Question 1

Walder is reviewing the logs and sees a spike in overnight activity by one of the user accounts that he knows the employee left the organization over a month ago. Which of the following is most likely the cause of these logins?

Accepted Answer

The most likely cause of the logins is a failure to properly deactivate accounts. When an employee leaves an organization, their user accounts should be deactivated to prevent unauthorized access. If this step is overlooked, the account remains active and could be used inappropriately.

Question 2

Jamie is head of security at his company and has gotten an alert from the monitoring system that the web servers are receiving a sudden spike in traffic from a number of foreign IP addresses. This is causing the website to run very slow or return errors to some users. Which of the following is most likely occurring?

Accepted Answer

The scenario described is indicative of a Distributed Denial of Service (DDoS) attack, where multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers, causing a denial of service for users of the targeted system.

Question 3

Ellaria is analyzing the infrastructure that her organization uses and sees that the first rule of the firewall is as shown below. Which of the following is probably true?

Accepted Answer

The first rule of a firewall often involves allowing or denying specific traffic, which relates to configuration settings. Incorrect hardening settings could lead to improper firewall rules.

Question 4

Bronn is examining the log files and notices a constant stream of traffic initializing sessions to an FTP server coming from a single IP address. Which of the following is most likely occurring?

Accepted Answer

A constant stream of traffic from a single IP address to an FTP server, especially if it's initiating sessions, is indicative of a Denial of Service (DoS) attack. The goal is likely to overwhelm the server with requests, making it unavailable to legitimate users.

Question 5

Brienne is trying to access one of her company's websites but gets an error message about not being able to trust the website. Which of the following has most likely occurred?

Accepted Answer

The most common reason for a trust error when accessing a website is that the site's SSL/TLS certificate has expired, making it untrustworthy to browsers.

Question 6

Gilly is walking down the hallway at her office when she notices someone in a delivery uniform carrying boxes down the hall without an escort. She also doesn't see a visitor's badge, which is supposed to be clipped to a visitor's collar. Which of the following might have just occurred?

Accepted Answer

Unauthorized physical access is indicated by the delivery person moving unescorted and without a visible visitor's badge, suggesting they may not have gone through the proper security checks.

Question 7

Meera notices someone entering a side door of her company's facility, but did not swipe a badge on the proximity badge reader before being able to open the door, even though there is a badge reader installed. Which of the following may have occurred?

Accepted Answer

A security device failure could have occurred, allowing the door to open without the badge being swiped.

Question 8

Myrcella has been hired to perform an audit of a security incident where a large corporation was using an open-source application that they had deployed to a cloud service provider. The application was used to manage the many people whose information it tracked and included a lot of identifying information about them that could be used in identity fraud. Unfortunately, the person that installed the application never removed the default administrative account that was still using the default password. Which of the following describes this scenario?

Accepted Answer

The scenario describes a failure to change default settings, which is an example of incorrect hardening settings.

Question 9

Euron has received several complaints that none of the users can access the company's resources that are hosted on a cloud service provider. The company has a piece of hardware installed that provides a VPN tunnel to the CSP. Upon entering the data center, he sees that all of the lights are off on the device. He unplugs it and plugs it back in and does not see any changes. Which of the following has most likely occurred?

Accepted Answer

Given that all the lights are off on the device even after Euron attempts to power cycle it (unplugging it and plugging it back in), the most likely issue is a hardware failure of the security device that provides the VPN tunnel. This is a direct indication that the device itself is not functioning properly, rather than an issue with security technologies, settings, or controls.

Question 10

Petyr has been called into Fictional Corp to perform a security audit of their systems. One of the things that he notes on his report is that the sales department is using FTP to remotely upload scanned copies of physical order sheets from customers. Why is this an issue?

Accepted Answer

FTP is considered insecure because it transmits data, including usernames and passwords, in clear text, making it susceptible to eavesdropping and interception by unauthorized individuals.

Question 11

Daenerys is examining the logs of one of the Linux servers as part of a standard auditing process. She comes across a number of entries showing that an administrative account has logged in from a foreign IP address many times over the past six months. She knows that the company doesn't have any operations in the country that the IP address is assigned to. Which of the following might describe the type of attack that has occurred?

Accepted Answer

APT (Advanced Persistent Threat) is the correct answer because it describes a type of attack where an unauthorized user gains access to a network and remains undetected for a long period of time, which aligns with the scenario of an administrative account logging in from a foreign IP address multiple times over six months.

Question 12

Jorah is performing an analysis of some of the systems and protocols his company uses. Which of the following, if found in use, should he recommend discontinuing? (Select all that apply)

Accepted Answer

The answer of Jorah is performing an analysis of some...

Quiz 6: Securing Cloud Resources