|
1. |
B. When you are assessing the cost-effectiveness of a security measure, you need to take the amount of money that it is expected to save, and subtract from that the actual cost of the safeguard itself. In Option 2, the cost related to equipment losses will be reduced by $65,000 (65 percent of 100,000). You then need to subtract the cost of the safeguard itself, so the total savings to the company will be $65,000 – $15,000 = $50,000. This meets the requirements put forth by the company CEO and CFO. x Answer A is incorrect, because the cost savings from Option 1 will be $80,000 (80 percent of $100,000) minus the cost of the safeguard. Therefore, the total savings to the company will be $80,000 – $60,000 = $20,000. This does not meet the requirements put forth by the CEO and CFO. Answer C is incorrect because the cost savings will be $25,000 (25 percent of $100,000). You then subtract the cost of the safeguard itself for a total cost savings of $25,000 – $10,000 = $15,000. This does not meet the requirements put forth by the company CEO and CFO. Answer D is incorrect because Option 2 is a cost-effective solution that meets the requirements set forth by company management.
|
|
2. |
A. Even if you could set a minimum password requirement of 25 characters (the maximum for this setting is 14 characters), a 25-character password would be unreasonably long, and would prompt your users to write it down on their monitors or in their wallets. This creates another avenue of attack that can easily render such a strong password meaningless. x Answer B is incorrect, because a password length of 8 to 14 characters is usually sufficient to guard against most brute-force attacks. Answer C is incorrect because a 25-character password will create the issues described in Answer A. Answer D is incorrect because Windows passwords can be up to 255 characters in length. |
|
3. |
D. Social engineering attacks take advantages of unsuspecting users and weaknesses in administrative security policies to gain access to a user account or password. This type of attack can be addressed through security awareness and a stringent adherence to security policies for administrators, help desk associates, and end users of all levels. x Answer A is incorrect because in this case, the attacker did not need to guess the user’s password—it was given to him by the help desk as a result of his social engineering. Answer B is incorrect because spoofing is a technical attack in which one machine is made to look like another. Answer C is incorrect because network sniffing is a technical attack in which network packets are physically intercepted and analyzed by someone running a copy of Network Monitor or some other packet sniffer. |
|
4. |
C. Trojan horses are pieces of malicious code embedded in an otherwise harmless-looking program such as a game or a screensaver. These attacks most often infect end-user workstations via files downloaded from the Internet or from an e-mail attachment. Based on the description of the problem, this is the most likely reason why the user’s workstation is not booting correctly. x Answers A, B, and D, while all possibilities, are far less likely reasons for the workstation failure than the likelihood that the downloaded game contained malicious code such as a Trojan horse. |
|
5. |
B. When an attacker intercepts network traffic between two parties and alters the data before the transmission is completed, this is called a MITM attack. When this occurs, both parties believe that they are only communicating with one another, when in fact the attacker is intercepting the entire conversation. x Answer A is incorrect because a DoS attack is designed to overwhelm a vulnerable computer so that it cannot provide resources and access to legitimate users. Answer C is incorrect because a password-guessing attack cannot alter network data, but simply attempts to brute-force its way into guessing a legitimate user’s password. Answer D is incorrect because a spoofing attack is one where an attacker disguises his or her attack so that it appears that it is coming from another location, or else impersonates a trusted computer to trick unsuspecting users into giving the attacker their information.
|
|
6. |
C. When you transfer the responsibilities associated with a particular risk to a third party, you have transferred that risk. A similar tactic would be performing risk transference by taking out an insurance policy against the theft of an automobile. x Answer A is incorrect because hosting your Web site externally does not remove the possibility that losses associated with downtime will occur. An example of Risk Avoidance would be to avoid risks associated with Web server downtime by removing your company’s Web presence altogether. Answer B is incorrect because Risk Mitigation refers to taking steps to lessen the likelihood that a risk will occur. Placing a Web server behind a firewall and proactively installing security patches would be a method of Risk Mitigation. Answer D is incorrect because Risk Acceptance means that you are taking no further measures to alleviate any risks to your network, either because the value of the asset is too little, or because the risk cannot be reduced any further in a cost-effective manner. |
|
7. |
A. A common way to begin a DoS attack is to send a stream of TCP SYN, or Synchronization, packets to a server and never complete the rest of the TCP connection. Because most servers will leave these “half-open” connections waiting to be completed, they can overwhelm a server to the point that it cannot respond to legitimate user requests. x Answer B is incorrect because a password-guessing attack would not use the TCP SYN flooding that is common with DoS attacks. In a password attack, you would be more likely to see a series of failed logon attempts in the Security Log of the Event Viewer. Answer C is incorrect because TCP SYN flooding is not a normal network condition, and therefore one that you should investigate as a potential security incident. Answer D is incorrect because a lost Internet connection would manifest itself by an inability to reach hosts on the Internet, transmit e-mail and the like; it does not typically create a SYN flood against a specific server. |
|
8. |
C. If the Windows NT 4 workstations cannot be upgraded to a more recent version of the operating system, the highest encryption level that this network can currently support is NTLM, version 2. Windows NT 4 Workstation does not support the use of Kerberos for LAN communications.
x Answer A is incorrect, because LM authentication is a legacy authentication method that predates even Windows NT4 and was used primarily for the Windows 9x family of operating systems. LM authentication is fairly insecure with several well-known vulnerabilities that can allow passwords and other information to be obtained by anyone running a network sniffer. Answer B is incorrect, because while NTLM authentication is an improvement over LM, the updated NTLMv2 resolves several vulnerabilities and provides greater encryption than its predecessor. Answer D is incorrect because the Windows NT4 operating system does not support Kerberos; this is only supported in Windows 2000 or later. |
|
9. |
B. When designing a VPN solution, the IPSec/L2TP will provide the best security if all clients can support it. IPSec/L2TP is supported natively by Windows 2000 and XP Professional, and support for it can be added to Windows NT4. x Answer A is incorrect because SPAP is a legacy protocol used for dial-up accounts that uses minimal encryption and can easily be sniffed. Answer C is incorrect, because while PPTP was the standard VPN protocol for use with NT4 and previous operating systems, the more modern OSs specified in this scenario will allow you to use IPSec/L2TP. Answer D is incorrect because MS-CHAPv2 is used for negotiating basic dial-up modem connectivity, not for securing VPN traffic.
|
|
10. |
A, D. When you are configuring a Windows Server 2003 DNS server to coexist with a UNIX-based DNS server, you need to ensure that the zone transfer process has been secured. In a homogeneous Windows environment, you can control which servers can and cannot retrieve zone transfer information through the Windows GUI. If you will be requesting zone transfers from a UNIX server, these same kinds of controls need to be created. Therefore, Answer A is correct. Second, you need to ensure that the process of sending record updates to the UNIX DNS server is encrypted so that your company’s DNS information cannot be intercepted by a curious or malicious user running a packet sniffer. Therefore, Answer D is correct. x Answer B is incorrect because only BIND DNS servers do not integrate with the Windows Server 2003 WINS service when performing DNS lookups. Answer C is incorrect because NTLM is a Windows-specific authentication mechanism—you will need to find a secure alternative when configuring authentication to a UNIX DNS server. |