Deck 6: Securing Cloud Resources

Question 1

Sansa has moved the only Linux server within VPC1 to the Linux-only VPC15. The remaining servers in VPC1 all run Windows Server. Which of the following should she do on the firewall for VPC1?

A) Disable port 22
B) Disable port 3389
C) Disable port 53
D) Disable port 443

Answer 1

A

Question 2

Samwell wants to create a lightly protected subnet within the VNet that acts as a filter between the Internet and the other internal network resources. Which of the following describes the type of subnet that he is looking to deploy?

A) ACL
B) GCP
C) STP
D) DMZ

Answer 2

D

Question 3

Podrick wants to implement a technology on the company's servers that will detect any intrusions as well as implement rules or other methods to immediately stop traffic that appears to be an intrusion. Which of the following is he looking to install?

A) HIDS
B) HIPS
C) NIDS
D) NIPS

Answer 3

B

Question 4

Tormund has created a set of firewall rules and has noticed that when there is traffic that matches a rule, the traffic allowed in one direction automatically allows traffic in the other direction for an active connection as long as there is at least one message going in either direction within 10 minutes. What is the name of that type of firewall?

A) Stateless
B) Stateful
C) Status-monitoring
D) Active-analysis

Question 5

Eddard wants to install a VM running in the perimeter network that provides antivirus/anti-malware capabilities for the rest of the network. Which of the following describes the type of VM that he wants to install?

A) NSG
B) NVA
C) ASG
D) NTP

Question 6

Hodor has a VPC that is only accessed by IP address and does not do any DNS lookups for any of the applications that it runs. Which of the following rules should he add to the firewall?

A) Deny port 53
B) Deny port 1433
C) Deny port 23
D) Deny port 69

Question 7

Missandei's manager has asked her to implement microsegmentation for her company's cloud deployment. She wasn't overly familiar with this term and upon researching came across the reasoning to implement this as being that nothing should be trusted in a cloud environment and every system, communication, and user is considered a threat until proven otherwise. Which of the following concepts does this describe?

A) Zero-trust security model
B) Proof positive security model
C) ID only security model
D) Assurance security model

Question 8

Jon recently returned from an IT conference where he learned about a technology that could alert the administrators to any intrusions that may occur by installing software on each of the servers within the cloud deployment. Unfortunately, this particular system wouldn't stop the intrusion automatically. Which of the following technologies did he learn about?

A) HIPS
B) HIDS
C) NIPS
D) NIDS

Question 9

Tyrion wants to use a virtual firewall to filter the types of traffic that are allowed or not allowed into a virtual private cloud instance he has created on the cloud service provider his company uses. Which of the following can he use to accomplish this goal?

A) VNC
B) NACL
C) NAT
D) VLAN

Question 10

Joffrey is about to deploy a new web server. He wants to ensure that when a user accesses the server, that their web browsing session is encrypted between the browser and the server. Which of the following should he use with the web server to provide this functionality?

A) SSH
B) SSL
C) TLS
D) ACL

Question 11

Khal has set up a new web server on the company's private cloud. He has installed the security certificate necessary so that the application can be accessed by HTTPS. He isn't overly familiar with how these certificates work, so he decides to read up on the details. He learns that there is a pair of keys used to encrypt and decrypt the initial communications. Which of the following is the key that does not get sent to the browser?

A) public key
B) private key
C) secret key
D) asymmetric key

Question 12

Theon wants to transfer some files to one of the Linux servers that he manages. Which of the following would ensure that the transmissions are secure while not relying on SSL/TLS for the encryption?

A) FTP
B) FTPS
C) SFTP
D) TFTP

Question 13

Stannis wants to block any traffic that uses insecure protocols from entering his VPC. Which of the following might he use to accomplish that goal?

A) Firewall
B) HIPS
C) HIDS
D) Anti-malware

Question 14

Tommen is doing an audit and finds that the firewall still includes some rules for some Windows servers that no longer exist in a VPC. The remaining servers all run a variant of Linux. Which of the following rules should he delete from the firewall?

A) Allow port 3389
B) Allow port 53
C) Allow port 443
D) Allow port 80

Question 15

Shae wants to implement antivirus in her cloud environments. Where should she look at installing this protection to be most effective?

A) Inside the DMZ
B) On each host of the network
C) On the e-mail servers
D) All of the other options are correct

Question 16

Gendry has been learning more about security within the cloud after hearing that it is a hot topic within the IT industry. He starts reading up on SHA-3 being used for hashing. Which of the following best describes SHA-3?

A) Firewall
B) Key
C) ACL
D) Cipher

Question 17

Davos has been reading about encryption recently. He begins to wonder how anything can be secure if everyone is using the same set of algorithms. After all, anyone using the same algorithm would be able to decrypt anything that had been encrypted using that algorithm. Which of the following helps make the data unusable by anyone else using that same encryption scheme without having this information?

A) Algorithm
B) Cipher
C) Key
D) Block

Question 18

Cersei wants to protect the application servers within her cloud deployment by implementing granular control of the traffic and workflows in the deployment. Which of the following would she implement?

A) Microsegmentation
B) Shadow IT
C) DDoS
D) Dos

Question 19

Bran has recently learned about the CIA triad. He knows that encryption is important to a variety of things within his organization's infrastructure. One of those is the ability to ensure that data being transmitted across the network cannot be modified undetected. Which of the following tenets of the CIA triad supports this idea?

A) Confidentiality
B) Intrusion detection
C) Covert
D) Integrity

Question 20

Arya is looking to install a security appliance that is designed to detect applications and other resources running within the domain and monitor them according to her organization's policies. Which of the following would she want to implement?

A) CASB
B) CIFS
C) CMDB
D) CAB

Question 21

Walder is reviewing the logs and sees a spike in overnight activity by one of the user accounts that he knows the employee left the organization over a month ago. Which of the following is most likely the cause of these logins?

A) Data breach
B) Failureto properly deactivate accounts
C) Account hijacking
D) User error

Question 22

Jamie is head of security at his company and has gotten an alert from the monitoring system that the web servers are receiving a sudden spike in traffic from a number of foreign IP addresses. This is causing the website to run very slow or return errors to some users. Which of the following is most likely occurring?

A) DoS attack
B) Ping flood
C) DDoS attack
D) Smurf attack

Question 23

Ellaria is analyzing the infrastructure that her organization uses and sees that the first rule of the firewall is as shown below. Which of the following is probably true?

A) Physical access by an unauthorized person
B) Unencrypted data and unencrypted communications
C) Incorrect hardening settings
D) Security device failure

Question 24

Bronn is examining the log files and notices a constant stream of traffic initializing sessions to an FTP server coming from a single IP address. Which of the following is most likely occurring?

A) DoS attack
B) Ping flood
C) DDoS attack
D) Smurf attack

Question 25

Brienne is trying to access one of her company's websites but gets an error message about not being able to trust the website. Which of the following has most likely occurred?

A) The cipher the site has been using is now deprecated and should no longer be used
B) The certificate authority cannot be verified
C) The certificate's serial number is invalid
D) The site's certificate has expired

Question 26

Gilly is walking down the hallway at her office when she notices someone in a delivery uniform carrying boxes down the hall without an escort. She also doesn't see a visitor's badge, which is supposed to be clipped to a visitor's collar. Which of the following might have just occurred?

A) Insufficient security controls and processes
B) Unauthorized physical access
C) Security device failure
D) Weak or obsolete security technologies

Question 27

Meera notices someone entering a side door of her company's facility, but did not swipe a badge on the proximity badge reader before being able to open the door, even though there is a badge reader installed. Which of the following may have occurred?

A) Weak or obsolete security technologies
B) Incorrect hardening settings
C) Security device failure
D) Insufficient security controls and processes

Question 28

Myrcella has been hired to perform an audit of a security incident where a large corporation was using an open-source application that they had deployed to a cloud service provider. The application was used to manage the many people whose information it tracked and included a lot of identifying information about them that could be used in identity fraud. Unfortunately, the person that installed the application never removed the default administrative account that was still using the default password. Which of the following describes this scenario?

A) Weak or obsolete security technologies
B) Unencrypted data and unencrypted communications
C) Insufficient security controls
D) Incorrect hardening settings

Question 29

Euron has received several complaints that none of the users can access the company's resources that are hosted on a cloud service provider. The company has a piece of hardware installed that provides a VPN tunnel to the CSP. Upon entering the data center, he sees that all of the lights are off on the device. He unplugs it and plugs it back in and does not see any changes. Which of the following has most likely occurred?

A) Weak or obsolete security technologies
B) Incorrect hardening settings
C) Insufficient security controls and processes
D) Security device failure

Question 30

Petyr has been called into Fictional Corp to perform a security audit of their systems. One of the things that he notes on his report is that the sales department is using FTP to remotely upload scanned copies of physical order sheets from customers. Why is this an issue?

A) Sales reps may not be comfortable using an FTP client; a web browser interface would be much easier for them to use.
B) FTP will time out their sessions if inactive for 10 minutes.
C) FTP is considered insecure.
D) Sales reps may be tempted to share their username and password with others to perform the task for them.

Question 31

Daenerys is examining the logs of one of the Linux servers as part of a standard auditing process. She comes across a number of entries showing that an administrative account has logged in from a foreign IP address many times over the past six months. She knows that the company doesn't have any operations in the country that the IP address is assigned to. Which of the following might describe the type of attack that has occurred?

A) APT
B) POODLE
C) Smurf
D) Christmas tree

Question 32

Jorah is performing an analysis of some of the systems and protocols his company uses. Which of the following, if found in use, should he recommend discontinuing? (Select all that apply)

A) SSH
B) Telnet
C) FTP
D) RDP