answer: 246

7. An organization chooses to implement a manual application logging strategy and desires to use a format that can readily be parsed. Which of the following formats will meet the organizational requirements?

image A. CSV

image B. HTML

image C. TXT

image D. SQL

Quick Answer: 230

Detailed Answer: 246

8. Application logging standards should be implemented for the types of events the organization logs based on which of the following? (Select all correct answers.)

image A. User requirements

image B. Vendor requirements

image C. Business requirements

image D. Regulatory requirements

Quick Answer: 230

Detailed Answer: 246

9. Which of the following is pertinent in addition to reading the log files?

image A. Knowing how to correlate events

image B. Knowing how to parse log files

image C. Knowing how to delete events

image D. Knowing how to export log files

Quick Answer: 230

Detailed Answer: 246

10. Internet Information Services (IIS) logs can be used for which of the following purposes? (Select all correct answers.)

image A. Assess content

image B. Identify bottlenecks

image C. End processes

image D. Investigate attacks

Quick Answer: 230

Detailed Answer: 246

11. Which of the following most accurately describes best practice for using Microsoft DNS logging?

image A. Only the user events should be logged.

image B. Only pertinent events should be logged.

image C. All events should be logged so nothing is missed.

image D. Nothing should be logged until there is a need for it.

Quick Answer: 230

Detailed Answer: 246

12. Which of the following would be the first place an administrator would look when troubleshooting Microsoft DNS-related issues?

image A. The DNS debug log file

image B. The Event Viewer DNS server log file

image C. Syslog channel log.msgs

image D. The Event Viewer Application log file

Quick Answer: 230

Detailed Answer: 246

13. Which of the following would be the first place an administrator would look when troubleshooting UNIX- or Linux-based systems?

image A. Mtools.conf

image B. Msconfig

image C. Event Viewer

image D. Syslogd

Quick Answer: 230

Detailed Answer: 247

14. Which of the following would be considered best practices for system logging? (Select all correct answers.)

image A. For easy compilation, keep log files in plain text.

image B. When permissible, encrypt the log files.

image C. Store log files on a stand-alone system.

image D. Store log files on individual system data partitions.

Quick Answer: 230

Detailed Answer: 247

15. Which of the following would an administrator use to end applications that get hung up without having to reboot the machine?

image A. Network Monitor

image B. Task Manager

image C. Event Viewer

image D. Performance Console

Quick Answer: 230

Detailed Answer: 247

16. Which of the following would provide information for troubleshooting remote-access policy issues?

image A. Internet Information Services logging

image B. Critical and error level logging

image C. Authentication and accounting logging

image D. Event Viewer Application logging

Quick Answer: 230

Detailed Answer: 247

17. Which of the following are events in the firewall log that require additional examination? (Select all correct answers.)

image A. Traffic on port 25

image B. HTTP traffic

image C. Blocked attempts

image D. Suspicious signatures

Quick Answer: 230

Detailed Answer: 247

18. The organizational firewall log shows repeated traffic to port 53. This could be an indication of which of the following types of attacks? (Select all correct answers.)

image A. Cross-site scripting

image B. Denial of service

image C. Distributed denial of service

image D. SQL injection

Quick Answer: 230

Detailed Answer: 247

19. Which of the following types of logging events are most commonly found in antivirus software? (Select all correct answers.)

image A. Updates

image B. Dropped packets

image C. Quarantined viruses

image D. Update history

Quick Answer: 230

Detailed Answer: 247

20. An organization primarily contracts workers and is concerned about remote-access usage and remote authentication attempts. Which of the following would the organization implement to track this type of activity?

image A. Firewall logging

image B. RRAS logging

image C. IIS logging

image D. System logging

Quick Answer: 230

Detailed Answer: 247

Objective 4.7: Conduct periodic audits of system security settings.

1. Which of the following best describes auditing?

image A. The process of measuring the performance of a network

image B. The process of collecting data to be used for monitoring

image C. The process of tracking users and actions on the network

image D. The process of observing the state of a system

Quick Answer: 231

Detailed Answer: 248

2. Which of the following are unintended consequences when auditing is not clear-cut or built around the organizational goals and policies? (Select all correct answers.)

image A. Irrelevant information is gathered.

image B. Important security events are deleted.

image C. User hard drives quickly run out of space.

image D. System administrators have reduced workloads.

Quick Answer: 231

Detailed Answer: 248

3. A systems administrator is tasked with auditing user privileges. Which of the following steps must be taken? (Select two correct answers.)

image A. Enable logging within the operating system.

image B. Enable auditing within the operating system.

image C. Specify the resources to be audited.

image D. Specify the audit file storage directory.

Quick Answer: 231

Detailed Answer: 248

4. An organization has primarily contract workers and is concerned about unauthorized and unintentional access on these accounts. Which of the following would the organization audit to track this type of activity?

image A. Group policies

image B. Retention polices

image C. DHCP events and changes

image D. Access use and rights changes

Quick Answer: 231

Detailed Answer: 248

5. Which of the following are user rights used by processes? (Select all correct answers.)

image A. Process tracking

image B. Create a token object

image C. Bypass traverse checking

image D. Account management

Quick Answer: 231

Detailed Answer: 248

6. Which of the following is true about the auditing of failed logon events and successful login events?

image A. Only failed events should be audited.

image B. Only successful events should be audited.

image C. Both successful and failed events should be audited.

image D. Neither one should be audited unless absolutely necessary.

Quick Answer: 231

Detailed Answer: 248

7. Which of the following best describes the activity that involves collecting information used for monitoring and reviewing purposes?

image A. Auditing

image B. Logging

image C. Baselining

image D. Inspecting

Quick Answer: 231

Detailed Answer: 248

8. Which of the following best describes the unintended consequence of turning on all auditing counters for all objects?

image A. Reduced user productivity

image B. Reduced I/O activity on user machines

image C. Reduced administrative overhead

image D. Reduced server performance

Quick Answer: 231

Detailed Answer: 248

9. Which of the following would an organization include in its retention and disposal policies? (Select all correct answers.)

image A. Security evaluations

image B. Commercial software manuals

image C. Operational documentation

image D. Vendor user manuals

Quick Answer: 231

Detailed Answer: 249

10. Which of the following most accurately describes the maintenance of data-retention and storage polices?

image A. Once in place, they are good for many years.

image B. They need to be updated on a monthly basis.

image C. They need to be updated on a quarterly basis.

image D. They need to be updated when business goals change.

Quick Answer: 231

Detailed Answer: 249

11. An organization does not have a data-retention policy in place when it becomes involved in a lawsuit. Many of the employees have kept emails for a period of up to ten years. As a general rule, which of the following is true about the discovery of these emails?

image A. All are discoverable regardless of time frame or format.

image B. None are discoverable because they are electronic format.

image C. They are discoverable only going back three years.

image D. Only the emails the organization deems necessary are discoverable.

Quick Answer: 231

Detailed Answer: 249

12. Which of the following are pertinent for an organization to review before formulating data-retention policy? (Select all correct answers.)

image A. ISP requirements

image B. Regulatory requirements

image C. User requirements

image D. Business requirements

Quick Answer: 231

Detailed Answer: 249

13. Which of the following best describes how settings will actually be applied to an object in a group policy?

image A. Individually applied to the object and only from the last policy

image B. A combination of all the settings that can affect the object

image C. Only from settings within the domain where the object is located

image D. A combination of only local group polices that affect the object

Quick Answer: 231

Detailed Answer: 249

14. An administrator is attempting to resolve some issue with multiple group policies on several computers. Which of the following tools would be used to script GPO troubleshooting of multiple computers?

image A. Gpupdate

image B. Gpresult

image C. Resultant Set of Policy

image D. Group Policy object

Quick Answer: 231

Detailed Answer: 249

15. Which of the following tools is used to review the effects of Group Policy settings on a particular computer?

image A. Resultant Set of Policy

image B. Group Policy object

image C. Gpupdate

image D. Local Security settings

Quick Answer: 231

Detailed Answer: 249

16. An organization is concerned with knowing about any unusual activity that would indicate modification to the local security authority (LSA). Which of the following event categories should be audited?

image A. Audit success events in the account management

image B. Success events in the policy change on domain controllers

image C. Success and failure events in the system events

image D. Audit success events in the logon event category

Quick Answer: 231

Detailed Answer: 250

17. An organization is concerned with unusual activity indicating that an intruder is attempting to gain access to the network. Which of the following event categories should be audited?

image A. Audit success events in the account management

image B. Success events in the policy change on domain controllers

image C. Success and failure events in the system events

image D. Audit success events in the logon event category

Quick Answer: 231

Detailed Answer: 250

18. An organization wants to verify changes that are made to user account and group properties. Which of the following event categories should be audited?

image A. Audit success events in the account management

image B. Success events in the policy change on domain controllers

image C. Success and failure events in the system events

image D. Audit success events in the logon event category

Quick Answer: 231

Detailed Answer: 250

19. An organization wants a record of when each user logs on to or logs off from any computer. Which of the following event categories should be audited?

image A. Audit success events in the account management event

image B. Success events in the policy change on domain controllers

image C. Success and failure events in the system events

image D. Audit success events in the logon event category

Quick Answer: 231

Detailed Answer: 250

20. An organization wants to verify when users log on to or log off from the domain. Which of the following event categories should be audited?

image A. Audit success events in the account management event

image B. Success events in the policy change on domain controllers

image C. Success events in the account logon on domain controllers

image D. Audit success events in the logon event category

Quick Answer: 231

Detailed Answer: 250

Quick-Check Answer Key

Objective 4.1: Conduct risk assessments and implement risk mitigation.

1. C

2. B

3. C

4. D

5. A

6. D

7. A

8. B

9. A

10. C

11. C

12. A, B, D

13. D

14. B

15. C

Objective 4.2: Carry out vulnerability assessments using common tools.

1. A

2. D

3. C

4. B

5. D

6. A

7. A

8. C

9. D

10. B

11. C

12. A

13. D

14. B

15. C

Objective 4.3: Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

1. B

2. A, C

3. B, C

4. D

5. A

Objective 4.4: Use monitoring tools on systems and networks and detect security-related anomalies.

1. D

2. A

3. C

4. B

5. B

6. D

7. C

8. A

9. A

10. B

11. A

12. C

13. D

14. C

15. B

16. A

17. A

18. B

19. D

20. C

21. D

22. A

23. C

24. B

25. B, D

Objective 4.5: Compare and contrast various types of monitoring methodologies.

1. B

2. D

3. C

4. B

5. D

6. A

7. A

8. D

9. B

10. B

11. A

12. B

13. D

14. B, C

15. A, D

16. A, C

17. B, D

18. B

19. A, B

20. C, D

Objective 4.6: Execute proper logging procedures and evaluate the results.

1. B

2. A

3. B

4. C

5. D

6. C

7. A

8. C, D

9. A

10. A, B, D

11. D

12. B

13. D

14. B, C

15. B

16. C

17. C, D

18. B, C

19. A, C, D

20. B

Objective 4.7: Conduct periodic audits of system security settings.

1. C

2. A, B

3. C

4. D

5. B, C

6. C

7. B

8. D

9. A, C

10. D

11. A

12. B, D

13. B

14. B

15. A

16. B

17. C

18. A

19. D

20. C

Answers and Explanations

Objective 4.1 Conduct risk assessments and implement risk mitigation.

1. Answer: C. Metrics for security baselines and hardening efforts rely on identification of vulnerability and risk. It is necessary to have some mechanism for measuring vulnerability to determine whether a baseline has been met, or if a new security measure has been effective. Answer A is incorrect because mitigation of threats and attacks are not related to metrics. Answer B is incorrect because security policies are not related to metrics. Answer D is incorrect; mitigation of vulnerability and risk is not related to metrics.

2. Answer: B. A risk, once identified, can be dealt with in several ways. A risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.

3. Answer: C. A risk, once identified, can be dealt with in several ways. Some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.

4. Answer: D. A risk, once identified, can be dealt with in several ways. Most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices.

5. Answer: A. A risk, once identified, can be dealt with in several ways. Some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.

6. Answer: D. Before any baseline can be established, beyond those developed by regulatory bodies outside of the business entity, a risk assessment must be conducted to identify existing risks and potential mitigation mechanisms. Answer A is incorrect. This is not a good policy and is not included is a risk assessment. Answer B is incorrect; it describes a vulnerability assessment. Answer C is incorrect; personally identifiable information may be part of the risk assessment, but is it not the main purpose.

7. Answer: A. Annual loss expectancy (ALE) equals the single loss expectancy (SLE) times the annualized rate of occurrence (ARO): SLE × ARO = ALE. Based on the previous formula, answers B, C, and D are incorrect.

8. Answer: B. SLE equals asset value multiplied by the threat exposure factor or probability. Answer A is incorrect because it describes return on investment (ROI). Answer C is incorrect because it describes risk. Answer D is incorrect because it describes annualized rate of occurrence. The ARO is the estimated possibility of specific threat taking place in a one-year time frame.

9. Answer: A. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because risk analysis helps align security objectives with business objectives. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.

10. Answer: C. Risk analysis helps align security objectives with business objectives. Risk analysis identifies risks, estimates the impact of potential threats, and identifies ways to reduce the risk without the cost of the prevention outweighing the risk. Answer A is incorrect. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.

11. Answer: C. Risk is the possibility of loss or danger. Answer A is incorrect because the exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer B is incorrect; the cumulative loss expectancy (CLE) is a risk model that calculates risk based on single systems. Answer D is incorrect because mitigation comes after risk is identified and assessed.

12. Answer: A, B, D. During the process of risk assessment, it is necessary to review many areas, such as the following: methods of access, authentication schemes, audit policies, hiring and release procedures, isolated services that may provide a single point of failure or avenue of compromise and data or services requiring special backup or automatic failover support. Answer C is incorrect. Financial records review is not a necessary part of risk assessment, but how well that data is protected may be.

13. Answer: D. Return on investment is the ratio of money realized or unrealized on an investment relative to the amount of money invested. Answer A is incorrect because it describes risk analysis. Answer B is incorrect because it describes risk management. Answer C is incorrect because it describes return on capital.

14. Answer: B. Return in investment is equal to the loss prevented minus the cost of solution. If the result of this formula is a negative number, you spent more than the loss prevented. Therefore, answer A is incorrect. Answers C and D are incorrect because depending on what the investment is, it may or may not be a good investment and might be necessary due to regulations.

15. Answer: C. The exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer A is incorrect because it describes vulnerability. Answer B is incorrect because it describes reduced risk on investment. Answer D is incorrect because it describes annual rate of occurrence.

Objective 4.2: Carry out vulnerability assessments using common tools.

1. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services.

2. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.

3. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

4. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses testing for the present of known vulnerabilities in software configuration and accessible services.

5. Answer: D. Open Vulnerability Assessment Language (OVAL) is intended as an international language for representing vulnerability information using an XML schema for expression, allowing tools to be developed to test for identified vulnerabilities in the OVAL repository. Answer A is incorrect because it describes the Open Systems Interconnection reference model (OSI model). Answer B is incorrect because it describes IEEE 802 standards. Answer C is incorrect because it describes the International Organization for Standardization (ISO).

6. Answer: A. Within U.S. Governmental agencies, vulnerability may be discussed using the Open Vulnerability Assessment Language (OVAL) sponsored by the Department of Homeland Security’s National Cyber Security Division (NCSD). Answer B is incorrect because IEEE refers to a family of IEEE standards dealing with local area networks and metropolitan area networks. Answer C is incorrect because the International Organization for Standardization, widely known as ISO, is an international-standard-setting body composed of representatives from various national standards organizations. Answer D is incorrect because the Information Systems Security Association is a security-focused group.

7. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Port scanners are useful in creating an inventory of services hosted on networked systems. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

8. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

9. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.

10. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

11. Answer: C. A password cracker is a software utility that allows direct testing of user logon password strength by conducting a brute-force password test using dictionary terms, specialized lexicons, or mandatory complexity guidelines. Answer A is incorrect. Password Locker is a commercial program that lets you save passwords, recover passwords, and manage and form-fill all your usernames and passwords. Answer B is incorrect because a password generator creates random passwords. Answer D is incorrect. A password keychain, most commonly found on Apple computers, keeps track of your passwords for any type of account.

12. Answer: A. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answers B, C, and D are incorrect because they do not accurately describe port scanners or vulnerability scanners.

13. Answer: D. Password crackers should provide only the relative strength of a password, rather than the password itself, to avoid weakening logon responsibility under evidentiary discovery actions. Answers A, B, and C are incorrect because password crackers should not provide the password itself to avoid disclosure under e-discovery proceedings.

14. Answer: B. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. This information can be used to identify single points of failure, conduct a network inventory, and create graphical details suitable for reporting on network configurations. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

15. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

Objective 4.3: Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

1. Answer: B. Friendly attacks against a network to test the security measures put into place. Such attacks are referred to as penetration tests or simply “pen tests.” Answer A and C are incorrect because a vulnerability assessment or a security assessment are not directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Answer D is incorrect because a compliance test has nothing to do with penetration testing.

2. Answer: A, C. Penetration tests may cause some disruption to network operations as a result of the actual penetration efforts conducted. Penetration tests can also make legitimate attacks by generating false data in intrusion detection systems/intrusion prevention systems (IDS/IPS). Answers B and D are incorrect; although internal and external users may be affected, these are not the most serious downsides of penetration testing.

3. Answer: B, C. Some systems administrators may perform amateur pen tests against networks in an attempt to prove a particular vulnerability exists or to evaluate the overall security exposure of a network. This is a bad practice because it generates false intrusion data, may weaken the network’s security level, and may be a violation of privacy laws, regulatory mandates, or business entity guidelines. Answers A and D are incorrect because the statements are contrary to the correct answers.

4. Answer: D. Vulnerability assessments may be complemented by directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Penetration testing includes all of the process in vulnerability assessment plus an important extra step, which is to exploit the vulnerabilities found in the discovery phase. Based in the previous information, answers A, B, and C are incorrect.

5. Answer: A. Penetration tests can also make legitimate attacks by generating false data in IDS systems, concealing aggression that is otherwise unrelated to the officially sanctioned penetration test. Answers B and C are incorrect; although they are both concerns, they are not the main security risk. Answer D is incorrect; penetration testing itself does not weaken the network’s security level; however amateur pen testing can.

Objective 4.4: Use monitoring tools on systems and networks and detect security-related anomalies.

1. Answer: D. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host. It is a good troubleshooting tool to tell whether a route is available to a host. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.

2. Answer: A. The traceroute utility traces the route a packet takes and records the hops along the way. This is a good tool to use to find out where a packet is getting hung up. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.

3. Answer: C. nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.

4. Answer: B. netstat displays all the ports on which the computer is currently listening. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.

5. Answer: B. ipconfig is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect; the traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect; ifconfig is used to display the TCP/IP settings on a UNIX machine.

6. Answer: D. It is common practice to block ICMP traffic on routers and firewalls. The devices can be configured to block ICMP PING request packets. Answers A and C are incorrect because the host and the host network may be available. Answer B is incorrect because DNS traffic has nothing to do with ping.

7. Answer: C. Benchmarking determines how much of a load the server can handle by comparing two or more systems or components of a system. Answer A is incorrect because it describes a baseline. Answer B is incorrect because it describes performance tuning. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.

8. Answer: A. The measure of normal activity is known as a baseline. Answer B is incorrect because it describes performance tuning. Answer C is incorrect because it describes a benchmark. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.

9. Answer: A. Ping uses the Internet Control Message Protocol (ICMP) and is a network layer test of whether a remote host is alive. A small packet containing an ICMP echo request message is sent through the network to a particular IP address. Answer B is incorrect because Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.

10. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.

11. Answer: A. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.

12. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.

13. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.

14. Answer: C. The security log records security events and is available for viewing only by administrators. For security events to be monitored, you must enable auditing. Based on this information, answers A, B, and D are incorrect.

15. Answer: B. Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer A is incorrect Internet Control Message Protocol (ICMP) and is a network layer protocol used to test remote connectivity. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.

16. Answer: A. The kernel level is the execution profile. It is here that malicious software such as rootkits operate. Answer B is incorrect; the network-level profile consists of the assembly and transport of data packets. Answer C is incorrect because all applications generate a normal profile of behavior. Changes in the normal application behavior warrants further investigation for a compromise. Answer D is incorrect; at the shell level, each user generates a standard profile representing the normal activities that are routine for that person.

17. Answer: A. Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.

18. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.

19. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.

20. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. A protocol analyzer, otherwise known as a packet sniffer, is used to capture network traffic and generate statistics for creating reports. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation.

21. Answer: D. ipconfig is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.

22. Answer: A. The traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.

23. Answer: C. nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.

24. Answer: B. netstat displays all the ports on which the computer is currently listening. Answer A is incorrect. The traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.

25. Answer: B, D. Baselines must be updated on a regular basis, and certainly when the network has changed or new technology has been deployed. An initial baseline should be done for both network and application processes so that you can tell whether you have a hardware or software issue. Based on the previous statement, answers A and C are incorrect.

Objective 4.5: Compare and contrast various types of monitoring methodologies.

1. Answer: B. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.

2. Answer: D. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic.

3. Answer: C. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.

4. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, and DoS attacks based on payloads or volume. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

5. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. This monitoring method can be used to identify internal misuse by recognizing actions outside of normal access patterns or authorized events occurring outside of normal profile usage, such as the access of protected files during off-hours. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.

6. Answer: A. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The problem is that they can detect only known attacks with identified signatures. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

7. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

8. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. It is not dependent on OS-specific mechanisms. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.

9. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Detection of anomalies is used in many security domains, ranging from video surveillance and security systems to intrusion detection and fraudulent transactions. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

10. Answer: B. The classifications of anomaly detection techniques include statistical methods, rule-based methods, distance-based methods, profiling methods, and model-based approaches. For example, under the profiling method, normal behavior can be programmed based on offline research, or the system can learn behavior while processing network traffic. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

11. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

12. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly detection is analogous to credit card fraud detection. Credit card companies maintain “spending profiles” for their customers. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

13. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. A behavior-based detector determines whether a program is malicious by inspecting the stream of system calls that the program issues to the operating system. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.

14. Answers: B, C. Behavior based detection has several limitations, including high incidence of false alarms and slow file checking. Answers A and D are incorrect because they are associated with signature-based monitoring solutions.

15. Answer: A, D. Signature-based detection has several limitations, including being based excessively on passive monitoring and the rule sets need constant updating. Answers B and C are incorrect because they are associated with behavior-based monitoring solutions.

16. Answer: A, C. Behavior-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers B and D are incorrect because they are advantages associated with signature-based monitoring.

17. Answer: B, D. Signature-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers A and C are incorrect because they are advantages associated with behavior-based monitoring.

18. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Because this method detects anomalies, it is also called statistical anomaly detection. Highly secure environments might use complex patterns of behavior analysis, in some cases learning individual patterns of use common to each user profile, so that variations can be identified. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.

19. Answer: A, B. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, DoS attacks based on payloads or volume, normal network failures, and variants of existing attacks in new environments. Answers C and D are incorrect; they are associated with signature-based monitoring.

20. Answer: C, D. In signature-based monitoring, the user can examine the signature database, and quickly determine which intrusive activity the misuse detection system is programmed to alert on. Another benefit is that it can accurate detect know malicious software. Answers A and B are incorrect; they are associated with anomaly-based monitoring.

Objective 4.6: Execute proper logging procedures and evaluate the results.

1. Answer: B. Logging is the process of collecting data to be used for monitoring and auditing purposes. Answer A is incorrect because it describes baselining. Answer C is incorrect because it describes auditing. Answer D is incorrect because it describes monitoring.

2. Answer: A. Logging procedures and evaluation are an important part of keeping your network safe. However, before you can configure logging, it is essential to identify what is typical behavior for your network. Answers B, C, and D are incorrect; all these functions are performed after logging is enabled.

3. Answer: B. When choosing what to log, be sure you choose carefully. Logs take up disk space and use system resources. They also have to be read; and if you log too much, will bog down the system, and it will take a long time to weed through the log files to determine what is important. Therefore, answers A, C, and D are incorrect.

4. Answer: C. To improve server performance, logs should be stored on a nonsystem striped or striped/mirrored disk volume. Answer A is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable. Answers B and D are incorrect; storing the log files on the local machine will not improve performance.

5. Answer: D. Log files should be stored in a centralized repository of an offline volume or on a standalone computer. Answer A is incorrect; storing the log files on the local machine will not improve security. Answer B is incorrect. Storing the log files on the Intranet is poor practice as the information is visible and more vulnerable. Answer C is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable.

6. Answer: C. When implementing an application logging strategy, look for a solution that uses standard protocols and formats so that analysis is simpler. Therefore, answers A, B, and D are incorrect.

7. Answer: A. Should you choose to use manual analysis, consider creating the logs in a format that is can readily be parsed, such as comma-separated value (CSV). Doing so will allow for more flexibility when importing the information into applications for analysis. Answers B, C, and D are incorrect because none of these formats are readily parsed.

8. Answer: C, D. Standards should be implemented for the types of events you want to log based on business, technical, and regulatory requirements, and the threats the organization faces. Answer A is incorrect because although user needs should be considered, logging standards should not be based on them. Answer B is incorrect; vendor requirements have nothing to do with organizational logging standards.

9. Answer: A. Not only do you need to read the logs, you may also have to know how to correlate events examining output. Answers B, C, and D are incorrect; they are not pertinent to being able to decipher log files.

10. Answer: A, B, D. IIS logs may include information about site visitors and their viewing habits. They can be used to assess content, identify bottlenecks, or investigate attacks. Answer C is incorrect. Task Manager is a tool that you can use to end processes.

11. Answer: D. DNS logging may cause performance degradation on the server. It should be used only for troubleshooting purposes. By enabling DNS debug logging, you can log all DNS-related information. Based on this information, answers A, B, and C are incorrect.

12. Answer: B. The DNS server log contains events logged by the DNS Server service. For example, when the DNS server starts or stops, a corresponding event message is written to this log. This should be the first place you look when troubleshooting DNS-related issues. Answer A is incorrect. By enabling DNS debug logging, you can log all DNS-related information. Answer C is incorrect. Syslog channels are used for BIND logging. Answer D is incorrect. The Event Viewer Application log will not provide enough detailed information.

13. Answer: D. In UNIX- or Linux-based systems, programs send log entries to the system logging daemon, syslogd. Answer A is incorrect because mtools.conf is a configuration file for all the operations. Answers B and C are incorrect; both Msconfig and Event Viewer are tools used on Windows-based systems.

14. Answer: B, C. You should employ strict access controls on all logging servers. If allowable, encrypt the log files and store log files on a stand-alone system. Answer A is incorrect; it is not good practice to store log files in plain text. Answer D is incorrect; log files should not be stored on data partitions of individual systems.

15. Answer: B. Task Manager is a tool that you can use to end processes or applications that get hung up or cause the operating system to become unstable, without having to reboot the machine. It also gives you an instant view of CPU and memory usage. Answer A is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer C is incorrect because Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer D is incorrect because Microsoft’s Performance console is used for tracking and viewing the utilization of system resources.

16. Answer: C. Authentication and accounting logging is particularly useful for troubleshooting remote-access policy issues. Answer A is incorrect because Internet Information Services (IIS) logging is designed to be more detailed than the event-logging or performance-monitoring features of Windows Server operating systems. The IIS logs can include information such as who has visited your site, what they viewed, and when the information was viewed last. Answer B is incorrect because critical and error level logging is one of the eight different logging levels available for Cisco logging devices. Answer D is incorrect because authentication and accounting logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log.

17. Answer: C, D. The following are some events you should to take a closer look at: repeated traffic to particular ports, blocked attempts, and suspicious signatures. Answer A is incorrect because port 25 is used for SMTP traffic. Answer B is incorrect because HTTP traffic is used for web access.

18. Answer: B, C. If a firewall log shows repeated traffic to particular ports, this can indicate a DoS or distributed DoS (DDoS) attack. When there is repeated traffic on port 53, the attacker is probably trying to overwhelm the DNS service. Answers A and D are incorrect because these attacks are associated with web browsers and servers.

19. Answer: A, C, D. Antivirus software, just like other software applications, usually contain a folder within the application for logging events such as updates, quarantined viruses, and update history. Answer B is incorrect. Dropped packets are normally found in router logs.

20. Answer: B. Routing and remote access logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log. Therefore, Answer D is incorrect. Answer A is incorrect; firewall logging will not log remote access and authentication. Answer C is incorrect; IIS logging will not log remote access and authentication.

Objective 4.7: Conduct periodic audits of system security settings.

1. Answer: C. Auditing is the process of tracking users and their actions on the network. Answer A is incorrect because it describes baselining. Answer B is incorrect because it describes logging. Answer D is incorrect because it describes monitoring.

2. Answer: A, B. Without proper planning and policies, you probably will quickly fill your log files and hard drives with useless or unused information. The more quickly you fill up your log files, the more frequently you need to check the logs; otherwise, important security events may get deleted unnoticed. Answer C is incorrect because log files should not be stored on user hard drives. Answer D is incorrect. When auditing is not clear-cut, the workload of the system administrator increases.

3. Answer: B, C. Auditing user privileges is generally a two-step process that involves enabling auditing within the operating system and then specifying the resources to be audited. Answer A is incorrect; auditing not logging needs to be enabled. Answer D is incorrect; the log file storage directory is specified not the audit file directory.

4. Answer: D. Auditing of access use and rights changes should be implemented to prevent unauthorized or unintentional access for a guest or restricted user account access to sensitive or protected resources. Answer A is incorrect; group policy controls access to resources. Answer B is incorrect; retention polices concern data not user access. Answer C is incorrect; DHCP deals with the issuing of IP addresses not access to accounts.

5. Answer: B, C. The following user rights are never audited, mainly because they are used by processes: bypass traverse checking, generate security audits, create a token object, debug programs and replace a process-level token. However, the assignment of these rights can be audited. Answers A and D are incorrect; these are audit polices set at a domain level. They are not user right assignments.

6. Answer: C. It is equally important to audit both failed and successful events because both may reveal unauthorized access or an unexpected escalation of access rights. Answers A and B are incorrect because it is important to audit both types of events. Answer D is incorrect because auditing is an important part of securing the network.

7. Answer: B. Logging is the process of collecting data to be used for monitoring and reviewing purposes. Auditing is the process of verification that normally involves going through log files; therefore, answer A is incorrect. Answer C is incorrect. Baselining is measuring and rating the performance of a network. Typically, the log files are frequently inspected, and inspection is not the process of collecting the data; therefore, answer D is incorrect.

8. Answer: D. Turning on all audit counters for all objects could significantly impact server performance. Answer A is incorrect; auditing is done in the background and does not affect user productivity. Answer B is incorrect; if the I/O activity were affected at all, it would be increased. Answer C is incorrect; as with I/O activity, if there were change, it would be an increase, not a decrease.

9. Answer: A, C. Log files, physical records, security evaluations, and other operational documentation should be managed within an organization’s retention and disposal policies. These should include specifications for access authorization, term of retention, and requirements for disposal. Answers B and D are incorrect; software and user manuals are readily available from the vendors website and are not required in a retention and disposal policy.

10. Answer: D. The organization should change and adjust a data-retention policy when and as needed (with emphasis on when and as needed). There may be a reason to make new classifications as business goals change, but make sure this gets into the documentation. Answer A is incorrect. Data-retention policies must be reviewed on a regular basis. Answers B and C are incorrect; these review cycles are too short a period of time.

11. Answer: A. If an organization is sued by a former employee for wrongful termination, the department may be compelled during the discovery phase of the suit to produce all documents related to that individual’s work performance. This used to mean the records and copies of any written correspondence (memos, letters, and so on) concerning the performance of that employee. All data is subject to discovery regardless of storage format or location. Therefore, answers B and C are incorrect. Answer D is incorrect because the organizations can never arbitrarily decide what is and what is not discoverable.

12. Answer: B and D. The organization should have a legal hold policy in place, have an understanding of statutory and regulatory document retention requirements, understand the varying statues of limitations, have a policy, and have a records-retention and destruction schedule. Answer A is incorrect because ISPs do not impose data-retention requirements on customers. Answer C is incorrect because user requirements may be a consideration, but it not pertinent.

13. Answer: B. In Group Policy, the settings that will actually be applied to an object will be a combination of all the settings that can affect the object. Answer A is incorrect because all group policies are applied to the object. Answer C is incorrect; in a universal group, the policies may be applied from different domains. Answer D is incorrect; this would only apply if there was not a domain environment.

14. Answer: B. You can use gpresult to see what policy is in effect and to troubleshoot problems. Answer A is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer C is incorrect the Resultant Set of Policy (RSoP) tool is used to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer D is incorrect; the Group Policy object is used to create group polices.

15. Answer: A. You can use the Resultant Set of Policy (RSoP) tool to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer B is incorrect; the Group Policy object is used to create group polices. Answer C is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer D is incorrect; the local security settings are used on the local machine only.

16. Answer: B. The organization should audit success events in the policy change event category on domain controllers. A logged event indicates someone has changed the local security authority (LSA). Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.

17. Answer: C. Auditing success events in the account management event category can be used to verify changes that were made to account properties and group properties. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.

18. Answer: A. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.

19. Answer: D. Auditing success events in the logon event category records when each user logs on to or logs off from the computer. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties.

20. Answer: C. Auditing success events in the account logon event category on domain controllers is used to verify when users log on to or log off from the domain. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.12.108.86