CompTIA Security+ SY0-201 Practice Questions: Assessment and Audits

This chapter is from the book

CompTIA Security+ SY0-201 Practice Questions Exam Cram, 2nd Edition

Learn More Buy

This chapter is from the book

This chapter is from the book 

CompTIA Security+ SY0-201 Practice Questions Exam Cram, 2nd Edition

Learn More Buy

Answers and Explanations

Objective 4.1 Conduct risk assessments and implement risk mitigation.

1. Answer: C. Metrics for security baselines and hardening efforts rely on identification of vulnerability and risk. It is necessary to have some mechanism for measuring vulnerability to determine whether a baseline has been met, or if a new security measure has been effective. Answer A is incorrect because mitigation of threats and attacks are not related to metrics. Answer B is incorrect because security policies are not related to metrics. Answer D is incorrect; mitigation of vulnerability and risk is not related to metrics.
2. Answer: B. A risk, once identified, can be dealt with in several ways. A risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
3. Answer: C. A risk, once identified, can be dealt with in several ways. Some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
4. Answer: D. A risk, once identified, can be dealt with in several ways. Most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices.
5. Answer: A. A risk, once identified, can be dealt with in several ways. Some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
6. Answer: D. Before any baseline can be established, beyond those developed by regulatory bodies outside of the business entity, a risk assessment must be conducted to identify existing risks and potential mitigation mechanisms. Answer A is incorrect. This is not a good policy and is not included is a risk assessment. Answer B is incorrect; it describes a vulnerability assessment. Answer C is incorrect; personally identifiable information may be part of the risk assessment, but is it not the main purpose.
7. Answer: A. Annual loss expectancy (ALE) equals the single loss expectancy (SLE) times the annualized rate of occurrence (ARO): SLE × ARO = ALE. Based on the previous formula, answers B, C, and D are incorrect.
8. Answer: B. SLE equals asset value multiplied by the threat exposure factor or probability. Answer A is incorrect because it describes return on investment (ROI). Answer C is incorrect because it describes risk. Answer D is incorrect because it describes annualized rate of occurrence. The ARO is the estimated possibility of specific threat taking place in a one-year time frame.
9. Answer: A. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because risk analysis helps align security objectives with business objectives. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.
10. Answer: C. Risk analysis helps align security objectives with business objectives. Risk analysis identifies risks, estimates the impact of potential threats, and identifies ways to reduce the risk without the cost of the prevention outweighing the risk. Answer A is incorrect. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.
11. Answer: C. Risk is the possibility of loss or danger. Answer A is incorrect because the exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer B is incorrect; the cumulative loss expectancy (CLE) is a risk model that calculates risk based on single systems. Answer D is incorrect because mitigation comes after risk is identified and assessed.
12. Answer: A, B, D. During the process of risk assessment, it is necessary to review many areas, such as the following: methods of access, authentication schemes, audit policies, hiring and release procedures, isolated services that may provide a single point of failure or avenue of compromise and data or services requiring special backup or automatic failover support. Answer C is incorrect. Financial records review is not a necessary part of risk assessment, but how well that data is protected may be.
13. Answer: D. Return on investment is the ratio of money realized or unrealized on an investment relative to the amount of money invested. Answer A is incorrect because it describes risk analysis. Answer B is incorrect because it describes risk management. Answer C is incorrect because it describes return on capital.
14. Answer: B. Return in investment is equal to the loss prevented minus the cost of solution. If the result of this formula is a negative number, you spent more than the loss prevented. Therefore, answer A is incorrect. Answers C and D are incorrect because depending on what the investment is, it may or may not be a good investment and might be necessary due to regulations.
15. Answer: C. The exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer A is incorrect because it describes vulnerability. Answer B is incorrect because it describes reduced risk on investment. Answer D is incorrect because it describes annual rate of occurrence.

Objective 4.2: Carry out vulnerability assessments using common tools.

1. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services.
2. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.
3. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
4. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses testing for the present of known vulnerabilities in software configuration and accessible services.
5. Answer: D. Open Vulnerability Assessment Language (OVAL) is intended as an international language for representing vulnerability information using an XML schema for expression, allowing tools to be developed to test for identified vulnerabilities in the OVAL repository. Answer A is incorrect because it describes the Open Systems Interconnection reference model (OSI model). Answer B is incorrect because it describes IEEE 802 standards. Answer C is incorrect because it describes the International Organization for Standardization (ISO).
6. Answer: A. Within U.S. Governmental agencies, vulnerability may be discussed using the Open Vulnerability Assessment Language (OVAL) sponsored by the Department of Homeland Security’s National Cyber Security Division (NCSD). Answer B is incorrect because IEEE refers to a family of IEEE standards dealing with local area networks and metropolitan area networks. Answer C is incorrect because the International Organization for Standardization, widely known as ISO, is an international-standard-setting body composed of representatives from various national standards organizations. Answer D is incorrect because the Information Systems Security Association is a security-focused group.
7. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Port scanners are useful in creating an inventory of services hosted on networked systems. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
8. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
9. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.
10. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
11. Answer: C. A password cracker is a software utility that allows direct testing of user logon password strength by conducting a brute-force password test using dictionary terms, specialized lexicons, or mandatory complexity guidelines. Answer A is incorrect. Password Locker is a commercial program that lets you save passwords, recover passwords, and manage and form-fill all your usernames and passwords. Answer B is incorrect because a password generator creates random passwords. Answer D is incorrect. A password keychain, most commonly found on Apple computers, keeps track of your passwords for any type of account.
12. Answer: A. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answers B, C, and D are incorrect because they do not accurately describe port scanners or vulnerability scanners.
13. Answer: D. Password crackers should provide only the relative strength of a password, rather than the password itself, to avoid weakening logon responsibility under evidentiary discovery actions. Answers A, B, and C are incorrect because password crackers should not provide the password itself to avoid disclosure under e-discovery proceedings.
14. Answer: B. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. This information can be used to identify single points of failure, conduct a network inventory, and create graphical details suitable for reporting on network configurations. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
15. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.

Objective 4.3: Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

1. Answer: B. Friendly attacks against a network to test the security measures put into place. Such attacks are referred to as penetration tests or simply “pen tests.” Answer A and C are incorrect because a vulnerability assessment or a security assessment are not directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Answer D is incorrect because a compliance test has nothing to do with penetration testing.
2. Answer: A, C. Penetration tests may cause some disruption to network operations as a result of the actual penetration efforts conducted. Penetration tests can also make legitimate attacks by generating false data in intrusion detection systems/intrusion prevention systems (IDS/IPS). Answers B and D are incorrect; although internal and external users may be affected, these are not the most serious downsides of penetration testing.
3. Answer: B, C. Some systems administrators may perform amateur pen tests against networks in an attempt to prove a particular vulnerability exists or to evaluate the overall security exposure of a network. This is a bad practice because it generates false intrusion data, may weaken the network’s security level, and may be a violation of privacy laws, regulatory mandates, or business entity guidelines. Answers A and D are incorrect because the statements are contrary to the correct answers.
4. Answer: D. Vulnerability assessments may be complemented by directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Penetration testing includes all of the process in vulnerability assessment plus an important extra step, which is to exploit the vulnerabilities found in the discovery phase. Based in the previous information, answers A, B, and C are incorrect.
5. Answer: A. Penetration tests can also make legitimate attacks by generating false data in IDS systems, concealing aggression that is otherwise unrelated to the officially sanctioned penetration test. Answers B and C are incorrect; although they are both concerns, they are not the main security risk. Answer D is incorrect; penetration testing itself does not weaken the network’s security level; however amateur pen testing can.

Objective 4.4: Use monitoring tools on systems and networks and detect security-related anomalies.

1. Answer: D. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host. It is a good troubleshooting tool to tell whether a route is available to a host. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.
2. Answer: A. The traceroute utility traces the route a packet takes and records the hops along the way. This is a good tool to use to find out where a packet is getting hung up. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
3. Answer: C. nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
4. Answer: B. netstat displays all the ports on which the computer is currently listening. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
5. Answer: B. ipconfig is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect; the traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect; ifconfig is used to display the TCP/IP settings on a UNIX machine.
6. Answer: D. It is common practice to block ICMP traffic on routers and firewalls. The devices can be configured to block ICMP PING request packets. Answers A and C are incorrect because the host and the host network may be available. Answer B is incorrect because DNS traffic has nothing to do with ping.
7. Answer: C. Benchmarking determines how much of a load the server can handle by comparing two or more systems or components of a system. Answer A is incorrect because it describes a baseline. Answer B is incorrect because it describes performance tuning. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.
8. Answer: A. The measure of normal activity is known as a baseline. Answer B is incorrect because it describes performance tuning. Answer C is incorrect because it describes a benchmark. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.
9. Answer: A. Ping uses the Internet Control Message Protocol (ICMP) and is a network layer test of whether a remote host is alive. A small packet containing an ICMP echo request message is sent through the network to a particular IP address. Answer B is incorrect because Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.
10. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
11. Answer: A. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
12. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
13. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.
14. Answer: C. The security log records security events and is available for viewing only by administrators. For security events to be monitored, you must enable auditing. Based on this information, answers A, B, and D are incorrect.
15. Answer: B. Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer A is incorrect Internet Control Message Protocol (ICMP) and is a network layer protocol used to test remote connectivity. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.
16. Answer: A. The kernel level is the execution profile. It is here that malicious software such as rootkits operate. Answer B is incorrect; the network-level profile consists of the assembly and transport of data packets. Answer C is incorrect because all applications generate a normal profile of behavior. Changes in the normal application behavior warrants further investigation for a compromise. Answer D is incorrect; at the shell level, each user generates a standard profile representing the normal activities that are routine for that person.
17. Answer: A. Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
18. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
19. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.
20. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. A protocol analyzer, otherwise known as a packet sniffer, is used to capture network traffic and generate statistics for creating reports. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation.
21. Answer: D. ipconfig is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.
22. Answer: A. The traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.
23. Answer: C. nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat displays all the ports on which the computer is currently listening. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.
24. Answer: B. netstat displays all the ports on which the computer is currently listening. Answer A is incorrect. The traceroute utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig is used to display the TCP/IP settings on a Windows machine.
25. Answer: B, D. Baselines must be updated on a regular basis, and certainly when the network has changed or new technology has been deployed. An initial baseline should be done for both network and application processes so that you can tell whether you have a hardware or software issue. Based on the previous statement, answers A and C are incorrect.

Objective 4.5: Compare and contrast various types of monitoring methodologies.

1. Answer: B. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.
2. Answer: D. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic.
3. Answer: C. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.
4. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, and DoS attacks based on payloads or volume. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
5. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. This monitoring method can be used to identify internal misuse by recognizing actions outside of normal access patterns or authorized events occurring outside of normal profile usage, such as the access of protected files during off-hours. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
6. Answer: A. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The problem is that they can detect only known attacks with identified signatures. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
7. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
8. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. It is not dependent on OS-specific mechanisms. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
9. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Detection of anomalies is used in many security domains, ranging from video surveillance and security systems to intrusion detection and fraudulent transactions. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
10. Answer: B. The classifications of anomaly detection techniques include statistical methods, rule-based methods, distance-based methods, profiling methods, and model-based approaches. For example, under the profiling method, normal behavior can be programmed based on offline research, or the system can learn behavior while processing network traffic. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
11. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
12. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly detection is analogous to credit card fraud detection. Credit card companies maintain “spending profiles” for their customers. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
13. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. A behavior-based detector determines whether a program is malicious by inspecting the stream of system calls that the program issues to the operating system. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
14. Answers: B, C. Behavior based detection has several limitations, including high incidence of false alarms and slow file checking. Answers A and D are incorrect because they are associated with signature-based monitoring solutions.
15. Answer: A, D. Signature-based detection has several limitations, including being based excessively on passive monitoring and the rule sets need constant updating. Answers B and C are incorrect because they are associated with behavior-based monitoring solutions.
16. Answer: A, C. Behavior-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers B and D are incorrect because they are advantages associated with signature-based monitoring.
17. Answer: B, D. Signature-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers A and C are incorrect because they are advantages associated with behavior-based monitoring.
18. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Because this method detects anomalies, it is also called statistical anomaly detection. Highly secure environments might use complex patterns of behavior analysis, in some cases learning individual patterns of use common to each user profile, so that variations can be identified. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
19. Answer: A, B. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, DoS attacks based on payloads or volume, normal network failures, and variants of existing attacks in new environments. Answers C and D are incorrect; they are associated with signature-based monitoring.
20. Answer: C, D. In signature-based monitoring, the user can examine the signature database, and quickly determine which intrusive activity the misuse detection system is programmed to alert on. Another benefit is that it can accurate detect know malicious software. Answers A and B are incorrect; they are associated with anomaly-based monitoring.

Objective 4.6: Execute proper logging procedures and evaluate the results.

1. Answer: B. Logging is the process of collecting data to be used for monitoring and auditing purposes. Answer A is incorrect because it describes baselining. Answer C is incorrect because it describes auditing. Answer D is incorrect because it describes monitoring.
2. Answer: A. Logging procedures and evaluation are an important part of keeping your network safe. However, before you can configure logging, it is essential to identify what is typical behavior for your network. Answers B, C, and D are incorrect; all these functions are performed after logging is enabled.
3. Answer: B. When choosing what to log, be sure you choose carefully. Logs take up disk space and use system resources. They also have to be read; and if you log too much, will bog down the system, and it will take a long time to weed through the log files to determine what is important. Therefore, answers A, C, and D are incorrect.
4. Answer: C. To improve server performance, logs should be stored on a nonsystem striped or striped/mirrored disk volume. Answer A is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable. Answers B and D are incorrect; storing the log files on the local machine will not improve performance.
5. Answer: D. Log files should be stored in a centralized repository of an offline volume or on a standalone computer. Answer A is incorrect; storing the log files on the local machine will not improve security. Answer B is incorrect. Storing the log files on the Intranet is poor practice as the information is visible and more vulnerable. Answer C is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable.
6. Answer: C. When implementing an application logging strategy, look for a solution that uses standard protocols and formats so that analysis is simpler. Therefore, answers A, B, and D are incorrect.
7. Answer: A. Should you choose to use manual analysis, consider creating the logs in a format that is can readily be parsed, such as comma-separated value (CSV). Doing so will allow for more flexibility when importing the information into applications for analysis. Answers B, C, and D are incorrect because none of these formats are readily parsed.
8. Answer: C, D. Standards should be implemented for the types of events you want to log based on business, technical, and regulatory requirements, and the threats the organization faces. Answer A is incorrect because although user needs should be considered, logging standards should not be based on them. Answer B is incorrect; vendor requirements have nothing to do with organizational logging standards.
9. Answer: A. Not only do you need to read the logs, you may also have to know how to correlate events examining output. Answers B, C, and D are incorrect; they are not pertinent to being able to decipher log files.
10. Answer: A, B, D. IIS logs may include information about site visitors and their viewing habits. They can be used to assess content, identify bottlenecks, or investigate attacks. Answer C is incorrect. Task Manager is a tool that you can use to end processes.
11. Answer: D. DNS logging may cause performance degradation on the server. It should be used only for troubleshooting purposes. By enabling DNS debug logging, you can log all DNS-related information. Based on this information, answers A, B, and C are incorrect.
12. Answer: B. The DNS server log contains events logged by the DNS Server service. For example, when the DNS server starts or stops, a corresponding event message is written to this log. This should be the first place you look when troubleshooting DNS-related issues. Answer A is incorrect. By enabling DNS debug logging, you can log all DNS-related information. Answer C is incorrect. Syslog channels are used for BIND logging. Answer D is incorrect. The Event Viewer Application log will not provide enough detailed information.
13. Answer: D. In UNIX- or Linux-based systems, programs send log entries to the system logging daemon, syslogd. Answer A is incorrect because mtools.conf is a configuration file for all the operations. Answers B and C are incorrect; both Msconfig and Event Viewer are tools used on Windows-based systems.
14. Answer: B, C. You should employ strict access controls on all logging servers. If allowable, encrypt the log files and store log files on a stand-alone system. Answer A is incorrect; it is not good practice to store log files in plain text. Answer D is incorrect; log files should not be stored on data partitions of individual systems.
15. Answer: B. Task Manager is a tool that you can use to end processes or applications that get hung up or cause the operating system to become unstable, without having to reboot the machine. It also gives you an instant view of CPU and memory usage. Answer A is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer C is incorrect because Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer D is incorrect because Microsoft’s Performance console is used for tracking and viewing the utilization of system resources.
16. Answer: C. Authentication and accounting logging is particularly useful for troubleshooting remote-access policy issues. Answer A is incorrect because Internet Information Services (IIS) logging is designed to be more detailed than the event-logging or performance-monitoring features of Windows Server operating systems. The IIS logs can include information such as who has visited your site, what they viewed, and when the information was viewed last. Answer B is incorrect because critical and error level logging is one of the eight different logging levels available for Cisco logging devices. Answer D is incorrect because authentication and accounting logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log.
17. Answer: C, D. The following are some events you should to take a closer look at: repeated traffic to particular ports, blocked attempts, and suspicious signatures. Answer A is incorrect because port 25 is used for SMTP traffic. Answer B is incorrect because HTTP traffic is used for web access.
18. Answer: B, C. If a firewall log shows repeated traffic to particular ports, this can indicate a DoS or distributed DoS (DDoS) attack. When there is repeated traffic on port 53, the attacker is probably trying to overwhelm the DNS service. Answers A and D are incorrect because these attacks are associated with web browsers and servers.
19. Answer: A, C, D. Antivirus software, just like other software applications, usually contain a folder within the application for logging events such as updates, quarantined viruses, and update history. Answer B is incorrect. Dropped packets are normally found in router logs.
20. Answer: B. Routing and remote access logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log. Therefore, Answer D is incorrect. Answer A is incorrect; firewall logging will not log remote access and authentication. Answer C is incorrect; IIS logging will not log remote access and authentication.

Objective 4.7: Conduct periodic audits of system security settings.

1. Answer: C. Auditing is the process of tracking users and their actions on the network. Answer A is incorrect because it describes baselining. Answer B is incorrect because it describes logging. Answer D is incorrect because it describes monitoring.
2. Answer: A, B. Without proper planning and policies, you probably will quickly fill your log files and hard drives with useless or unused information. The more quickly you fill up your log files, the more frequently you need to check the logs; otherwise, important security events may get deleted unnoticed. Answer C is incorrect because log files should not be stored on user hard drives. Answer D is incorrect. When auditing is not clear-cut, the workload of the system administrator increases.
3. Answer: B, C. Auditing user privileges is generally a two-step process that involves enabling auditing within the operating system and then specifying the resources to be audited. Answer A is incorrect; auditing not logging needs to be enabled. Answer D is incorrect; the log file storage directory is specified not the audit file directory.
4. Answer: D. Auditing of access use and rights changes should be implemented to prevent unauthorized or unintentional access for a guest or restricted user account access to sensitive or protected resources. Answer A is incorrect; group policy controls access to resources. Answer B is incorrect; retention polices concern data not user access. Answer C is incorrect; DHCP deals with the issuing of IP addresses not access to accounts.
5. Answer: B, C. The following user rights are never audited, mainly because they are used by processes: bypass traverse checking, generate security audits, create a token object, debug programs and replace a process-level token. However, the assignment of these rights can be audited. Answers A and D are incorrect; these are audit polices set at a domain level. They are not user right assignments.
6. Answer: C. It is equally important to audit both failed and successful events because both may reveal unauthorized access or an unexpected escalation of access rights. Answers A and B are incorrect because it is important to audit both types of events. Answer D is incorrect because auditing is an important part of securing the network.
7. Answer: B. Logging is the process of collecting data to be used for monitoring and reviewing purposes. Auditing is the process of verification that normally involves going through log files; therefore, answer A is incorrect. Answer C is incorrect. Baselining is measuring and rating the performance of a network. Typically, the log files are frequently inspected, and inspection is not the process of collecting the data; therefore, answer D is incorrect.
8. Answer: D. Turning on all audit counters for all objects could significantly impact server performance. Answer A is incorrect; auditing is done in the background and does not affect user productivity. Answer B is incorrect; if the I/O activity were affected at all, it would be increased. Answer C is incorrect; as with I/O activity, if there were change, it would be an increase, not a decrease.
9. Answer: A, C. Log files, physical records, security evaluations, and other operational documentation should be managed within an organization’s retention and disposal policies. These should include specifications for access authorization, term of retention, and requirements for disposal. Answers B and D are incorrect; software and user manuals are readily available from the vendors website and are not required in a retention and disposal policy.
10. Answer: D. The organization should change and adjust a data-retention policy when and as needed (with emphasis on when and as needed). There may be a reason to make new classifications as business goals change, but make sure this gets into the documentation. Answer A is incorrect. Data-retention policies must be reviewed on a regular basis. Answers B and C are incorrect; these review cycles are too short a period of time.
11. Answer: A. If an organization is sued by a former employee for wrongful termination, the department may be compelled during the discovery phase of the suit to produce all documents related to that individual’s work performance. This used to mean the records and copies of any written correspondence (memos, letters, and so on) concerning the performance of that employee. All data is subject to discovery regardless of storage format or location. Therefore, answers B and C are incorrect. Answer D is incorrect because the organizations can never arbitrarily decide what is and what is not discoverable.
12. Answer: B and D. The organization should have a legal hold policy in place, have an understanding of statutory and regulatory document retention requirements, understand the varying statues of limitations, have a policy, and have a records-retention and destruction schedule. Answer A is incorrect because ISPs do not impose data-retention requirements on customers. Answer C is incorrect because user requirements may be a consideration, but it not pertinent.
13. Answer: B. In Group Policy, the settings that will actually be applied to an object will be a combination of all the settings that can affect the object. Answer A is incorrect because all group policies are applied to the object. Answer C is incorrect; in a universal group, the policies may be applied from different domains. Answer D is incorrect; this would only apply if there was not a domain environment.
14. Answer: B. You can use gpresult to see what policy is in effect and to troubleshoot problems. Answer A is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer C is incorrect the Resultant Set of Policy (RSoP) tool is used to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer D is incorrect; the Group Policy object is used to create group polices.
15. Answer: A. You can use the Resultant Set of Policy (RSoP) tool to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer B is incorrect; the Group Policy object is used to create group polices. Answer C is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer D is incorrect; the local security settings are used on the local machine only.
16. Answer: B. The organization should audit success events in the policy change event category on domain controllers. A logged event indicates someone has changed the local security authority (LSA). Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
17. Answer: C. Auditing success events in the account management event category can be used to verify changes that were made to account properties and group properties. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
18. Answer: A. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
19. Answer: D. Auditing success events in the logon event category records when each user logs on to or logs off from the computer. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties.
20. Answer: C. Auditing success events in the account logon event category on domain controllers is used to verify when users log on to or log off from the domain. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.