Security+ Sy0-301 Misc Q

Answer: B. Protocol analyzer. Explanation: A protocol analyzer will capture packets and timestamp each one. This tells you exactly what type of packets were captured and when. If the timestamps correspond to the network activity spikes, you know you have a match for the time. By digging into the packets with a protocol analyzer, you can find out exactly what type of traffic is causing the activity. Network mappers such as LanSurveyor locate all the hosts on a network. System Monitor is a program used by Linux, and performance monitor is a program used by Windows; both of these monitor a servers resources such as CPU, RAM, and hard drive.

Answer: C. Integrity. Explanation: Message authentication code (MAC) is a short piece of information that authenticates the message in an attempt to guarantee the messages data integrity. The MAC algorithm is sometimes referred to as a cryptographic hash function. Confidentiality needs to prevent the disclosure of information to unauthorized persons that can be done with encryption, not hashing. Fault tolerance is the capability for a server, network device, or entire network to continue functioning even if an error or attack occurs. Data recovery is necessary if a failure occurs that the network cannot recover from automatically. It is usually part of a disaster recovery plan.

Answer: A. AES. Explanation: The Advanced Encryption Standard (AES) is the best solution for this scenario. It uses the least amount of CPU resources yet is the most secure symmetric algorithm listed. SHA-1 is not a symmetric encryption algorithm; it is a hashing algorithm. 3DES is the predecessor to AES; it is not as secure or fast. RSA is an asymmetric encryption algorithm; it is secure but can use a lot of CPU resources.

Answer: D. Security log file. Explanation: The security log file shows any unauthorized changes to the resources that you decide to audit. These resources can include files, folders, printers, and so on. This can work only if object access auditing has been enabled, and if auditing has been turned on for the resource in question. The system log file logs information pertaining to drivers, operating system files, the kernel, and so on. The application log file logs information pertaining to applications such as Windows Explorer, the Command Prompt, and third-party applications. The directory services log file logs information pertaining to the active directory.

Answer: B. Key escrow.
Explanation: Key escrow should be implemented so that the governmental third party can be provided decryption keys as necessary. Key escrow is when certificate keys are held in the case that third parties such as government or other organizations need access to encrypted communications. Additional certificate authorities are normally implemented as a form of fault tolerance. To avoid single points of failure such as a single CA, certificate authorities can be organized in a hierarchical manner. Key recovery agents are configured if the lost or corrupted keys need to be restored. Certificate registration occurs when a user tries to access secure information and needs to apply for a certificate. The registration might be completed by the certificate authority or by a registration authority.

Answer: A. Shielding.
Explanation: Shielding is part of the TEMPEST standards. TEMPEST is a group of standards that refer to the investigations of conducted admissions from electrical and mechanical devices that may or may not compromise an organization. It is important to shield devices such as air conditioners to prevent electromagnetic interference to network devices and cabling. Our suppression deals with the prevention of fires. HVAC deals with heating, ventilation, and air-conditioning. Biometrics is the measurement of human characteristics, such as thumbprint scans and voice recognition.

Answers: B and D. Disable the USB root hub, and turn off USB in the BIOS. Explanation: The best way to disable USB flash drives is to turn off USB altogether in the BIOS; however, it can also be turned off by disabling one or more of the USB root hubs within Device Manager in Windows. Disabling the USB flash drive is the best solution when it comes to mitigating this threat. An antivirus scan might find viruses or other amounts contained within the USB flash drive; if USB flash drives must be used, it would be wise to set up automatic scanning of removable media before usage is allowed. Written policies are difficult to enforce; a better option would be to create a software-based policy on the network controlling server.

Answer: D. Security log file. Explanation: The security log file shows any unauthorized changes to the resources that you decide to audit. These resources can include files, folders, printers, and so on. This can work only if object access auditing has been enabled, and if auditing has been turned on for the resource in question. The system log file logs information pertaining to drivers, operating system files, the kernel, and so on. The application log file logs information pertaining to applications such as Windows Explorer, the Command Prompt, and third-party applications. The directory services log file logs information pertaining to the active directory.

Explanation: The Secure Shell (SSH) protocol is assigned to port 22 by default. This network protocol is used to exchange data over a secure channel between two network devices. The SSH protocol provides two versions, SSH1 and SSH2. SSH2 provides several improvements over SSH1 in regards to its design and flexibility.

Correct Option(s):

b) Port 22

Incorrect Option(s):

a) Port 443 - Port 443 is used by the Hypertext Transfer Protocol Secure (HTTPS). HTTPS provides encrypted communication between web servers by combining Hypertext Transfer Protocol (HTTP) and Transport Layer Security (TLS)/Secure Sockets Layer (SSL).
c) Port 21 - Port 21 is used by the File Transfer Protocol (FTP). FTP is commonly used to share files across a network.
d) Port 25 - Port 25 is used by the Simple Mail Transfer Protocol (SMTP). SMTP is used for e-mail routing between two e-mail servers.

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is an available secure protocol used for encrypting wireless Local Area Networks (LANs). The CCMP protocol is more secure than TKIP and WEP protocols, as it is used with the WPA2 standard.

Correct Option(s):

d) CCMP

Incorrect Option(s):

a) TKIP - Temporal Key Integrity Protocol (TKIP) is used with WPA wireless security and is not as secure as the CCPM protocol. TKIP is an encryption method, whereas CCMP is a protocol used with wireless LANs.
b) WEP - Wired Equivalent Privacy (WEP) is a non-secure algorithm and was replaced by WPA. WEP is not as secure as the CCPM protocol.
c) AES - Advanced Encryption Standard (AES) is an encryption method used with wireless security and not a protocol. AES is more secure than TKIP and is a common preference over this encryption method.

A MAC address filter can be used with a wireless access point (WAP) to prevent clients from using it. A MAC address filter works by building a list of approved or denied MAC addresses, as well as which devices may be exempt from the filter. Using a wireless authentication method, such as Advanced Encryption Standard (AES) or Wired Equivalent Privacy (WEP), as well as a MAC address filter, is typically recommended to maximize wireless security. A MAC address filter is especially useful when the same devices, such as a computer or cellular phone, will be connecting to the same WAP; otherwise, a MAC address filter can be difficult to maintain if it constantly needs updating.

Correct Option(s):

d) MAC address filter

Incorrect Option(s):

a) Firewall - A firewall is used within a network to filter and examine packets that are transmitted between devices. A firewall cannot be used to prevent a computer from authenticating with a WAP.
b) Access control list - An access control list (ACL) is used to provide a list of permissions for a specific resource. An ACL cannot be used to prevent a computer from authenticating with a WAP.
c) SSL - Secure Sockets Layer (SSL) is a protocol that provides secure communication over the Internet. SSL cannot be used to prevent a computer from authenticating with a WAP.

C. S/MIME enables users to send both encrypted and digitally signed e-mail messages.
( S/MIME employs a model based on a trusted CA S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFCs (3369,3370,3850,3851). S/MIME was originally developed by RSA Data Security Inc.)

Ron's Code 5 = RC5 has a variable block size (32, 64 or 128 bits), key size (0 to 2040 bits) and number of rounds (0 to 255). The suggested choice of parameters were a block 64 bits/128-bit key /12 rounds.
SHA-1 produces a 160-bit message digest based on principles similar to MD5 message digest algorithms, but has a more conservative design.
NTLM security protocols that provides AIC to users

B. DNS poisoning
C. Modified hosts file

The hosts file is one of several system facilities that assists in addressing network nodes in a computer network. It is a common part of an operating system's Internet Protocol (IP) implementation, and serves the function of translating human-friendly hostnames into numeric protocol addresses, called IP addresses, that identify and locate a host in an IP network. In some operating systems, the hosts file's content is used preferentially to other methods, such as the Domain Name System (DNS), but many systems implement name service switches (e.g., nsswitch.conf for Linux and Unix) to provide customization. Unlike the DNS, the hosts file is under the direct control of the local computer's administrator.^[1]

C. UDP attack
A UDP flood attack is a denial-of-service (DoS) attack using the User Datagram Protocol (UDP), a sessionless/connectionless computer networking protocol.