Which of the following terms refers to the process in which headers and trailers are added around user data?
You work as a Network Administrator for Net Perfect Inc. The company has a Linux-based network. You have created a folder named Report. You have made David the owner of the folder. The members of a group named JAdmin can access the folder and have Read, Write, and Execute permissions. No other user can access the folder. You want to ensure that the members of the JAdmin group do not have Write permission on the folder. Also, you want other users to have Read permission on the Report folder.
Which of the following commands will you use to accomplish the task?
Which of the following would be used to explicitly deny the traffic from a foreign IP address scanning the EC2 Instances in a VPC?
Which of the following statements about policy is FALSE?
What is the key difference between Electronic Codebook mode and other block cipher modes like Cipher Block Chaining, Cipher-Feedback and Output-Feedback?
What is the name of the registry key that is used to manage remote registry share permissions for the whole registry?
Which of the following authentication methods are used by Wired Equivalent Privacy (WEP)? Each correct answer represents a complete solution. Choose two.
You are the security director for an off-shore banking site. From a business perspective, what is a major factor to consider before running your new vulnerability scanner against the company's business systems?
What is the main reason that DES is faster than RSA?
Which of the following is a Personal Area Network enabled device?
How can an adversary utilize a stolen database of unsalted password hashes?
In preparation to do a vulnerability scan against your company's systems. You've taken the steps below:
You've notified users that there will be a system test.
You've priontized and selected your targets and subnets.
You've configured the system to do a deep scan.
You have a member of your team on call to answer questions.
Which of the following is a necessary step to take prior to starting the scan?
When file integrity checking is enabled, what feature is used to determine if a monitored file has been modified?
Use sudo to launch Snort with the, /etc /snort /snort.conf file In full mode to generate alerts based on incoming traffic to echo. What is the source IP address of the traffic triggering an alert with a destination port of 156?
Note: Snort Is configured to exit after It evaluates 50 packets.
Which of the following Unix syslog message priorities is the MOST severe?
Which of the following is referred to as Electromagnetic Interference (EMI)?
Against policy, employees have installed Peer-to-Peer applications on their workstations and they are using them over TCP port 80 to download files via the company network from other Peer-to-Peer users on the Internet. Which of the following describes this threat?
Jonny Is an IT Project Manager. He cannot access the folder called "IT Projects" but can access a folder called "Sales Data" even though he's not on the sales team. Which information security principle has failed?
Which of the following SIP methods is used to setup a new session and add a caller?
Which of the following statements about DMZ are true?
Each correct answer represents a complete solution. Choose two.
A new data center is being built where customer credit information will be processed and stored. Which of the following actions will help maintain the confidentiality of the data?
How are differences in configuration settings handled between Domain and Local Group Policy Objects (GPOs)?
You work as an Administrator for McRoberts Inc. The company has a Linux-based network. You are logged in as a non-root user on your client computer. You want to delete all files from the /garbage directory. You want that the command you will use should prompt for the root user password. Which of the following commands will you use to accomplish the task?
What is log, pre-processing?
What is the following sequence of packets demonstrating?
What is the SHA1 hash of the Ale /bin/Is?
Which class of IDS events occur when the IDS fails to alert on malicious data?
SSL session keys are available in which of the following lengths?
Which of the following is an advantage of private circuits versus VPNs?
What type of malware is a self-contained program that has the ability to copy itself without parasitically infecting other host code?
If the NET_ID of the source and destination address in an IP (Internet Protocol) packet match, which answer BEST describes the routing method the sending host will use?
What is the most secure way to address an unused Windows service so it cannot be exploited by malware?
Which of the following are the types of access controls?
Each correct answer represents a complete solution. Choose three.
Which of the following tools is also capable of static packet filtering?
Launch Calculator (calc.exe). Using PowerShell, retrieve the Calculator Process Information. What is the value of the File Version property?
Hint: The process name of Calculator is calculator
On an NTFS file system, what will happen when a conflict exists between Allow and Deny permissions?
Which practice can help protect secrets in a cloud environment?
You work as a Network Administrator for NetTech Inc. When you enter http://66.111.64.227 in the browser 's address bar, you are able to access the site. But, you are unable to access the site when you enter http://www.uCertify.com. What is the most likely cause?
Many IIS servers connect to Microsoft SQL databases. Which of the following statements about SQL server security is TRUE?
Use PowerShell ISE to
examineC:\Windows\security\templates\WorkstationSecureTemplate.inf. Which setting is configured in the template?
You work as a Network Administrator for Tech2tech Inc. You have configured a network-based IDS for your company. You have physically installed sensors at all key positions throughout the network such that they all report to the command console.
What will be the key functions of the sensors in such a physical layout?
Each correct answer represents a complete solution. Choose all that apply.
Why are false positives such a problem with IPS technology?
Which of the following is a benefit to utilizing Cygwin for Windows?
A Network Engineer is charged with maintaining and protecting a network with a high availability requirement. In addition to other defenses, they have chosen to implement a NIPS. How should the NIPS failure conditions be configured to ensure availability if the NIPS is installed in front of the Firewall that protects the DMZ?
What is the term for a game in which for every win there must be an equivalent loss?
What requirement must an administrator remember when utilizing Security Configuration and Analysis (SCA) to apply security templates to Windows systems?
You work as a Network Administrator for Secure World Inc. The company has a Linux-based network. You want to run a command with the changed root directory. Which of the following commands will you use?
Dilbert wants to have a script run on his Windows server every time Wally logs into it. Where should he place this script?
Which Windows event log would you look in if you wanted information about whether or not a specific diver was running at start up?
Which of the following statements would be seen in a Disaster Recovery Plan?
Why would someone use port 80 for deployment of unauthorized services?
Use nmap to discover a host on the 10.10.10.0/24 network, scanning only port 8082 and using the SYN or Stealth scan approach. Which host has a service called -blackice-alerts"?
Which of the following logging tasks should be evaluated in real-time?
You ask your system administrator to verify user compliance with the corporate policies on password strength, namely that all passwords will have at least one numeral, at least one letter, at least one special character and be 15 characters long. He comes to you with a set of compliance tests for use with an offline password cracker. They are designed to examine the following parameters of the password:
* they contain only numerals
* they contain only letters
* they contain only special characters
* they contain only letters and numerals
" they contain only letters and special characters
* they contain only numerals and special characters
Of the following, what is the benefit to using this set of tests?
You work as a Network Administrator for McNeil Inc. The company has a Windows Server 2008 network environment. The network is configured as a Windows Active Directory-based single forest domain-based network. The company's management has decided to provide laptops to its sales team members. These laptops are equipped with smart card readers. The laptops will be configured as wireless network clients. You are required to accomplish the following tasks:
The wireless network communication should be secured.
The laptop users should be able to use smart cards for getting authenticated. In order to accomplish the tasks, you take the following steps:
Configure 802.1x and WEP for the wireless connections. Configure the PEAP-MS-CHAP v2 protocol for authentication. What will happen after you have taken these steps?
Which of the following SIP INVITE lines indicates to the remote registrar the VoIP phone that initiated the call?
Analyze the screenshot below. What is the purpose of this message?
Which of the following languages enable programmers to store cookies on client computers? Each correct answer represents a complete solution. Choose two.
What is it called when an OSI layer adds a new header to a packet?
What is the name of the command-line tool for Windows that can be used to manage audit policies on remote systems?
Which of the following is a private, RFC 1918 compliant IP address that would be assigned to a DHCP scope on a private LAN?
Critical information is encrypted within an application accessible only to a small group of administrators, with a separate group of administrators holding the decryption keys. What Defense in Depth approach is being used?
Which of the following best describes the level of risk associated with using proprietary crypto algorithms.?
The Return on Investment (ROI) measurement used in Information Technology and Information Security fields is typically calculated with which formula?
Which of the following statements about Secure Sockets Layer (SSL) are true? Each correct answer represents a complete solution. Choose two.
What is needed for any of the four options for Azure AD multi-factor user authentication?
Which of the following terms is used for the process of securing a system or a device on a network infrastructure?
Which of the following is an UDP based protocol?
Where could you go in Windows XP/2003 to configure Automatic Updates?
When discussing access controls, which of the following terms describes the process of determining the activities or functions that an Individual is permitted to perform?
The Windows 'tracert' begins by sending what type of packet to the destination host?
What is a security feature available with Windows Vista and Windows 7 that was not present in previous Windows operating systems?
Analyze the screenshot below. In what order should the vulnerabilities be remediated?
You have an automated system for patching the operating systems of all your computers. All patches are supposedly current. Yet your automated vulnerability scanner has just reported vulnerabilities that you believe have been patched. Which of the actions below should you take next?
Which Defense-in-Depth principle starts with an awareness of the value of each section of information within an organization?
During a scheduled evacuation training session the following events took place in this order:
1. Evacuation process began by triggering the building fire alarm.
2a. The meeting point leader arrived first at the designated meeting point and immediately began making note of who was and was not accounted for.
2b. Stairwell and door monitors made it to their designated position to leave behind a box of flashlights and prop the stairway doors open with a garbage can so employees can find exits and dispose of food and beverages.
2c. Special needs assistants performed their assigned responsibility to help employees out that require special assistance.
3. The safety warden communicated with the meeting point leader via walkie talkie to collect a list of missing personnel and communicated this information back to the searchers.
4. Searchers began checking each room and placing stick-it notes on the bottom of searched doors to designate which areas were cleared.
5. All special need assistants and their designated wards exited the building.
6. Searchers complete their assigned search pattern and exit with the Stairwell/door monitors.
Given this sequence of events, which role is in violation of its expected evacuation tasks?
Which of the following networking topologies uses a hub to connect computers?
Which of the following elements is the most important requirement to ensuring the success of a business continuity plan?
What protocol is a WAN technology?
You work as a Network Administrator for Net World Inc. The company has a Linux-based network. You are optimizing performance and security on your Web server. You want to know the ports that are listening to FTP. Which of the following commands will you use?
What security practice is described by NIST as the application of science to the identification, collection, examination, and analysis of data while maintaining data integrity and chain of custody?
Which of the following attacks can be mitigated by avoiding making system calls from within a web application?
Which of the following is a potential WPA3 security issue?
Which of the following commands is used to change file access permissions in Linux?
A folder D:\Files\Marketing has the following NTFS permissions:
• Administrators: Full Control
• Marketing: Change and Authenticated
• Users: Read
It has been shared on the server as "MARKETING", with the following share permissions:
• Full Control share permissions for the Marketing group
Which of the following effective permissions apply if a user from the Sales group accesses the \\FILESERVER\MARKETING shared folder?
The previous system administrator at your company used to rely heavily on email lists, such as vendor lists and Bug Traq to get information about updates and patches. While a useful means of acquiring data, this requires time and effort to read through. In an effort to speed things up, you decide to switch to completely automated updates and patching. You set up your systems to automatically patch your production servers using a cron job and a scripted apt-get upgrade command. Of the following reasons, which explains why you may want to avoid this plan?
What is the motivation behind SYN/FIN scanning?
Which of the following is a required component for successful 802.lx network authentication?
How is confidentiality disabled in the IPSec Encapsulated Security Payload protocol?
Which of the following is a benefit of using John the Ripper for auditing passwords?
Which of the following is TRUE regarding Ethernet?
Which of the following files contains the shadowed password entries in Linux?
You have been hired to design a TCP/IP-based network that will contain both Unix and Windows computers. You are planning a name resolution strategy. Which of the following services will best suit the requirements of the network?
You are reviewing a packet capture file from your network intrusion detection system. In the packet stream, you come across a long series of "no operation" (NOP) commands. In addition to the NOP commands, there appears to be a malicious payload. Of the following, which is the most appropriate preventative measure for this type of attack?
There is not universal agreement on the names of the layers in the TCP/IP networking model. Which of the following is one of the functions of the bottom layer which is sometimes called the Network Access or Link Layer?
The TTL can be found in which protocol header?
Which Terraform command should be run immediately after creating a new configuration file for a cloud-based virtual machine?
Which of the following applications cannot proactively detect anomalies related to a computer?
Which of the following statements about IPSec are true?
Each correct answer represents a complete solution. Choose two.
In the directory C:\lmages\steer there Is an Image file lmage_4240.png with a data string encoded inside the file. What word is hidden in the file?
You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet capture, you see the malware is attempting to do a DNS query for a server called iamabadserver.com so that it can connect to it. There is no DNS server on the test network to do name resolution. You have another computer, whose IP is 192.168.1.115, available on the test network that you would like for the malware connect to it instead. How do you get the malware to connect to that computer on the test network?
Which file would the entry below be found in?
net.ipv6.conf.all.acctpt-ra=0
Which of the following is a signature-based intrusion detection system (IDS) ?
What would the file permission example "rwsr-sr-x" translate to in absolute mode?
Based on the iptables output below, which type of endpoint security protection has host 192.168.1.17 implemented for incoming traffic on TCP port 22 (SSH) and TCP port 23 (telnet)?
Which of the following should be implemented to protect an organization from spam?
Which of the following applications would be BEST implemented with UDP instead of TCP?
A Host-based Intrusion Prevention System (HIPS) software vendor records how the Firefox Web browser interacts with the operating system and other applications, and identifies all areas of Firefox functionality. After collecting all the data about how Firefox should work, a database is created with this information, and it is fed into the HIPS software. The HIPS then monitors Firefox whenever it's in use. What feature of HIPS is being described in this scenario?
You are an Intrusion Detection Analyst and the system has alerted you to an Event of Interest (EOI) that appears to be activity generated by a worm. You investigate and find that the network traffic was normal. How would this type of alert be categorized?
An organization keeps its intellectual property in a database. Protection of the data is assigned to one system administrator who marks the data, and monitors for this intellectual property leaving the network. Which defense-In-depth principle does this describe?
Use Hashcat to crack a local shadow file. What Is the password for the user account AGainsboro?
Hints
Hints
• The shadow file (shadow) and Hashcat wordlist (gsecwordlist.txt) are located in the directory. home giac PasswordHashing
- Run Hashcat in straight mod* (flag -a 0) to crack the MD5 hashes (flag -m 500) in the shadow file.
• Use the hash values from the Hashcat output file and the shadow file to match the cracked password with the user name.
• If required, a backup copy of the original files can be found in the shadowbackup directory.
Which of the following proxy servers provides administrative controls over the content?
Analyze the following screenshot. What conclusion can be drawn about the user account shown?
What is SSL primarily used to protect you against?
You work as a Network Administrator for McNeil Inc. The company has a Linux-based network. David, a Sales Manager, wants to know the name of the shell that he is currently using. Which of the following commands will he use to accomplish the task?