100 Free GIAC GSEC Practice Questions and Answers
100 questions for the GIAC GSEC exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network namespaces give a container its own network stack for isolation but do not limit memory or CPU consumption.
Not this one. Try another answer.
Why B is wrong
Seccomp filters which system calls a process may make and has no mechanism for metering memory or CPU usage.
Not this one. Try another answer.
Why C is wrong
AppArmor is a mandatory access control system that restricts file and resource access by path, not resource consumption.
Right, D is the answer.
Why D is right
Containers rely on two separate kernel features. Namespaces provide isolation, giving each container its own view of processes, network interfaces, mounts and hostnames. Control groups provide resource accounting and limiting, so an administrator can restrict how much memory, CPU and block I/O a container may use. Setting cgroup limits, for example with the Docker --memory and --cpus options, protects the host and neighboring containers against a runaway or malicious container that tries to exhaust shared resources, which is a form of denial of service.
Question 2 Play from 02:10
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
System Integrity Protection restricts the root user and limits what root can do to protected parts of the operating system, including /System, /usr, /bin, /sbin and the apps that ship with macOS. Only Apple-signed processes with special entitlements, such as Apple software updates and installers, may modify these locations. This means that malware which gains root through a stolen administrator password or an exploit still cannot tamper with core system binaries, while third-party software continues to install into locations such as /Applications and /usr/local.
Not this one. Try another answer.
Why B is wrong
Gatekeeper checks the signature and notarization of apps when they are opened and does not block root from writing to system directories.
Not this one. Try another answer.
Why C is wrong
FileVault encrypts the startup disk to protect data at rest and does not restrict which files an unlocked system lets root modify.
Not this one. Try another answer.
Why D is wrong
XProtect detects and blocks known malware signatures and does not enforce write protection on operating system paths.
Question 3 Play from 04:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Event ID 3 records network connections, and it is disabled by default.
Not this one. Try another answer.
Why B is wrong
Event ID 11 records file create or overwrite operations, not process execution details.
Right, C is the answer.
Why C is right
Sysmon, a Sysinternals system service and driver, writes detailed activity to the Microsoft-Windows-Sysmon/Operational event log. Event ID 1, process creation, records the image path, the full command line, the parent process and its command line, a ProcessGuid that stays unique even when Windows reuses process IDs, and hashes of the image using the configured algorithms. These fields make it a primary source for hunting living-off-the-land activity such as powershell.exe launched with an -EncodedCommand argument by an Office application.
Not this one. Try another answer.
Why D is wrong
Event ID 22 records DNS queries made by processes, not process creation.
Question 4 Play from 06:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A technique describes how a goal is achieved, which in this mapping is dumping LSASS memory, not the goal itself.
Not this one. Try another answer.
Why B is wrong
A procedure is a specific observed implementation of a technique by an adversary or tool, not a broad goal.
Not this one. Try another answer.
Why C is wrong
Mitigations in ATT&CK are defensive measures that prevent a technique from succeeding, not descriptions of adversary goals.
Right, D is the answer.
Why D is right
ATT&CK describes adversary behavior at several levels. Tactics represent the why: the adversary's tactical goal or reason for performing an action, such as Initial Access, Persistence or Credential Access. Techniques represent the how: the way an adversary achieves that goal, such as OS Credential Dumping, with sub-techniques such as LSASS Memory adding detail. Procedures are the specific implementations observed in the wild, such as a particular group running a named tool against LSASS. Defenders use this structure to map detections and identify coverage gaps across each tactic.
Question 5 Play from 08:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Ingress filtering at the host level controls incoming traffic but does not prevent malware from reading unencrypted files on the system.
Not this one. Try another answer.
Why B is wrong
Monitoring for abnormal traffic flow can detect exfiltration after it occurs but does not prevent the malware from reading unencrypted files.
Not this one. Try another answer.
Why C is wrong
File integrity monitoring detects unauthorized changes but does not prevent files from being read or copied by malware.
Right, D is the answer.
Why D is right
Encrypting files locally when not in use would protect their confidentiality if they were exfiltrated by malware. Even if malware successfully copies and transmits encrypted files, the attacker cannot read the contents without the encryption key. This provides confidentiality protection at rest and during unauthorized access, making it the most direct defense against file disclosure.
Question 6 Play from 10:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data custodians implement and maintain security measures but do not decide classification levels.
Not this one. Try another answer.
Why B is wrong
Security auditors verify that data is properly classified and protected; they do not make initial classification decisions.
Not this one. Try another answer.
Why C is wrong
End users follow the classification policies established by data owners and do not determine classification levels.
Right, D is the answer.
Why D is right
The data owner is responsible for deciding the appropriate classification level for data. Data owners have authority over their data assets and make decisions about sensitivity levels, access restrictions, and protection requirements. Custodians implement and maintain the protections decided by owners, security auditors verify compliance, and end users follow established policies.
Question 7 Play from 11:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Security level does not determine speed; many secure algorithms can be fast or slow depending on their mathematical basis.
Not this one. Try another answer.
Why B is wrong
Implementation medium (hardware vs software) is not the primary reason; the algorithmic difference between symmetric and asymmetric is fundamental.
Not this one. Try another answer.
Why C is wrong
This is backwards; asymmetric cryptography is actually much slower than symmetric cryptography.
Right, D is the answer.
Why D is right
Symmetric cryptography (such as DES) is generally much faster than asymmetric cryptography (such as RSA) because symmetric algorithms use simpler mathematical operations and shorter key lengths relative to their security strength. Asymmetric cryptography requires complex mathematical operations like modular exponentiation on very large numbers, making it inherently slower. This is why symmetric encryption is used for bulk data encryption and asymmetric encryption is used for key exchange and signatures.
Question 8 Play from 14:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Application log records application-level events, not driver startup information.
Right, B is the answer.
Why B is right
The System event log records hardware, driver, and system-level events, including driver loading during startup. Information about whether a specific driver was running at system startup would be logged in the System event log where startup processes and driver initialization are recorded.
Not this one. Try another answer.
Why C is wrong
There is no standard Windows event log called 'Startup'; startup events are logged in the System log.
Not this one. Try another answer.
Why D is wrong
The Security log records authentication, authorization, and access control events, not driver startup information.
Question 9 Play from 15:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Snort is an intrusion detection system, not a privilege management tool.
Not this one. Try another answer.
Why B is wrong
Apache is a web server software and does not manage system command permissions.
Not this one. Try another answer.
Why C is wrong
SSH is a secure remote access protocol and does not provide granular command-level permission control.
Right, D is the answer.
Why D is right
SUDO (substitute user do) is a utility that allows specific users to execute specific commands with root-level privileges without needing the root password, providing granular control over command access.
Question 10 Play from 16:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A bridge operates at Layer 2 and forwards broadcasts within the same network segment, not preventing them from crossing subnets.
Not this one. Try another answer.
Why B is wrong
A hub is a Layer 1 device that simply repeats signals and does not filter or block any traffic, including broadcasts.
Right, C is the answer.
Why C is right
A router operates at Layer 3 (Network layer) and prevents broadcast traffic from crossing subnet boundaries by not forwarding broadcast frames between different subnets, effectively isolating broadcast domains.
Not this one. Try another answer.
Why D is wrong
A modem is used for connecting to ISPs and does not control broadcast traffic between subnets.
Show all 100 questionsShow fewer questions
Question 11 Play from 18:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Firewalling a service does not prevent local exploitation and does not address the core vulnerability of having unnecessary code present.
Not this one. Try another answer.
Why B is wrong
Setting a service to manual startup still leaves it installed and potentially exploitable if an attacker manually starts it.
Not this one. Try another answer.
Why C is wrong
Disabling a service prevents it from running but the code remains on the system and could potentially be exploited or re-enabled by malware.
Right, D is the answer.
Why D is right
Uninstalling an unused service is the most secure approach because it removes the service entirely from the system, eliminating any possibility of exploitation. While disabling a service prevents it from running, the code remains on the system. Uninstallation removes the attack surface completely, making it the strongest security posture for services that are not needed.
Question 12 Play from 19:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Assessing risk involved in discarding information is a risk assessment process, not sanitization.
Not this one. Try another answer.
Why B is wrong
Verifying identity is authentication, not sanitization.
Not this one. Try another answer.
Why C is wrong
Physically destroying media is destruction or degaussing, which is more extreme than sanitization; sanitization allows reuse of media while removing data.
Right, D is the answer.
Why D is right
Sanitization is the process of removing or obscuring data from media so that it is extremely difficult or impossible to recover or restore the information, ensuring data cannot be easily retrieved.
Question 13 Play from 21:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NSLOOKUP is a DNS query tool used to resolve domain names to IP addresses, not for configuring network interfaces.
Not this one. Try another answer.
Why B is wrong
IPCONFIG is the Windows equivalent of IFCONFIG and configures TCP/IP parameters on Windows systems, but the question asks for the tool generally used across systems.
Not this one. Try another answer.
Why C is wrong
ARP is the Address Resolution Protocol tool used to map IP addresses to MAC addresses, not for configuring network interface parameters.
Right, D is the answer.
Why D is right
IFCONFIG is the command-line tool used on Unix and Linux systems to configure, control, and query TCP/IP network interface parameters such as IP addresses, subnet masks, and gateway settings. It provides comprehensive network interface management capabilities for viewing and modifying network configuration.
Question 14 Play from 23:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SECEDTT.EXE is a tool for editing security templates, not for managing audit policies.
Not this one. Try another answer.
Why B is wrong
POLCLI.EXE is not a standard Windows tool for audit policy management.
Not this one. Try another answer.
Why C is wrong
REMOTEAUDIT.EXE is not a real Windows command-line tool for audit management.
Right, D is the answer.
Why D is right
AUDITPOL.EXE is the correct command-line tool for managing audit policies on Windows systems, including remote systems. It allows administrators to configure, query, and modify audit policies at both the local and group policy levels.
Question 15 Play from 24:48
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Distributed Denial of Service (DDoS) attack is distinguished from a regular DOS attack by the source of the attack traffic. DDoS attacks originate from multiple distributed hosts or systems (often a botnet), whereas a standard DOS attack typically comes from a single source. This distributed nature makes DDoS attacks significantly harder to mitigate.
Not this one. Try another answer.
Why B is wrong
DDoS attacks target a single victim system, not multiple distributed targets.
Not this one. Try another answer.
Why C is wrong
Regular DOS attacks can target any network device, not just routers.
Not this one. Try another answer.
Why D is wrong
DDoS attacks do not affect the entire Internet; they target specific victim systems or networks.
Question 16 Play from 26:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Network Layer (IP) handles routing and logical addressing, not port numbers.
Right, B is the answer.
Why B is right
Port numbers are managed at the Transport Layer of the TCP/IP stack. This layer includes protocols like TCP and UDP, which use port numbers to identify specific services and applications on a host. Ports enable multiplexing of multiple applications over the same network connection.
Not this one. Try another answer.
Why C is wrong
The Internet Layer is synonymous with the Network Layer and does not manage port numbers.
Not this one. Try another answer.
Why D is wrong
The Application Layer uses ports but does not manage them; port management is a Transport Layer function.
Question 17 Play from 27:59
What are they?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption strength is not a primary biometric selection factor; reliability, acceptance, and cost are the key considerations.
Not this one. Try another answer.
Why B is wrong
Encryption strength and authorization method are not among the three key biometric selection factors.
Right, C is the answer.
Why C is right
The three key factors in selecting a biometric mechanism are reliability (false acceptance and rejection rates), user acceptance (willingness to use the system), and cost (implementation and operational expenses). These factors balance the technical performance, practical usability, and financial viability of any biometric authentication system. Encryption strength is not a primary selection factor for biometrics since the strength of biometric systems depends on the accuracy of the matching algorithm, not cryptographic encryption.
Not this one. Try another answer.
Why D is wrong
Encryption strength is not a relevant selection factor for biometric mechanisms; the correct factors are reliability, user acceptance, and cost.
Question 18 Play from 29:59
Which of the following commands will he use to accomplish the task?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
mv is used to move or rename files, not to display shell information.
Right, B is the answer.
Why B is right
The echo command prints the value of environment variables. The $SHELL variable contains the name of the current shell. Using 'echo $SHELL' will display the shell being used. The mv command moves files, rm removes files, and ls lists directory contents, none of these would display the current shell name.
Not this one. Try another answer.
Why C is wrong
rm is used to delete files, not to display shell information.
Not this one. Try another answer.
Why D is wrong
ls is used to list directory contents, not to display shell information.
Question 19 Play from 31:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Technical risk assessments focus on identifying system and network vulnerabilities, not categorical risk ratings.
Right, B is the answer.
Why B is right
Qualitative risk assessments categorize results using descriptive labels like low, medium, and high to represent relative risk levels. This approach focuses on the nature and characteristics of risks rather than numerical calculations. Technical assessments focus on system vulnerabilities, management assessments address organizational processes, and quantitative assessments use numerical data and probabilities, none of these produce the low/medium/high categorization as their primary output format.
Not this one. Try another answer.
Why C is wrong
Management risk assessments address organizational and governance risks, not the categorical classification system described.
Not this one. Try another answer.
Why D is wrong
Quantitative risk assessments produce numerical values and probability calculations, not the low/medium/high categorical labels.
Question 20 Play from 33:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Condition deployment is not a recognized IT discipline or standard practice terminology.
Not this one. Try another answer.
Why B is wrong
Observation discipline is not a formal IT management or security discipline.
Not this one. Try another answer.
Why C is wrong
Security establishment describes initial security setup, not the ongoing baseline management and change control process.
Right, D is the answer.
Why D is right
Configuration Management is the established discipline of establishing a known baseline configuration for systems and maintaining control over changes to that baseline. This encompasses documentation, change control, and the ongoing management of system states to ensure consistency and security. The other options do not represent recognized IT management disciplines with this specific definition.
Question 21 Play from 35:01
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
/etc/passwd contains user information but not actual password hashes.
Right, B is the answer.
Why B is right
The /etc/shadow file contains encrypted password hashes and shadow password entries in Linux systems. This file has restricted permissions (readable only by root) to protect password hashes from unauthorized access. The /etc/passwd file contains user account information but not actual password hashes (in modern systems). The /etc/profile file contains shell configuration settings, and /etc/shdpwd is not a standard Linux file.
Not this one. Try another answer.
Why C is wrong
/etc/profile contains shell environment configuration, not password entries.
Not this one. Try another answer.
Why D is wrong
/etc/shdpwd is not a standard Linux password file.
Question 22 Play from 36:44
Which of the following will you use to accomplish this?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
PPTP is a VPN protocol for network tunneling, not email encryption
Not this one. Try another answer.
Why B is wrong
IPSec operates at the network layer for VPN and network security, not for email encryption
Right, C is the answer.
Why C is right
PGP (Pretty Good Privacy) is specifically designed for encrypting and digitally signing email messages, making it the appropriate choice for secure email communication. It provides end-to-end encryption and authentication for email content.
Not this one. Try another answer.
Why D is wrong
NTFS is a file system, not an email encryption solution
Question 23 Play from 38:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TCP port 443 is the default port for HTTPS, not L2TP.
Not this one. Try another answer.
Why B is wrong
UDP port 161 is the default port for SNMP, not L2TP.
Not this one. Try another answer.
Why C is wrong
TCP port 110 is the default port for POP3 email, not L2TP.
Right, D is the answer.
Why D is right
L2TP (Layer 2 Tunneling Protocol) uses UDP port 1701 as its default port. TCP 443 is for HTTPS, UDP 161 is for SNMP, and TCP 110 is for POP3, none of these are the L2TP default port.
Question 24 Play from 39:51
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Multicast streaming applications are best implemented with UDP because UDP supports multicast transmission, is connectionless, and has lower overhead, ideal for real-time streaming where some packet loss is acceptable. TCP does not support multicast and requires connection establishment. Web browsers (B) require reliable delivery via TCP. DNS zone transfers (C) use TCP for reliability. File transfers (D) require TCP to ensure all data arrives intact.
Not this one. Try another answer.
Why B is wrong
Web browsers require TCP's reliable, in-order delivery and connection management.
Not this one. Try another answer.
Why C is wrong
DNS zone transfers require TCP to guarantee complete and accurate data transfer.
Not this one. Try another answer.
Why D is wrong
File transfer applications require TCP to ensure data integrity and complete file delivery.
Question 25 Play from 41:39
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
IDS being a mature technology is a legitimate advantage, it has well-established implementations, proven detection methods, and extensive industry experience. Option B overstates its role (it's not the best solution alone). Option C is false (IDS requires patches). Option D is false (IDS complements but doesn't replace firewalls). Maturity brings reliability, vendor support, and widespread deployment experience.
Not this one. Try another answer.
Why B is wrong
IDS alone is not the best network security; it must work with other tools like firewalls.
Not this one. Try another answer.
Why C is wrong
IDS definitely requires patching to address new threats and vulnerabilities.
Not this one. Try another answer.
Why D is wrong
IDS is a detection tool, not a replacement for firewalls which provide prevention.
Question 26 Play from 43:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VPN (Virtual Private Network) is used for secure remote access, not for hosting public-facing servers.
Not this one. Try another answer.
Why B is wrong
MMZ is not a standard network architecture term.
Not this one. Try another answer.
Why C is wrong
VLAN (Virtual Local Area Network) is a logical network segmentation tool, not specifically designed to host DNS and web servers for internet users.
Right, D is the answer.
Why D is right
The DMZ (Demilitarized Zone) is a network segment that contains public-facing servers such as DNS servers and web servers that internet users need to access. The DMZ sits between the internal network and the internet, protecting internal systems while allowing controlled access to public services.
Question 27 Play from 44:50
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
System state data contains the critical components needed to recover Active Directory on a domain controller, including the Active Directory database, SYSVOL, registry, boot files, and system files. This is the specific backup target required for AD recovery.
Not this one. Try another answer.
Why B is wrong
Operating system files alone are insufficient; Active Directory-specific data must also be backed up
Not this one. Try another answer.
Why C is wrong
User personal data is not necessary for recovering Active Directory functionality
Not this one. Try another answer.
Why D is wrong
Third-party application folders are unrelated to Active Directory recovery
Question 28 Play from 46:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hubs are Layer 1 devices that flood all traffic to all ports; they do not filter broadcasts.
Not this one. Try another answer.
Why B is wrong
Bridges are Layer 2 devices that forward broadcast traffic within their domains.
Right, C is the answer.
Why C is right
Routers are Layer 3 devices that typically drop directed broadcast traffic by default. A directed broadcast (like 192.168.1.255 sent to a specific subnet) is forwarded by bridges and switches but is blocked by routers as a security measure to prevent broadcast storms and limit the scope of broadcast traffic across network boundaries. This is a standard router configuration to prevent certain types of denial-of-service attacks.
Not this one. Try another answer.
Why D is wrong
Switches are Layer 2 devices that forward broadcast traffic to all ports on a VLAN; they do not drop directed broadcasts.
Question 29 Play from 47:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The border router is external to the firewall, not between the firewall and internal network.
Not this one. Try another answer.
Why B is wrong
DNS servers are internal resources; the border router's role is at the ISP boundary, not related to DNS placement.
Not this one. Try another answer.
Why C is wrong
The border router's primary function is not to sit between ISP and DNS; it sits between ISP and the firewall.
Right, D is the answer.
Why D is right
A border router is the first router encountered at the network perimeter, positioned between the ISP (Internet Service Provider) and the organization's external firewall. This placement allows the border router to handle initial traffic filtering, routing decisions, and serve as the demarcation point between the external internet and the organization's network infrastructure.
Question 30 Play from 49:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Key Recovery is a later phase used to restore compromised or lost keys, not to generate the initial key-pair.
Right, B is the answer.
Why B is right
During the Initialization phase of PKI, the public/private key-pair is generated for an entity. This is the first step in establishing a user's cryptographic identity before registration with a Certificate Authority.
Not this one. Try another answer.
Why C is wrong
Registration occurs after initialization, when the entity submits their public key and identity information to the CA.
Not this one. Try another answer.
Why D is wrong
Certification is when the CA issues a digital certificate binding the public key to the entity's identity.
Question 31 Play from 51:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Length field can be hashed as it remains constant during transport.
Not this one. Try another answer.
Why B is wrong
Source IP address can be hashed as it remains constant during transport.
Right, C is the answer.
Why C is right
In IPsec AH transport mode, the TTL (Time To Live) field cannot be hashed because it changes during transit as packets hop through routers. Hashing a field that changes in transit would cause the integrity check to fail at the destination. The Length field (A), Source IP (B), and Destination IP (D) remain constant during transport and can be reliably hashed.
Not this one. Try another answer.
Why D is wrong
Destination IP address can be hashed as it remains constant during transport.
Question 32 Play from 52:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Port 110 is the well-known port for POP3 (Post Office Protocol 3), used for retrieving email. Well-known ports range from 0 to 1023 and are officially assigned by IANA for specific services.
Not this one. Try another answer.
Why B is wrong
Dynamic ports (49152-65535) are used for temporary client-side connections, not assigned to standard services like POP3.
Not this one. Try another answer.
Why C is wrong
Private ports (1024-49151) are for less standardized services and are below the dynamic port range.
Not this one. Try another answer.
Why D is wrong
Application port is not a formal port category defined in the standard port classification system.
Question 33 Play from 54:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
12 bytes would represent 24 hexadecimal digits, not 6.
Not this one. Try another answer.
Why B is wrong
2 bytes would only represent 4 hexadecimal digits.
Right, C is the answer.
Why C is right
The hexadecimal value 0xFEDCBA contains 6 hexadecimal digits. Since each hexadecimal digit represents 4 bits, and 8 bits equal 1 byte, 6 hex digits equal 3 bytes (6 digits ÷ 2 = 3 bytes). The value breaks down as: FE (1 byte), DC (1 byte), BA (1 byte).
Not this one. Try another answer.
Why D is wrong
6 bytes would represent 12 hexadecimal digits.
Question 34 Play from 55:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Discrete mode is not a standard network interface operating mode.
Not this one. Try another answer.
Why B is wrong
Reporting mode is not a recognized network interface mode for traffic capture.
Right, C is the answer.
Why C is right
Network Intrusion Detection Systems (NIDS) operate network interface cards in promiscuous mode, which allows the card to capture all traffic on the network segment regardless of whether the packets are addressed to that specific interface. This capability is essential for analyzing network traffic patterns and detecting intrusions.
Not this one. Try another answer.
Why D is wrong
Alert mode is not a network interface operational mode; it is a NIDS response state.
Question 35 Play from 57:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
200.11.11.1 is a host address, not a broadcast address, and doesn't end in .255.
Not this one. Try another answer.
Why B is wrong
221.10.10.10 is a host address within its subnet, not the broadcast address.
Not this one. Try another answer.
Why C is wrong
245.20.30.254 is a host address, one below the broadcast, but not the broadcast address itself.
Right, D is the answer.
Why D is right
In a /24 subnet, the broadcast address is always the last address in the subnet (all host bits set to 1). For the subnet 192.10.10.0/24, the broadcast address is 192.10.10.255. This is the only option that ends in .255 and represents a valid broadcast address within a /24 network.
Question 36 Play from 58:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
127.0.0.100 is a loopback address, not a private RFC 1918 address.
Not this one. Try another answer.
Why B is wrong
169.254.1.50 is in the link-local range (169.254.0.0/16), not an RFC 1918 private range.
Right, C is the answer.
Why C is right
RFC 1918 defines three ranges of private IP addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.254.1.50 falls within the 10.0.0.0/8 range and is a valid private address suitable for DHCP assignment on a private LAN.
Not this one. Try another answer.
Why D is wrong
172.35.1.100 falls outside the RFC 1918 private range of 172.16.0.0/12; it is a public address.
Question 37 Play from 1:01:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Spoofing is a security attack where an attacker impersonates another entity; it does not control access to resources.
Right, B is the answer.
Why B is right
ACL (Access Control List) is used to allow or deny access to network resources. ACLs define which users, groups, or systems have permissions to access specific resources and what actions they can perform on those resources.
Not this one. Try another answer.
Why C is wrong
System hardening involves securing a system against attacks through configuration and patch management, not specifically allowing or denying access to network resources.
Not this one. Try another answer.
Why D is wrong
NFS (Network File System) is a protocol for sharing files across networks, not a mechanism for controlling access permissions.
Question 38 Play from 1:02:36
How would this type of alert be categorized?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The system generated an alert about worm activity (positive alert), but upon investigation the network traffic was normal (no actual threat present). This is a False Positive, the IDS incorrectly flagged benign activity as malicious. False positives are common in security monitoring and occur when detection systems raise alarms without legitimate security incidents occurring.
Not this one. Try another answer.
Why B is wrong
True Negative would mean no alert was raised and no threat existed; here an alert was raised.
Not this one. Try another answer.
Why C is wrong
True Positive would mean an alert was raised and an actual threat was confirmed; investigation showed no threat.
Not this one. Try another answer.
Why D is wrong
False Negative would mean no alert was raised but a threat actually existed; an alert was clearly raised here.
Question 39 Play from 1:04:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A back door is a security vulnerability that allows unauthorized access, not a monitoring system.
Right, B is the answer.
Why B is right
HIDS (Host-based Intrusion Detection System) monitors program activities on individual systems and can detect and prevent malicious activities. A back door is a security vulnerability, NIDS is network-based (not host-based), and RADIUS is an authentication protocol, none of these monitor and modify malicious activities on a system.
Not this one. Try another answer.
Why C is wrong
NIDS (Network Intrusion Detection System) monitors network traffic, not individual host program activities.
Not this one. Try another answer.
Why D is wrong
RADIUS is an authentication and authorization protocol, not a system activity monitoring tool.
Question 40 Play from 1:05:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NBTSTAT queries NetBIOS name resolution, not DNS servers
Right, B is the answer.
Why B is right
NSLOOKUP is the standard DNS query tool used to retrieve detailed DNS information including A records, MX records, NS records, and other DNS data from DNS servers. It allows administrators to troubleshoot DNS issues and verify DNS configurations.
Not this one. Try another answer.
Why C is wrong
PING tests basic network connectivity but does not query DNS servers for detailed records
Not this one. Try another answer.
Why D is wrong
NETSTAT displays network connections and statistics, not DNS information
Question 41 Play from 1:07:23
Each correct answer represents a part of the solution.
Choose two.
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
A. SSL C. TLS SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are the primary cryptographic protocols that provide secure, encrypted communication between clients and servers over the Internet, protecting data confidentiality and integrity.
Not this one. Try another answer.
Why B is wrong
HTTP is an unsecured application layer protocol without encryption; HTTPS uses SSL/TLS for security.
Right, C is one of the answers.
Why C is right
A. SSL C. TLS SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are the primary cryptographic protocols that provide secure, encrypted communication between clients and servers over the Internet, protecting data confidentiality and integrity.
Not this one. Try another answer.
Why D is wrong
SNMP is a network management protocol primarily for monitoring devices and does not provide secure client-server communication for general purposes.
Question 42 Play from 1:08:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Auditing logs activity but does not prevent spam from arriving.
Not this one. Try another answer.
Why B is wrong
System hardening addresses vulnerability management, not spam prevention.
Right, C is the answer.
Why C is right
Email filtering is the primary and most effective mechanism to protect organizations from spam by screening incoming messages, identifying spam characteristics, and blocking or quarantining unwanted messages. Auditing monitors activity after the fact rather than preventing spam. System hardening protects against malware and vulnerabilities but does not specifically address spam. Packet filtering operates at the network level and is not designed to identify or filter spam messages based on content or characteristics.
Not this one. Try another answer.
Why D is wrong
Packet filtering works at the network layer and cannot analyze email content for spam.
Question 43 Play from 1:10:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
20 bytes is the offset for the destination address, not the source address.
Not this one. Try another answer.
Why B is wrong
8 bytes is too early in the header and falls within the flags/fragment offset field.
Not this one. Try another answer.
Why C is wrong
C is not the best answer here.
Right, D is the answer.
Why D is right
In an IPv4 header, the source address field is located at offset 12 bytes from the start of the header. The header begins with version/IHL (0-1 bytes), ToS (1-2 bytes), total length (2-4 bytes), identification (4-6 bytes), flags/fragment offset (6-8 bytes), TTL (8-9 bytes), protocol (9-10 bytes), and checksum (10-12 bytes), placing the source address at the 12- byte offset.
Question 44 Play from 1:12:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Mandatory Access Control (MAC) requires high maintenance because it relies on security labels and classifications applied to all data, and all users must be assigned appropriate security clearances. Every resource must be classified at a specific level, and every user must hold matching or higher clearance. This centralized, label-based system demands continuous administrative oversight to maintain proper classification and clearance alignment across the entire system.
Not this one. Try another answer.
Why B is wrong
Discretionary Access Control (DAC) allows resource owners to set permissions, reducing central administrative burden.
Not this one. Try another answer.
Why C is wrong
Rule set-based access control uses predefined rules and typically requires less maintenance than MAC systems.
Not this one. Try another answer.
Why D is wrong
Role-Based Access Control (RBAC) simplifies management by assigning permissions to roles rather than individual classifications.
Question 45 Play from 1:13:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The receiver's digital signature is not used to verify a CA's signature on a certificate.
Not this one. Try another answer.
Why B is wrong
The CA's private key is never shared and cannot be used by others to verify signatures; only the CA uses its private key to create signatures.
Not this one. Try another answer.
Why C is wrong
A secret passphrase is not used in PKI signature verification; public key cryptography is the mechanism.
Right, D is the answer.
Why D is right
To verify a digital signature on a certificate, the verifier uses the Certificate Authority's (CA's) public key to decrypt the signature. The CA signs certificates using its private key, and anyone can verify the signature using the corresponding public key, which is widely distributed. This asymmetric process ensures authenticity and non-repudiation of the certificate.
Question 46 Play from 1:15:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lacks both numeric and special characters, only has uppercase and lowercase letters.
Not this one. Try another answer.
Why B is wrong
Lacks uppercase letters and special characters, only has lowercase and numerics.
Not this one. Try another answer.
Why C is wrong
Lacks lowercase letters, only has uppercase letters and special character (@).
Right, D is the answer.
Why D is right
Windows default password complexity requires at least three of four character types: uppercase letters, lowercase letters, numbers, and special characters. Option D (SaNS2006) contains uppercase (S, N), lowercase (a, n, S), and numbers (2, 0, 0, 6), meeting the three-character-type minimum. Option A lacks numbers and special characters. Option B lacks uppercase letters and special characters. Option C has only uppercase letters and special characters but no lowercase letters.
Question 47 Play from 1:17:30
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A firewall installed on a computer cannot proactively detect anomalies related to the computer itself. Firewalls focus on controlling network traffic based on rules but lack the monitoring capabilities to detect system-level anomalies, behavioral changes, or suspicious process activity.
Not this one. Try another answer.
Why B is wrong
NIDS (Network-based Intrusion Detection System) can detect network anomalies such as unusual traffic patterns, port scans, and attack signatures.
Not this one. Try another answer.
Why C is wrong
HIDS (Host-based Intrusion Detection System) specifically monitors host anomalies including process behavior, file modifications, and system calls.
Not this one. Try another answer.
Why D is wrong
Anti-virus scanners proactively detect anomalies by scanning files and memory for malware signatures and suspicious code patterns.
Question 48 Play from 1:19:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
False negative is when an intrusion occurs but no alarm is generated
Right, B is the answer.
Why B is right
A false positive occurs in intrusion detection when an alarm is generated when no actual intrusion or anomaly is present. This is a common challenge in IDS systems where legitimate traffic patterns may trigger false alarms.
Not this one. Try another answer.
Why C is wrong
True positive is when an alarm is generated and an actual intrusion is present
Not this one. Try another answer.
Why D is wrong
True negative is when no alarm is generated and no intrusion is present
Question 49 Play from 1:20:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Network Address Translation (NAT) operates at the network layer (Layer 3) and hides internal LAN IP addresses and network topology by translating private IP addresses to public IP addresses at the router boundary. This provides both functional address translation and a degree of network obscurity. A hub operates at Layer 1, a MAC address is a Layer 2 identifier that does not hide topology, and a NIC is a hardware component, none of these hide internal IP addresses and topology as NAT does.
Not this one. Try another answer.
Why B is wrong
A hub is a Layer 1 device that does not translate addresses or hide topology.
Not this one. Try another answer.
Why C is wrong
MAC addresses operate at Layer 2 and do not hide network topology.
Not this one. Try another answer.
Why D is wrong
A NIC is hardware; it does not perform address translation or topology hiding.
Question 50 Play from 1:22:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Anomaly detection identifies unusual network behavior, not which vulnerabilities are exploitable.
Not this one. Try another answer.
Why B is wrong
Vulnerability scanning identifies weaknesses but does not validate whether they are actually exploitable.
Not this one. Try another answer.
Why C is wrong
Perimeter assessment is a general term for boundary review; it does not specifically validate exploitability of vulnerabilities.
Right, D is the answer.
Why D is right
Penetration testing actively attempts to exploit vulnerabilities to determine which ones are actually exploitable in the network environment. Vulnerability scanning identifies potential vulnerabilities but does not confirm exploitability; penetration testing goes further by validating which vulnerabilities can realistically be leveraged by attackers, providing a practical assessment of actual risk.
Question 51 Play from 1:23:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Passive analysis typically involves monitoring without active intervention, not keyword matching.
Not this one. Try another answer.
Why B is wrong
Retroactive analysis involves examining logs after the fact, not matching keywords in real-time.
Not this one. Try another answer.
Why C is wrong
Exclusive analysis would focus on excluding certain events, which is the opposite of the inclusive keyword-matching approach described.
Right, D is the answer.
Why D is right
Inclusive analysis in HIDS log monitoring uses a predefined list of keywords or phrases that define events of interest, and generates alerts when matches are found in log activity. This whitelist approach alerts on defined relevant events. The term 'inclusive' refers to including only those events that match the specified criteria.
Question 52 Play from 1:25:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TCP sequence numbers are not modified during standard NAT operations.
Right, B is the answer.
Why B is right
Network Address Translation (NAT) changes the source address of packets leaving the network, translating private internal addresses to public routable addresses. This is the fundamental function of NAT, rewriting the source IP address to enable communication between private and public networks.
Not this one. Try another answer.
Why C is wrong
Destination ports are typically not changed by basic NAT (port translation is a separate feature).
Not this one. Try another answer.
Why D is wrong
Destination addresses remain unchanged; NAT modifies the source address.
Question 53 Play from 1:27:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
NAT translates addresses but does not inherently generate forensic evidence trails.
Not this one. Try another answer.
Why B is wrong
State tables track active connections but are not primarily designed for forensic analysis or trend identification.
Right, C is the answer.
Why C is right
Logging is the firewall feature that records network traffic and security events, creating a forensic trail of evidence that can be analyzed to identify attack patterns and trends. Logs capture detailed information about connections, blocked traffic, and suspicious activities that are essential for forensic analysis and trend identification.
Not this one. Try another answer.
Why D is wrong
Content filtering blocks certain content but does not create the detailed forensic trail needed for evidence and trend analysis.
Question 54 Play from 1:28:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
True Negative refers to correctly identifying legitimate (non-malicious) traffic and not alerting.
Not this one. Try another answer.
Why B is wrong
True Positive refers to correctly detecting actual malicious data and alerting appropriately.
Not this one. Try another answer.
Why C is wrong
False Positive refers to incorrectly alerting on legitimate traffic as if it were malicious.
Right, D is the answer.
Why D is right
A False Negative occurs when the IDS fails to detect and alert on malicious data that is actually present. This is the most critical failure mode of an IDS because malicious traffic passes through undetected. True positives correctly identify attacks, true negatives correctly identify legitimate traffic, and false positives incorrectly flag legitimate traffic as malicious.
Question 55 Play from 1:30:08
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
When the NET_ID (network portion) of the source and destination IP addresses match, both hosts are on the same local network segment. The sending host will use local or direct routing, delivering the packet directly to the destination without requiring a router.
Not this one. Try another answer.
Why B is wrong
Circuit switching is a telephone network concept unrelated to IP packet routing.
Not this one. Try another answer.
Why C is wrong
Dynamic routing refers to routing protocol adaptation, not the method used when addresses share the same network.
Not this one. Try another answer.
Why D is wrong
Remote routing is used when NET_IDs differ, requiring an intermediary router.
Question 56 Play from 1:31:43
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SLIP (Serial Line Internet Protocol) is an older point-to-point protocol without built-in security features and does not use IPSec.
Not this one. Try another answer.
Why B is wrong
PPP (Point-to-Point Protocol) is a basic link layer protocol that can be used with IPSec but does not inherently implement VPN with IPSec.
Right, C is the answer.
Why C is right
L2TP (Layer 2 Tunneling Protocol) is specifically designed to implement VPN connections using IPSec for encryption and authentication, making it the protocol that combines tunneling with IPSec security.
Not this one. Try another answer.
Why D is wrong
PPTP (Point-to-Point Tunneling Protocol) uses its own encryption method, not IPSec, for VPN implementation.
Question 57 Play from 1:33:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
chgrp is used to change the group ownership of a file, not file permissions.
Not this one. Try another answer.
Why B is wrong
chperm is not a valid Linux command.
Right, C is the answer.
Why C is right
The chmod command is used to change file access permissions in Linux systems. It allows administrators to modify read, write, and execute permissions for users, groups, and others. chgrp changes group ownership, chown changes file ownership, and chperm is not a valid Linux command.
Not this one. Try another answer.
Why D is wrong
chown is used to change the owner/user of a file, not file permissions.
Question 58 Play from 1:34:36
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
By impersonating a switch (specifically through ARP spoofing and MAC flooding techniques or by acting as a rogue switch), an attacker can redirect traffic and sniff frames from other hosts on a switched network. This works because switches learn MAC addresses and can be manipulated to send traffic to the attacker's port.
Not this one. Try another answer.
Why B is wrong
A bridge operates similarly to a switch; impersonating one doesn't provide the same sniffing advantage.
Not this one. Try another answer.
Why C is wrong
A hub already broadcasts to all ports, so impersonating it doesn't help an attacker gain additional sniffing capability.
Not this one. Try another answer.
Why D is wrong
A router operates at Layer 3 and doesn't directly control switched Ethernet frame delivery at Layer 2.
Question 59 Play from 1:36:06
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
IMAP (Internet Message Access Protocol) allows email clients to access and manipulate email on a remote server without downloading messages to the local computer. Users can read, organize, and manage emails while they remain stored on the server.
Not this one. Try another answer.
Why B is wrong
SNMP (Simple Network Management Protocol) is used for network device management, not email access.
Not this one. Try another answer.
Why C is wrong
POP3 (Post Office Protocol 3) downloads email from the server to the local computer, rather than accessing it remotely without downloading.
Not this one. Try another answer.
Why D is wrong
SMTP (Simple Mail Transfer Protocol) is used for sending email, not for accessing or retrieving remote email.
Question 60 Play from 1:37:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
UDP is a transport layer protocol for data transmission and does not provide maintenance or error reporting functions.
Right, B is the answer.
Why B is right
ICMP (Internet Control Message Protocol) is specifically designed to provide network maintenance, diagnostics, and error reporting functions such as ping, traceroute, and unreachable destination notifications.
Not this one. Try another answer.
Why C is wrong
PPP is a point-to-point link layer protocol for establishing connections, not for network-wide maintenance and error reporting.
Not this one. Try another answer.
Why D is wrong
IGMP is used for multicast group management and does not provide general network maintenance and error reporting capabilities.
Question 61 Play from 1:39:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ICMP messages are carried within IP packets; the TTL is in the enclosing IP header, not the ICMP header.
Right, B is the answer.
Why B is right
The Time-To-Live (TTL) field is located in byte 8 of the IP header (IPv4). It is an 8-bit field that decreases by one at each hop and is used to prevent packets from circulating indefinitely in routing loops.
Not this one. Try another answer.
Why C is wrong
TCP operates at Layer 4 and does not contain a TTL field; that function belongs to the IP layer.
Not this one. Try another answer.
Why D is wrong
DNS operates over UDP or TCP at Layer 4; the TTL function exists at Layer 3 in the IP header.
Question 62 Play from 1:40:47
Which of the following types of security control is implemented in this case?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Detective controls identify and alert on security issues after they happen, not prevent them.
Right, B is the answer.
Why B is right
A firewall that blocks unauthorized network connections is a preventive control because it acts before an attack occurs to prevent unauthorized access. Preventive controls stop security incidents from happening, whereas detective controls identify incidents after they occur, directive controls guide behavior, and corrective controls remediate damage after an incident.
Not this one. Try another answer.
Why C is wrong
Directive controls provide guidance and policies, not technical prevention mechanisms.
Not this one. Try another answer.
Why D is wrong
Corrective controls fix issues after they have already occurred.
Question 63 Play from 1:42:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Creating the baseline before patching could capture an insecure state; it should be created after hardening but before exposure to attack.
Not this one. Try another answer.
Why B is wrong
Creating a database after compromise defeats the purpose, as malicious changes would be included in the baseline.
Right, C is the answer.
Why C is right
A file integrity checker database must be created before a system is compromised to establish a clean baseline of file hashes and metadata. This baseline is then used to detect unauthorized changes by comparing current file states against the original baseline. Creating the database after compromise would capture malicious modifications as legitimate, rendering the tool ineffective for detecting the attack.
Not this one. Try another answer.
Why D is wrong
Creating a database during an active attack is too late to establish a trustworthy baseline.
Question 64 Play from 1:44:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Firewall compatibility rules are not a detection methodology used by IPS devices.
Right, B is the answer.
Why B is right
In-line NIDS/IPS devices use three primary detection methodologies: signature-based rules (matching known attack patterns), anomaly analysis (detecting deviations from normal behavior), and application analysis (understanding and inspecting application-layer protocols and behavior). Application analysis helps identify sophisticated attacks that operate at the application layer.
Not this one. Try another answer.
Why C is wrong
ICMP and UDP active scanning describes offensive reconnaissance techniques, not IPS detection methods.
Not this one. Try another answer.
Why D is wrong
MAC address filtering is a Layer 2 access control mechanism, not part of IPS malicious event detection.
Question 65 Play from 1:45:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SMTP (Simple Mail Transfer Protocol) is the standard protocol used to send emails across the Internet. It handles the transmission of messages from a client to a mail server or between mail servers. While IMAP4 and POP3 are used for receiving/retrieving emails and HTTP is a web protocol, SMTP is the designated protocol specifically for sending emails.
Not this one. Try another answer.
Why B is wrong
IMAP4 is used for receiving and accessing emails on a mail server, not sending them.
Not this one. Try another answer.
Why C is wrong
POP3 is used for retrieving emails from a mail server, not sending them.
Not this one. Try another answer.
Why D is wrong
HTTP is a general web protocol used for transferring web pages and content, not the standard email transmission protocol.
Question 66 Play from 1:47:34
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Information-centric defense is a defense-in-depth approach that classifies and prioritizes information based on its value and sensitivity to the organization, then applies appropriate protection layers accordingly. This principle recognizes that not all information has equal value and requires customized protection strategies based on organizational assets.
Not this one. Try another answer.
Why B is wrong
Uniform information protection applies the same security controls to all information regardless of value, which contradicts the value-awareness principle.
Not this one. Try another answer.
Why C is wrong
General information protection is not a recognized defense-in-depth principle and is too vague.
Not this one. Try another answer.
Why D is wrong
Perimeter layering focuses on network boundary protection, not on classification based on information value.
Question 67 Play from 1:49:14
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Hardening is the term used for the process of securing a system or device by reducing its vulnerability surface through configuration changes, updates, and security controls. Authentication is identity verification, cryptography is encryption, and sanitization is data destruction, none of these describe the overall process of securing a system's infrastructure.
Not this one. Try another answer.
Why B is wrong
Authentication is the process of verifying identity, not the overall process of securing a system.
Not this one. Try another answer.
Why C is wrong
Cryptography involves encryption and decryption, not the comprehensive security process.
Not this one. Try another answer.
Why D is wrong
Sanitization refers to secure data destruction, not the overall securing of a system infrastructure.
Question 68 Play from 1:50:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A local DNS server provides a cached, non-authoritative response, not an authoritative one.
Not this one. Try another answer.
Why B is wrong
Top-level domain servers direct queries to authoritative servers but do not provide the authoritative answer themselves.
Right, C is the answer.
Why C is right
An authoritative DNS reply comes from the authoritative nameserver for the domain in question. For www.google.com, the authoritative reply would come from Google's own DNS server (or servers designated by Google), which contains the actual resource records for that domain. While a local DNS server may cache and return the answer, it would be a cached (non-authoritative) response.
Not this one. Try another answer.
Why D is wrong
Root DNS servers direct queries further down the hierarchy; they do not provide authoritative answers for specific domains.
Question 69 Play from 1:52:36
What sort of risk assessment is most appropriate?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Annualized Risk Assessment requires detailed financial calculations and historical data, making it slower.
Right, B is the answer.
Why B is right
When a manager needs to quickly assess risks without extensive data collection or calculations, qualitative risk assessment is most appropriate. Qualitative assessment uses descriptive categories (high/medium/low) and subjective judgment, allowing for rapid evaluation. Quantitative assessment requires detailed metrics and financial modeling, which is more time-consuming. Annualized, Technical, and Iterative are either too specific or not standard risk assessment methodologies.
Not this one. Try another answer.
Why C is wrong
Quantitative risk assessment requires extensive metrics, calculations, and cost data, which is time-consuming.
Not this one. Try another answer.
Why D is wrong
Technical Risk Assessment is not a standard risk assessment classification.
Not this one. Try another answer.
Why E is wrong
Iterative Risk Assessment is not a standard risk assessment type in this context.
Question 70 Play from 1:54:38
Which policy does this pertain to?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Monitoring employee hard disks pertains to privacy policy, as it concerns what personal or professional data employees may store and how that data is monitored or accessed by the organization.
Not this one. Try another answer.
Why B is wrong
Backup policy deals with procedures for backing up and recovering data, not monitoring hard disk contents.
Not this one. Try another answer.
Why C is wrong
User password policy governs password creation and management requirements, not hard disk monitoring.
Not this one. Try another answer.
Why D is wrong
Network security policy addresses network-level security measures rather than individual employee computer monitoring.
Question 71 Play from 1:56:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
File integrity relates to file systems and data, not IPS false positive impacts.
Not this one. Try another answer.
Why B is wrong
False positives block legitimate traffic, not allow malicious code through.
Right, C is the answer.
Why C is right
False positives in IPS systems cause legitimate network traffic and services to be blocked or terminated, resulting in denial of service to legitimate users and applications. This disrupts normal business operations.
Not this one. Try another answer.
Why D is wrong
While rule misinterpretation may cause false positives, the problem with false positives is the operational impact, not the cause.
Question 72 Play from 1:57:33
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A Security Access Token (SAT) contains the Security ID (SID) numbers of all groups to which the authenticated user belongs. This information is used throughout the Windows session to determine access rights and permissions for resources.
Not this one. Try another answer.
Why B is wrong
Cached authentications are stored separately in credential caches, not in the SAT itself.
Not this one. Try another answer.
Why C is wrong
Domain privileges are determined by group memberships and policy, not directly stored in the SAT structure.
Not this one. Try another answer.
Why D is wrong
The SAT contains information about the authenticated user and their groups, not a list of all authenticated local users on the system.
Question 73 Play from 1:59:15
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Supplicant is a required component of 802.1X network authentication. It is the software or device (client) that authenticates to the network by requesting access and responding to authentication challenges from the authenticator (network switch or access point).
Not this one. Try another answer.
Why B is wrong
While a Certificate Authority may be used in some 802.1X implementations, it is not a required component for all 802.1X deployments.
Not this one. Try another answer.
Why C is wrong
A Ticket Granting Server belongs to Kerberos authentication, not 802.1X.
Not this one. Try another answer.
Why D is wrong
IPSec is a network security protocol unrelated to the core components required for 802.1X authentication.
Question 74 Play from 2:00:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Hash functions are neither asymmetric nor symmetric, they are one-way functions distinct from both categories.
Right, B is the answer.
Why B is right
The primary characteristic of hash operations is that they are non-reversible (one-way functions). Given a hash output, it is computationally infeasible to derive the original input. This property is fundamental to their use in security applications like password storage and data integrity verification.
Not this one. Try another answer.
Why C is wrong
Hash operations are not symmetric; symmetric operations are reversible with a key, unlike hashing.
Not this one. Try another answer.
Why D is wrong
Hash functions produce fixed-length output regardless of input size, not variable length output.
Question 75 Play from 2:02:20
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
err (3) is less severe than both emerg and alert.
Right, B is the answer.
Why B is right
Unix syslog defines eight priority levels in decreasing severity: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), and debug (7). 'Emerg' is the most severe level, used for emergency conditions where the system is unusable. The other options represent progressively lower severity levels.
Not this one. Try another answer.
Why C is wrong
crit (2) is less severe than both emerg and alert.
Not this one. Try another answer.
Why D is wrong
alert (1) is the second-most severe, less severe than emerg.
Question 76 Play from 2:03:44
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The `dd` command is the standard Unix utility for copying raw disk and file system data byte-by-byte, preserving all data including unallocated space, metadata, and deleted files. This makes it essential for forensic analysis where maintaining a bit-for-bit copy of the original media is critical. The `dd` command can create forensic images without interpreting the file system, which is exactly what forensic analysis requires.
Not this one. Try another answer.
Why B is wrong
The `backup` command is not a standard Unix command for this purpose.
Not this one. Try another answer.
Why C is wrong
The `cp` command copies files at the file system level, missing unallocated space and not suitable for forensic imaging.
Not this one. Try another answer.
Why D is wrong
The `gzip` command is a compression utility, not designed for raw data acquisition or forensic imaging.
Question 77 Play from 2:05:16
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Prevention controls are countermeasures designed to stop threats from reaching vulnerabilities by blocking or eliminating the threat vector before it can exploit a weakness. Prevention controls proactively defend against attacks, representing the most direct approach to ensuring a threat vector cannot meet a vulnerability.
Not this one. Try another answer.
Why B is wrong
Detection controls identify and alert on threats after they occur, but do not prevent threat vectors from reaching vulnerabilities.
Not this one. Try another answer.
Why C is wrong
Monitoring controls observe and record system activity but do not prevent threats from exploiting vulnerabilities.
Not this one. Try another answer.
Why D is wrong
Subversive controls is not a recognized standard security control category in established frameworks.
Question 78 Play from 2:06:54
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The chown command can change both the owner (user) and group of a file in a single operation using the syntax 'chown user:group filename'. It is the only command that can modify both attributes simultaneously.
Not this one. Try another answer.
Why B is wrong
chgrp only changes the group ownership, not the username.
Not this one. Try another answer.
Why C is wrong
chmod changes file permissions (read, write, execute), not ownership or group membership.
Not this one. Try another answer.
Why D is wrong
newgrp changes the user's current group in the login session but does not change file ownership.
Question 79 Play from 2:08:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Telnet uses TCP port 23 for establishing terminal sessions.
Right, B is the answer.
Why B is right
SNMP (Simple Network Management Protocol) operates over UDP port 161 for queries and port 162 for traps. SNMP was designed to use UDP because it provides lightweight, connectionless communication suitable for network monitoring without the overhead of TCP.
Not this one. Try another answer.
Why C is wrong
IMAP (Internet Message Access Protocol) uses TCP port 143 for secure email retrieval.
Not this one. Try another answer.
Why D is wrong
LDAP (Lightweight Directory Access Protocol) primarily uses TCP port 389, though it can also use TCP.
Question 80 Play from 2:09:40
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Guest systems do not perform NAT; they are behind the NAT device.
Not this one. Try another answer.
Why B is wrong
Local gateway is not the component performing NAT in VMware NAT mode.
Right, C is the answer.
Why C is right
In VMware NAT mode, the host system acts as the NAT device, translating network addresses between the guest virtual machines and the external network. The host system performs the address translation, allowing guest systems to communicate with external networks while appearing to use the host's address.
Not this one. Try another answer.
Why D is wrong
Virtual system is too vague; the host system specifically performs the NAT function.
Question 81 Play from 2:11:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
RARP (Reverse Address Resolution Protocol) is specifically designed for a host to discover its own IP address when it knows its MAC address. A host with a known MAC address sends a RARP request to obtain the corresponding IP address from a RARP server.
Not this one. Try another answer.
Why B is wrong
ARP does the opposite, it resolves IP addresses to MAC addresses, not MAC to IP.
Not this one. Try another answer.
Why C is wrong
DNS resolves domain names to IP addresses, not MAC addresses to IP addresses.
Not this one. Try another answer.
Why D is wrong
RDNS (Reverse DNS) performs reverse lookups of IP addresses to domain names, not MAC to IP resolution.
Question 82 Play from 2:12:40
IP tables -I INPUT -s 99.23.45.1/32 -j DROP
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The command 'iptables -I INPUT -s 99.23.45.1/32 -j DROP' inserts (-I) a rule into the INPUT chain that matches packets from the source (-s) address 99.23.45.1 and applies the DROP action (-j DROP) to them. This drops all incoming packets originating from that specific source address. The /32 indicates a single host. Option B incorrectly describes the action as 'input,' option C mentions logging which isn't part of this command, and option D is incorrect because the rule targets source addresses, not destination addresses.
Not this one. Try another answer.
Why B is wrong
The command drops packets; it does not input or forward them to the source address.
Not this one. Try another answer.
Why C is wrong
This command uses DROP action, not LOG; no logging occurs without explicit -j LOG specification.
Not this one. Try another answer.
Why D is wrong
The -s flag specifies source address filtering, not destination; packets are dropped based on origin.
Question 83 Play from 2:15:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Authentication is the process of verifying identity (proving you are who you claim to be), not determining what activities are permitted.
Not this one. Try another answer.
Why B is wrong
Identification is simply claiming or stating an identity, not determining what permissions are granted.
Right, C is the answer.
Why C is right
Authorization is the process of determining what actions, permissions, and functions an authenticated user or entity is allowed to perform. It answers the question 'what can this user do?' after they have been identified and authenticated.
Not this one. Try another answer.
Why D is wrong
Validation refers to confirming the correctness or integrity of data, not defining user permissions.
Question 84 Play from 2:16:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Keeping an algorithm secret (security through obscurity) is not a sign of strength; it often masks weaknesses.
Right, B is the answer.
Why B is right
A strong encryption algorithm must be well-known and publicly scrutinized. The security of a strong algorithm relies on the strength of the key and the mathematics behind it, not on keeping the algorithm itself secret. Public algorithms undergo extensive peer review and cryptanalysis, which actually strengthens confidence in their security. Kerckhoffs's principle states that a cryptosystem should be secure even if everything about the system is public except the key.
Not this one. Try another answer.
Why C is wrong
Confidentiality of an algorithm does not contribute to its cryptographic strength; strong algorithms are openly published.
Not this one. Try another answer.
Why D is wrong
Proprietary algorithms are not necessarily strong; in fact, closed algorithms often lack the peer review necessary to identify weaknesses.
Question 85 Play from 2:18:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
1755 would indicate a sticky bit (1) with wrong base permissions; there is no sticky bit in this string.
Right, B is the answer.
Why B is right
The symbolic permission string 'rwsr-sr-x' breaks down as follows: the first 's' in position 4 indicates setuid (4), the second 's' in position 7 indicates setgid (2), and the owner permissions are 'rws' (7), group permissions are 'sr' (5), and other permissions are 'r-x' (5). The special bits (setuid + setgid) total 6 (4+2), giving the octal notation 6755.
Not this one. Try another answer.
Why C is wrong
6645 misrepresents the permissions; the group and other sections should be 5 and 5, not 4 and 5.
Not this one. Try another answer.
Why D is wrong
1644 incorrectly assumes a sticky bit and wrong base permissions entirely.
Question 86 Play from 2:19:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Trojans are deceptive programs that do not have self-replication capability.
Not this one. Try another answer.
Why B is wrong
Boot infectors target boot sectors but are not self-contained or self-replicating in the typical sense.
Not this one. Try another answer.
Why C is wrong
Viruses require parasitic infection of host code to replicate, making them dependent on hosts unlike worms.
Right, D is the answer.
Why D is right
A worm is a self-contained, self-replicating program that spreads independently without needing to parasitically attach to host code. Worms can propagate across networks and systems autonomously, unlike viruses which require a host program to execute. Trojans are deceptive programs that don't self-replicate, boot infectors attack the boot sector, and viruses require host code infection to propagate.
Question 87 Play from 2:21:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Changing passwords could alter evidence and should not be done before securing the area and assessing the incident.
Right, B is the answer.
Why B is right
During the containment phase of incident handling, securing the area is the foundational first step to prevent further compromise, preserve evidence, and control access. This must occur before other actions like password changes, which could alter evidence, or notifications that might alert the threat actor. Jump bag preparation is a pre-incident activity, and reporting occurs after investigation.
Not this one. Try another answer.
Why C is wrong
Preparing the jump bag is a pre-incident preparation activity, not part of active incident containment.
Not this one. Try another answer.
Why D is wrong
Management notification typically occurs after initial containment and assessment, not as the first containment action.
Not this one. Try another answer.
Why E is wrong
Reporting is completed after investigation and analysis, not during the initial containment phase.
Question 88 Play from 2:23:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port scanning identifies open ports on known systems, not the enumeration of all hosts on a network.
Not this one. Try another answer.
Why B is wrong
Vulnerability scanning assesses known hosts for weaknesses, rather than discovering which hosts exist.
Not this one. Try another answer.
Why C is wrong
GPS mapping is geographic location mapping unrelated to network administration.
Right, D is the answer.
Why D is right
Network mapping is the process of discovering and identifying all hosts and devices connected to a network. Enumerating all hosts on a network is the core definition of network mapping.
Question 89 Play from 2:24:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
GPOs are applied at 90-minute intervals for periodic refresh.
Not this one. Try another answer.
Why B is wrong
GPOs are applied automatically at logon.
Right, C is the answer.
Why C is right
Group Policy Objects are automatically applied at logon (B), at boot-up (D), and at periodic intervals of 90 minutes (A) for refreshing policies. However, GPOs are NOT automatically applied every time Windows Explorer is launched. Windows Explorer is a file manager utility and does not trigger GPO reapplication; policy updates occur at defined intervals and system events, not application launches.
Not this one. Try another answer.
Why D is wrong
GPOs are applied automatically at boot-up.
Question 90 Play from 2:26:01
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Encapsulation is the networking concept where headers and trailers (protocol-specific information) are added around user data at each layer of the OSI model. This allows each layer to add its own addressing and control information as data moves through the network stack.
Not this one. Try another answer.
Why B is wrong
Authentication verifies the identity of users or systems, not the addition of headers and trailers
Not this one. Try another answer.
Why C is wrong
Authorization controls what authenticated users are permitted to access, not data formatting
Not this one. Try another answer.
Why D is wrong
Encryption scrambles data for confidentiality but doesn't define the addition of headers and trailers
Question 91 Play from 2:27:25
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The robots.txt file is the standard text file placed in a website's root directory that provides instructions to web crawlers and spiders about which areas of the site should or should not be accessed. Search engines and web spiders consult this file to respect website owners' preferences. The other filenames (Restricted.txt, Spider.txt, Search.txt) are not recognized standards in web protocol specifications.
Not this one. Try another answer.
Why B is wrong
Restricted.txt is not a recognized standard file for controlling web crawler access.
Not this one. Try another answer.
Why C is wrong
Spider.txt is not the standard filename; the actual standard is robots.txt.
Not this one. Try another answer.
Why D is wrong
Search.txt is not a recognized standard for instructing search engines or spiders.
Question 92 Play from 2:29:02
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A content filtering web proxy server is specifically designed to provide administrative controls over the content that users can access. It inspects traffic and applies policies to block or allow content based on categories, keywords, or other criteria defined by administrators.
Not this one. Try another answer.
Why B is wrong
Caching proxy servers focus on performance improvement by storing frequently accessed content.
Not this one. Try another answer.
Why C is wrong
Forced proxy servers enforce proxy usage but don't specifically provide content control.
Not this one. Try another answer.
Why D is wrong
A generic web proxy server provides basic proxy functions without specialized content filtering controls.
Question 93 Play from 2:30:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Session information is sent continuously with each request, not just when session data changes.
Right, B is the answer.
Why B is right
Session information is sent to the web server with every subsequent request after the session is established. The browser includes session identifiers (typically in cookies, headers, or URL parameters) with each HTTP request so the server can maintain session state and associate requests with the authenticated user.
Not this one. Try another answer.
Why C is wrong
Hidden form elements may contain session data, but session information itself is sent with every request regardless.
Not this one. Try another answer.
Why D is wrong
The initial request registers the session, but subsequent requests also carry session information with every new request.
Question 94 Play from 2:32:11
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Camera recordings document a breach but do not protect the data on the tapes from unauthorized access.
Not this one. Try another answer.
Why B is wrong
Security guards are a physical control that has already been bypassed by assumption in the question.
Right, C is the answer.
Why C is right
Encryption is the critical technical control that protects data confidentiality even after physical security is breached. If an intruder obtains encrypted tapes, the data remains unreadable without the decryption keys. This is a detective/preventive control that provides the last line of defense when physical security fails, making it more effective than other options which either don't protect the data itself or are detective-only controls.
Not this one. Try another answer.
Why D is wrong
Shredding is a destruction method, not applicable to tapes still in use for critical data.
Not this one. Try another answer.
Why E is wrong
Corrective controls address issues after they occur but do not prevent unauthorized data access if tapes are obtained.
Question 95 Play from 2:34:03
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Vector-oriented defense involves identifying the various attack vectors (means by which threats manifest) and implementing specific security controls to neutralize each threat vector. This approach focuses on understanding threat pathways and deploying countermeasures against each identified vector.
Not this one. Try another answer.
Why B is wrong
Uniform protection applies the same security measures across all systems without regard to specific threat vectors.
Not this one. Try another answer.
Why C is wrong
Information centric defense focuses on protecting data based on its classification and sensitivity, not on threat vectors.
Not this one. Try another answer.
Why D is wrong
Protected enclaves involve creating isolated security zones rather than addressing specific threat manifestation paths.
Question 96 Play from 2:35:34
Which of the following commands will you use to know the process identification number (PID) of the process?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
killall terminates processes by name but doesn't display their PIDs
Right, B is the answer.
Why B is right
The ps command is used to display information about running processes, including their process identification numbers (PIDs). This is the standard tool for identifying which PID corresponds to a specific process before terminating it with kill or killall.
Not this one. Try another answer.
Why C is wrong
getpid is a programming function call, not a command-line utility for identifying running processes
Not this one. Try another answer.
Why D is wrong
kill is used to terminate a process once you know its PID, not to find the PID
Question 97 Play from 2:37:05
Each correct answer represents a complete solution.
Choose three.
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The three primary categories of access controls are: Physical (locks, guards, facilities), Administrative (policies, procedures, training), and Technical (firewalls, encryption, authentication systems). Option C, 'Automatic,' is not a recognized category of access controls in standard security frameworks.
Right, B is one of the answers.
Why B is right
The three primary categories of access controls are: Physical (locks, guards, facilities), Administrative (policies, procedures, training), and Technical (firewalls, encryption, authentication systems). Option C, 'Automatic,' is not a recognized category of access controls in standard security frameworks.
Not this one. Try another answer.
Why C is wrong
Automatic is not a recognized category of access controls; controls require design and implementation by security professionals.
Right, D is one of the answers.
Why D is right
The three primary categories of access controls are: Physical (locks, guards, facilities), Administrative (policies, procedures, training), and Technical (firewalls, encryption, authentication systems). Option C, 'Automatic,' is not a recognized category of access controls in standard security frameworks.
Question 98 Play from 2:38:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Honeypot is the correct term; 'Files pot' is not a recognized security concept.
Right, B is the answer.
Why B is right
A honeypot is a security tool designed to attract and deceive potential intruders by appearing as a legitimate system or network resource. It is intentionally made attractive to attackers to study their behavior, detect intrusion attempts, and gather intelligence about attack methods. Honeypots collect data on attack patterns without exposing actual production systems to risk.
Not this one. Try another answer.
Why C is wrong
Data pot is not a standard security term or defensive mechanism.
Not this one. Try another answer.
Why D is wrong
A bastion host is a hardened server that acts as a gateway or control point, not a tool designed to attract intruders.
Question 99 Play from 2:39:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Analysis phase is too late; decisions should be pre-established in policy.
Right, B is the answer.
Why B is right
Law enforcement notification decisions must be made during the preparation phase when policies are being established, not reactively during an incident. This allows the organization to understand legal obligations, jurisdictional requirements, and notification procedures before a crisis occurs. Making this decision during analysis, recovery, or reaction would be too late and could compromise investigations or violate legal requirements.
Not this one. Try another answer.
Why C is wrong
Recovery is the final phase and too late for initial law enforcement decisions.
Not this one. Try another answer.
Why D is wrong
Reaction phase occurs during the incident; planning should happen beforehand.
Question 100 Play from 2:41:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This command has invalid syntax; there is a missing space between "chmod 444" and "/etc/shadow".
Not this one. Try another answer.
Why B is wrong
The chown command changes file ownership, not permissions; it would not make the file readable only by root.
Right, C is the answer.
Why C is right
The command chmod 400 /etc/shadow sets permissions to read-only (4) for the owner (root) with no permissions for group or others (00). In octal notation, 4 = read, 2 = write, 1 = execute, so 400 means owner can only read. Option A uses invalid syntax (missing space), Option B uses chown which changes ownership not permissions, and Option D incorrectly uses chown with a numeric mode instead of an owner specification.
Not this one. Try another answer.
Why D is wrong
The chown command expects owner:group format, not a numeric permission code like 400.
Transcript
Play from 00:00 Question 1. A container host suffered an outage when one container consumed all available memory and starved the other workloads on the same host. Which Linux kernel feature should be used to cap the memory and CPU that each container can consume? Here are the options. Option A. Network namespaces. Option B. Seccomp profiles. Option C. AppArmor profiles. Option D. Control groups (cgroups). Pause the video now if you want time to think about the answer.
The correct answer is D. Control groups (cgroups). Containers rely on two separate kernel features. Namespaces provide isolation, giving each container its own view of processes, network interfaces, mounts and hostnames. Control groups provide resource accounting and limiting, so an administrator can restrict how much memory, CPU and block I/O a container may use. Setting cgroup limits, for example with the Docker --memory and --cpus options, protects the host and neighboring containers against a runaway or malicious container that tries to exhaust shared resources, which is a form of denial of service. Now, why are the other options incorrect? Option A is incorrect. Network namespaces give a container its own network stack for isolation but do not limit memory or CPU consumption. Option B is incorrect. Seccomp filters which system calls a process may make and has no mechanism for metering memory or CPU usage. Option C is incorrect. AppArmor is a mandatory access control system that restricts file and resource access by path, not resource consumption. Therefore, D, Control groups (cgroups), is the correct answer.
Play from 02:10 Question 2. On a Mac running macOS 15, an administrator uses sudo to obtain a root shell and attempts to replace a binary in /usr/bin with a modified version. The operation fails with an "Operation not permitted" error. Which macOS security feature is most likely preventing the change? Here are the options. Option A. System Integrity Protection. Option B. Gatekeeper. Option C. FileVault. Option D. XProtect. Pause the video now if you want time to think about the answer.
The correct answer is A. System Integrity Protection. System Integrity Protection restricts the root user and limits what root can do to protected parts of the operating system, including /System, /usr, /bin, /sbin and the apps that ship with macOS. Only Apple-signed processes with special entitlements, such as Apple software updates and installers, may modify these locations. This means that malware which gains root through a stolen administrator password or an exploit still cannot tamper with core system binaries, while third-party software continues to install into locations such as /Applications and /usr/local. Now, why are the other options incorrect? Option B is incorrect. Gatekeeper checks the signature and notarization of apps when they are opened and does not block root from writing to system directories. Option C is incorrect. FileVault encrypts the startup disk to protect data at rest and does not restrict which files an unlocked system lets root modify. Option D is incorrect. XProtect detects and blocks known malware signatures and does not enforce write protection on operating system paths. Therefore, A, System Integrity Protection, is the correct answer.
Play from 04:15 Question 3. A threat hunter wants to find suspicious encoded PowerShell commands on Windows endpoints that run Sysmon. The hunt requires the full command line of each new process, its parent process and a hash of the executable image. Which Sysmon event ID should the threat hunter query? Here are the options. Option A. Event ID 3. Option B. Event ID 11. Option C. Event ID 1. Option D. Event ID 22. Pause the video now if you want time to think about the answer.
The correct answer is C. Event ID 1. Sysmon, a Sysinternals system service and driver, writes detailed activity to the Microsoft-Windows-Sysmon/Operational event log. Event ID 1, process creation, records the image path, the full command line, the parent process and its command line, a ProcessGuid that stays unique even when Windows reuses process IDs, and hashes of the image using the configured algorithms. These fields make it a primary source for hunting living-off-the-land activity such as powershell.exe launched with an -EncodedCommand argument by an Office application. Now, why are the other options incorrect? Option A is incorrect. Event ID 3 records network connections, and it is disabled by default. Option B is incorrect. Event ID 11 records file create or overwrite operations, not process execution details. Option D is incorrect. Event ID 22 records DNS queries made by processes, not process creation. Therefore, C, Event ID 1, is the correct answer.
Show full transcriptShow less
Play from 06:16 Question 4. A SOC team is mapping a new detection to MITRE ATT&CK. In the observed activity, the adversary's goal was to obtain account credentials, and the method used was dumping the memory of the LSASS process. In ATT&CK terminology, what does Credential Access represent in this mapping? Here are the options. Option A. A technique. Option B. A procedure. Option C. A mitigation. Option D. A tactic. Pause the video now if you want time to think about the answer.
The correct answer is D. A tactic. ATT&CK describes adversary behavior at several levels. Tactics represent the why: the adversary's tactical goal or reason for performing an action, such as Initial Access, Persistence or Credential Access. Techniques represent the how: the way an adversary achieves that goal, such as OS Credential Dumping, with sub-techniques such as LSASS Memory adding detail. Procedures are the specific implementations observed in the wild, such as a particular group running a named tool against LSASS. Defenders use this structure to map detections and identify coverage gaps across each tactic. Now, why are the other options incorrect? Option A is incorrect. A technique describes how a goal is achieved, which in this mapping is dumping LSASS memory, not the goal itself. Option B is incorrect. A procedure is a specific observed implementation of a technique by an adversary or tool, not a broad goal. Option C is incorrect. Mitigations in ATT&CK are defensive measures that prevent a technique from succeeding, not descriptions of adversary goals. Therefore, D, A tactic, is the correct answer.
Play from 08:30 Question 5. What defensive measure could have been taken that would have protected the confidentiality of files that were divulged by systems that were compromised by malware? Here are the options. Option A. Ingress filtering at the host level. Option B. Monitoring for abnormal traffic flow. Option C. Installing file integrity monitoring software. Option D. Encrypting the files locally when not in use. Pause the video now if you want time to think about the answer.
The correct answer is D. Encrypting the files locally when not in use. Encrypting files locally when not in use would protect their confidentiality if they were exfiltrated by malware. Even if malware successfully copies and transmits encrypted files, the attacker cannot read the contents without the encryption key. This provides confidentiality protection at rest and during unauthorized access, making it the most direct defense against file disclosure. Now, why are the other options incorrect? Option A is incorrect. Ingress filtering at the host level controls incoming traffic but does not prevent malware from reading unencrypted files on the system. Option B is incorrect. Monitoring for abnormal traffic flow can detect exfiltration after it occurs but does not prevent the malware from reading unencrypted files. Option C is incorrect. File integrity monitoring detects unauthorized changes but does not prevent files from being read or copied by malware. Therefore, D, Encrypting the files locally when not in use, is the correct answer.
Play from 10:21 Question 6. Who is responsible for deciding the appropriate classification level for data within an organization? Here are the options. Option A. Data custodian. Option B. Security auditor. Option C. End user. Option D. Data owner. Pause the video now if you want time to think about the answer.
The correct answer is D. Data owner. The data owner is responsible for deciding the appropriate classification level for data. Data owners have authority over their data assets and make decisions about sensitivity levels, access restrictions, and protection requirements. Custodians implement and maintain the protections decided by owners, security auditors verify compliance, and end users follow established policies. Now, why are the other options incorrect? Option A is incorrect. Data custodians implement and maintain security measures but do not decide classification levels. Option B is incorrect. Security auditors verify that data is properly classified and protected; they do not make initial classification decisions. Option C is incorrect. End users follow the classification policies established by data owners and do not determine classification levels. Therefore, D, Data owner, is the correct answer.
Play from 11:56 Question 7. What is the main reason that DES is faster than RSA? Here are the options. Option A. DES is less secure. Option B. DES is implemented in hardware and RSA is implemented in software. Option C. Asymmetric cryptography is generally much faster than symmetric. Option D. Symmetric cryptography is generally much faster than asymmetric. Pause the video now if you want time to think about the answer.
The correct answer is D. Symmetric cryptography is generally much faster than asymmetric. Symmetric cryptography (such as DES) is generally much faster than asymmetric cryptography (such as RSA) because symmetric algorithms use simpler mathematical operations and shorter key lengths relative to their security strength. Asymmetric cryptography requires complex mathematical operations like modular exponentiation on very large numbers, making it inherently slower. This is why symmetric encryption is used for bulk data encryption and asymmetric encryption is used for key exchange and signatures. Now, why are the other options incorrect? Option A is incorrect. Security level does not determine speed; many secure algorithms can be fast or slow depending on their mathematical basis. Option B is incorrect. Implementation medium (hardware vs software) is not the primary reason; the algorithmic difference between symmetric and asymmetric is fundamental. Option C is incorrect. This is backwards; asymmetric cryptography is actually much slower than symmetric cryptography. Therefore, D, Symmetric cryptography is generally much faster than asymmetric, is the correct answer.
Play from 14:02 Question 8. Which Windows event log would you look in if you wanted information about whether or not a specific diver was running at start up? Here are the options. Option A. Application. Option B. System. Option C. Startup. Option D. Security. Pause the video now if you want time to think about the answer.
The correct answer is B. System. The System event log records hardware, driver, and system-level events, including driver loading during startup. Information about whether a specific driver was running at system startup would be logged in the System event log where startup processes and driver initialization are recorded. Now, why are the other options incorrect? Option A is incorrect. The Application log records application-level events, not driver startup information. Option C is incorrect. There is no standard Windows event log called 'Startup'; startup events are logged in the System log. Option D is incorrect. The Security log records authentication, authorization, and access control events, not driver startup information. Therefore, B, System, is the correct answer.
Play from 15:25 Question 9. Which of the following utilities provides an efficient way to give specific users permission to use specific system commands at the root level of a Linux operating system? Here are the options. Option A. Snort. Option B. Apache. Option C. SSH. Option D. SUDO. Pause the video now if you want time to think about the answer.
The correct answer is D. SUDO. SUDO (substitute user do) is a utility that allows specific users to execute specific commands with root-level privileges without needing the root password, providing granular control over command access. Now, why are the other options incorrect? Option A is incorrect. Snort is an intrusion detection system, not a privilege management tool. Option B is incorrect. Apache is a web server software and does not manage system command permissions. Option C is incorrect. SSH is a secure remote access protocol and does not provide granular command-level permission control. Therefore, D, SUDO, is the correct answer.
Play from 16:49 Question 10. Which of the following hardware devices prevents broadcasts from crossing over subnets? Here are the options. Option A. Bridge. Option B. Hub. Option C. Router. Option D. Modem. Pause the video now if you want time to think about the answer.
The correct answer is C. Router. A router operates at Layer 3 (Network layer) and prevents broadcast traffic from crossing subnet boundaries by not forwarding broadcast frames between different subnets, effectively isolating broadcast domains. Now, why are the other options incorrect? Option A is incorrect. A bridge operates at Layer 2 and forwards broadcasts within the same network segment, not preventing them from crossing subnets. Option B is incorrect. A hub is a Layer 1 device that simply repeats signals and does not filter or block any traffic, including broadcasts. Option D is incorrect. A modem is used for connecting to ISPs and does not control broadcast traffic between subnets. Therefore, C, Router, is the correct answer.
Play from 18:12 Question 11. What is the most secure way to address an unused Windows service so it cannot be exploited by malware? Here are the options. Option A. Firewall it. Option B. Set to manual startup. Option C. Disable it. Option D. Uninstall it. Pause the video now if you want time to think about the answer.
The correct answer is D. Uninstall it. Uninstalling an unused service is the most secure approach because it removes the service entirely from the system, eliminating any possibility of exploitation. While disabling a service prevents it from running, the code remains on the system. Uninstallation removes the attack surface completely, making it the strongest security posture for services that are not needed. Now, why are the other options incorrect? Option A is incorrect. Firewalling a service does not prevent local exploitation and does not address the core vulnerability of having unnecessary code present. Option B is incorrect. Setting a service to manual startup still leaves it installed and potentially exploitable if an attacker manually starts it. Option C is incorrect. Disabling a service prevents it from running but the code remains on the system and could potentially be exploited or re-enabled by malware. Therefore, D, Uninstall it, is the correct answer.
Play from 19:52 Question 12. Which of the following processes is known as sanitization? Here are the options. Option A. Assessing the risk involved in discarding particular information. Option B. Verifying the identity of a person, network host, or system process. Option C. Physically destroying the media and the information stored on it. Option D. Removing the content from the media so that it is difficult to restore. Pause the video now if you want time to think about the answer.
The correct answer is D. Removing the content from the media so that it is difficult to restore. Sanitization is the process of removing or obscuring data from media so that it is extremely difficult or impossible to recover or restore the information, ensuring data cannot be easily retrieved. Now, why are the other options incorrect? Option A is incorrect. Assessing risk involved in discarding information is a risk assessment process, not sanitization. Option B is incorrect. Verifying identity is authentication, not sanitization. Option C is incorrect. Physically destroying media is destruction or degaussing, which is more extreme than sanitization; sanitization allows reuse of media while removing data. Therefore, D, Removing the content from the media so that it is difficult to restore, is the correct answer.
Play from 21:33 Question 13. Which of the following tools is used to configure, control, and query the TCP/IP network interface parameters? Here are the options. Option A. NSLOOKUP. Option B. IPCONFIG. Option C. ARP. Option D. IFCONFIG. Pause the video now if you want time to think about the answer.
The correct answer is D. IFCONFIG. IFCONFIG is the command-line tool used on Unix and Linux systems to configure, control, and query TCP/IP network interface parameters such as IP addresses, subnet masks, and gateway settings. It provides comprehensive network interface management capabilities for viewing and modifying network configuration. Now, why are the other options incorrect? Option A is incorrect. NSLOOKUP is a DNS query tool used to resolve domain names to IP addresses, not for configuring network interfaces. Option B is incorrect. IPCONFIG is the Windows equivalent of IFCONFIG and configures TCP/IP parameters on Windows systems, but the question asks for the tool generally used across systems. Option C is incorrect. ARP is the Address Resolution Protocol tool used to map IP addresses to MAC addresses, not for configuring network interface parameters. Therefore, D, IFCONFIG, is the correct answer.
Play from 23:15 Question 14. What is the name of the command-line tool for Windows that can be used to manage audit policies on remote systems? Here are the options. Option A. SECEDTT.EXE. Option B. POLCLI.EXE. Option C. REMOTEAUDIT.EXE. Option D. AUDITPOL.EXE. Pause the video now if you want time to think about the answer.
The correct answer is D. AUDITPOL.EXE. AUDITPOL.EXE is the correct command-line tool for managing audit policies on Windows systems, including remote systems. It allows administrators to configure, query, and modify audit policies at both the local and group policy levels. Now, why are the other options incorrect? Option A is incorrect. SECEDTT.EXE is a tool for editing security templates, not for managing audit policies. Option B is incorrect. POLCLI.EXE is not a standard Windows tool for audit policy management. Option C is incorrect. REMOTEAUDIT.EXE is not a real Windows command-line tool for audit management. Therefore, D, AUDITPOL.EXE, is the correct answer.
Play from 24:48 Question 15. How is a Distributed Denial of Service (DDOS) attack distinguished from a regular DOS attack? Here are the options. Option A. DDOS attacks are perpetrated by many distributed hosts. Option B. DDOS affects many distributed targets. Option C. Regular DOS focuses on a single router. Option D. DDOS affects the entire Internet. Pause the video now if you want time to think about the answer.
The correct answer is A. DDOS attacks are perpetrated by many distributed hosts. A Distributed Denial of Service (DDoS) attack is distinguished from a regular DOS attack by the source of the attack traffic. DDoS attacks originate from multiple distributed hosts or systems (often a botnet), whereas a standard DOS attack typically comes from a single source. This distributed nature makes DDoS attacks significantly harder to mitigate. Now, why are the other options incorrect? Option B is incorrect. DDoS attacks target a single victim system, not multiple distributed targets. Option C is incorrect. Regular DOS attacks can target any network device, not just routers. Option D is incorrect. DDoS attacks do not affect the entire Internet; they target specific victim systems or networks. Therefore, A, DDOS attacks are perpetrated by many distributed hosts, is the correct answer.
Play from 26:36 Question 16. Which layer of the TCP/IP Protocol Stack Is responsible for port numbers? Here are the options. Option A. Network. Option B. Transport. Option C. Internet. Option D. Application. Pause the video now if you want time to think about the answer.
The correct answer is B. Transport. Port numbers are managed at the Transport Layer of the TCP/IP stack. This layer includes protocols like TCP and UDP, which use port numbers to identify specific services and applications on a host. Ports enable multiplexing of multiple applications over the same network connection. Now, why are the other options incorrect? Option A is incorrect. The Network Layer (IP) handles routing and logical addressing, not port numbers. Option C is incorrect. The Internet Layer is synonymous with the Network Layer and does not manage port numbers. Option D is incorrect. The Application Layer uses ports but does not manage them; port management is a Transport Layer function. Therefore, B, Transport, is the correct answer.
Play from 27:59 Question 17. There are three key factors in selecting a biometric mechanism. What are they? Here are the options. Option A. Reliability, encryption strength, and cost. Option B. Encryption strength, authorization method, and cost. Option C. Reliability, user acceptance, and cost. Option D. User acceptance, encryption strength, and cost. Pause the video now if you want time to think about the answer.
The correct answer is C. Reliability, user acceptance, and cost. The three key factors in selecting a biometric mechanism are reliability (false acceptance and rejection rates), user acceptance (willingness to use the system), and cost (implementation and operational expenses). These factors balance the technical performance, practical usability, and financial viability of any biometric authentication system. Encryption strength is not a primary selection factor for biometrics since the strength of biometric systems depends on the accuracy of the matching algorithm, not cryptographic encryption. Now, why are the other options incorrect? Option A is incorrect. Encryption strength is not a primary biometric selection factor; reliability, acceptance, and cost are the key considerations. Option B is incorrect. Encryption strength and authorization method are not among the three key biometric selection factors. Option D is incorrect. Encryption strength is not a relevant selection factor for biometric mechanisms; the correct factors are reliability, user acceptance, and cost. Therefore, C, Reliability, user acceptance, and cost, is the correct answer.
Play from 29:59 Question 18. You work as a Network Administrator for McNeil Inc. The company has a Linux-based network. David, a Sales Manager, wants to know the name of the shell that he is currently using. Which of the following commands will he use to accomplish the task? Here are the options. Option A. mv $shell. Option B. echo $shell. Option C. rm $shell. Option D. ls $shell. Pause the video now if you want time to think about the answer.
The correct answer is B. echo $shell. The echo command prints the value of environment variables. The $SHELL variable contains the name of the current shell. Using 'echo $SHELL' will display the shell being used. The mv command moves files, rm removes files, and ls lists directory contents, none of these would display the current shell name. Now, why are the other options incorrect? Option A is incorrect. mv is used to move or rename files, not to display shell information. Option C is incorrect. rm is used to delete files, not to display shell information. Option D is incorrect. ls is used to list directory contents, not to display shell information. Therefore, B, echo $shell, is the correct answer.
Play from 31:38 Question 19. Which type of risk assessment results are typically categorized as low, medium, or high- risk events? Here are the options. Option A. Technical. Option B. Qualitative. Option C. Management. Option D. Quantitative. Pause the video now if you want time to think about the answer.
The correct answer is B. Qualitative. Qualitative risk assessments categorize results using descriptive labels like low, medium, and high to represent relative risk levels. This approach focuses on the nature and characteristics of risks rather than numerical calculations. Technical assessments focus on system vulnerabilities, management assessments address organizational processes, and quantitative assessments use numerical data and probabilities, none of these produce the low/medium/high categorization as their primary output format. Now, why are the other options incorrect? Option A is incorrect. Technical risk assessments focus on identifying system and network vulnerabilities, not categorical risk ratings. Option C is incorrect. Management risk assessments address organizational and governance risks, not the categorical classification system described. Option D is incorrect. Quantitative risk assessments produce numerical values and probability calculations, not the low/medium/high categorical labels. Therefore, B, Qualitative, is the correct answer.
Play from 33:24 Question 20. What is the discipline of establishing a known baseline and managing that condition known as? Here are the options. Option A. Condition deployment. Option B. Observation discipline. Option C. Security establishment. Option D. Configuration management. Pause the video now if you want time to think about the answer.
The correct answer is D. Configuration management. Configuration Management is the established discipline of establishing a known baseline configuration for systems and maintaining control over changes to that baseline. This encompasses documentation, change control, and the ongoing management of system states to ensure consistency and security. The other options do not represent recognized IT management disciplines with this specific definition. Now, why are the other options incorrect? Option A is incorrect. Condition deployment is not a recognized IT discipline or standard practice terminology. Option B is incorrect. Observation discipline is not a formal IT management or security discipline. Option C is incorrect. Security establishment describes initial security setup, not the ongoing baseline management and change control process. Therefore, D, Configuration management, is the correct answer.
Play from 35:01 Question 21. Which of the following files contains the shadowed password entries in Linux? Here are the options. Option A. /etc/passwd. Option B. /etc/shadow. Option C. /etc/profile. Option D. /etc/shdpwd. Pause the video now if you want time to think about the answer.
The correct answer is B. /etc/shadow. The /etc/shadow file contains encrypted password hashes and shadow password entries in Linux systems. This file has restricted permissions (readable only by root) to protect password hashes from unauthorized access. The /etc/passwd file contains user account information but not actual password hashes (in modern systems). The /etc/profile file contains shell configuration settings, and /etc/shdpwd is not a standard Linux file. Now, why are the other options incorrect? Option A is incorrect. /etc/passwd contains user information but not actual password hashes. Option C is incorrect. /etc/profile contains shell environment configuration, not password entries. Option D is incorrect. /etc/shdpwd is not a standard Linux password file. Therefore, B, /etc/shadow, is the correct answer.
Play from 36:44 Question 22. You work as a Network Administrator for NetTech Inc. The company wants to encrypt its e-mails. Which of the following will you use to accomplish this? Here are the options. Option A. PPTP. Option B. IPSec. Option C. PGP. Option D. NTFS. Pause the video now if you want time to think about the answer.
The correct answer is C. PGP. PGP (Pretty Good Privacy) is specifically designed for encrypting and digitally signing email messages, making it the appropriate choice for secure email communication. It provides end-to-end encryption and authentication for email content. Now, why are the other options incorrect? Option A is incorrect. PPTP is a VPN protocol for network tunneling, not email encryption Option B is incorrect. IPSec operates at the network layer for VPN and network security, not for email encryption Option D is incorrect. NTFS is a file system, not an email encryption solution Therefore, C, PGP, is the correct answer.
Play from 38:12 Question 23. Which of the following ports is the default port for Layer 2 Tunneling Protocol (L2TP)? Here are the options. Option A. TCP port 443. Option B. UDP port 161. Option C. TCP port 110. Option D. UDP port 1701. Pause the video now if you want time to think about the answer.
The correct answer is D. UDP port 1701. L2TP (Layer 2 Tunneling Protocol) uses UDP port 1701 as its default port. TCP 443 is for HTTPS, UDP 161 is for SNMP, and TCP 110 is for POP3, none of these are the L2TP default port. Now, why are the other options incorrect? Option A is incorrect. TCP port 443 is the default port for HTTPS, not L2TP. Option B is incorrect. UDP port 161 is the default port for SNMP, not L2TP. Option C is incorrect. TCP port 110 is the default port for POP3 email, not L2TP. Therefore, D, UDP port 1701, is the correct answer.
Play from 39:51 Question 24. Which of the following applications would be BEST implemented with UDP instead of TCP? Here are the options. Option A. A multicast streaming application. Option B. A web browser. Option C. A DNS zone transfer. Option D. A file transfer application. Pause the video now if you want time to think about the answer.
The correct answer is A. A multicast streaming application. Multicast streaming applications are best implemented with UDP because UDP supports multicast transmission, is connectionless, and has lower overhead, ideal for real-time streaming where some packet loss is acceptable. TCP does not support multicast and requires connection establishment. Web browsers (B) require reliable delivery via TCP. DNS zone transfers (C) use TCP for reliability. File transfers (D) require TCP to ensure all data arrives intact. Now, why are the other options incorrect? Option B is incorrect. Web browsers require TCP's reliable, in-order delivery and connection management. Option C is incorrect. DNS zone transfers require TCP to guarantee complete and accurate data transfer. Option D is incorrect. File transfer applications require TCP to ensure data integrity and complete file delivery. Therefore, A, A multicast streaming application, is the correct answer.
Play from 41:39 Question 25. Which of the following is an advantage of an Intrusion Detection System? Here are the options. Option A. It is a mature technology. Option B. It is the best network security. Option C. It never needs patching. Option D. It is a firewall replacement. Pause the video now if you want time to think about the answer.
The correct answer is A. It is a mature technology. IDS being a mature technology is a legitimate advantage, it has well-established implementations, proven detection methods, and extensive industry experience. Option B overstates its role (it's not the best solution alone). Option C is false (IDS requires patches). Option D is false (IDS complements but doesn't replace firewalls). Maturity brings reliability, vendor support, and widespread deployment experience. Now, why are the other options incorrect? Option B is incorrect. IDS alone is not the best network security; it must work with other tools like firewalls. Option C is incorrect. IDS definitely requires patching to address new threats and vulnerabilities. Option D is incorrect. IDS is a detection tool, not a replacement for firewalls which provide prevention. Therefore, A, It is a mature technology, is the correct answer.
Play from 43:20 Question 26. Which of the following areas of a network contains DNS servers and Web servers for Internet users? Here are the options. Option A. VPN. Option B. MMZ. Option C. VLAN. Option D. DMZ. Pause the video now if you want time to think about the answer.
The correct answer is D. DMZ. The DMZ (Demilitarized Zone) is a network segment that contains public-facing servers such as DNS servers and web servers that internet users need to access. The DMZ sits between the internal network and the internet, protecting internal systems while allowing controlled access to public services. Now, why are the other options incorrect? Option A is incorrect. VPN (Virtual Private Network) is used for secure remote access, not for hosting public-facing servers. Option B is incorrect. MMZ is not a standard network architecture term. Option C is incorrect. VLAN (Virtual Local Area Network) is a logical network segmentation tool, not specifically designed to host DNS and web servers for internet users. Therefore, D, DMZ, is the correct answer.
Play from 44:50 Question 27. Which of the following is required to be backed up on a domain controller to recover Active Directory? Here are the options. Option A. System state data. Option B. Operating System files. Option C. User's personal data. Option D. Installed third party application's folders. Pause the video now if you want time to think about the answer.
The correct answer is A. System state data. System state data contains the critical components needed to recover Active Directory on a domain controller, including the Active Directory database, SYSVOL, registry, boot files, and system files. This is the specific backup target required for AD recovery. Now, why are the other options incorrect? Option B is incorrect. Operating system files alone are insufficient; Active Directory-specific data must also be backed up Option C is incorrect. User personal data is not necessary for recovering Active Directory functionality Option D is incorrect. Third-party application folders are unrelated to Active Directory recovery Therefore, A, System state data, is the correct answer.
Play from 46:19 Question 28. Which of the following is a Layer 3 device that will typically drop directed broadcast traffic? Here are the options. Option A. Hubs. Option B. Bridges. Option C. Routers. Option D. Switches. Pause the video now if you want time to think about the answer.
The correct answer is C. Routers. Routers are Layer 3 devices that typically drop directed broadcast traffic by default. A directed broadcast (like 192.168.1.255 sent to a specific subnet) is forwarded by bridges and switches but is blocked by routers as a security measure to prevent broadcast storms and limit the scope of broadcast traffic across network boundaries. This is a standard router configuration to prevent certain types of denial-of-service attacks. Now, why are the other options incorrect? Option A is incorrect. Hubs are Layer 1 devices that flood all traffic to all ports; they do not filter broadcasts. Option B is incorrect. Bridges are Layer 2 devices that forward broadcast traffic within their domains. Option D is incorrect. Switches are Layer 2 devices that forward broadcast traffic to all ports on a VLAN; they do not drop directed broadcasts. Therefore, C, Routers, is the correct answer.
Play from 47:58 Question 29. Which of the following statements best describes where a border router is normally placed? Here are the options. Option A. Between your firewall and your internal network. Option B. Between your firewall and DNS server. Option C. Between your ISP and DNS server. Option D. Between your ISP and your external firewall. Pause the video now if you want time to think about the answer.
The correct answer is D. Between your ISP and your external firewall. A border router is the first router encountered at the network perimeter, positioned between the ISP (Internet Service Provider) and the organization's external firewall. This placement allows the border router to handle initial traffic filtering, routing decisions, and serve as the demarcation point between the external internet and the organization's network infrastructure. Now, why are the other options incorrect? Option A is incorrect. The border router is external to the firewall, not between the firewall and internal network. Option B is incorrect. DNS servers are internal resources; the border router's role is at the ISP boundary, not related to DNS placement. Option C is incorrect. The border router's primary function is not to sit between ISP and DNS; it sits between ISP and the firewall. Therefore, D, Between your ISP and your external firewall, is the correct answer.
Play from 49:45 Question 30. During which of the following steps is the public/private key-pair generated for Public Key Infrastructure (PKI)? Here are the options. Option A. Key Recovery. Option B. Initialization. Option C. Registration. Option D. Certification. Pause the video now if you want time to think about the answer.
The correct answer is B. Initialization. During the Initialization phase of PKI, the public/private key-pair is generated for an entity. This is the first step in establishing a user's cryptographic identity before registration with a Certificate Authority. Now, why are the other options incorrect? Option A is incorrect. Key Recovery is a later phase used to restore compromised or lost keys, not to generate the initial key-pair. Option C is incorrect. Registration occurs after initialization, when the entity submits their public key and identity information to the CA. Option D is incorrect. Certification is when the CA issues a digital certificate binding the public key to the entity's identity. Therefore, B, Initialization, is the correct answer.
Play from 51:15 Question 31. Which of the following fields CANNOT be hashed by Authentication Header (AH) in transport mode? Here are the options. Option A. Length. Option B. Source IP. Option C. TTL. Option D. Destination IP. Pause the video now if you want time to think about the answer.
The correct answer is C. TTL. In IPsec AH transport mode, the TTL (Time To Live) field cannot be hashed because it changes during transit as packets hop through routers. Hashing a field that changes in transit would cause the integrity check to fail at the destination. The Length field (A), Source IP (B), and Destination IP (D) remain constant during transport and can be reliably hashed. Now, why are the other options incorrect? Option A is incorrect. Length field can be hashed as it remains constant during transport. Option B is incorrect. Source IP address can be hashed as it remains constant during transport. Option D is incorrect. Destination IP address can be hashed as it remains constant during transport. Therefore, C, TTL, is the correct answer.
Play from 52:45 Question 32. Which port category does the port 110 fall into? Here are the options. Option A. Well known port. Option B. Dynamic port. Option C. Private port. Option D. Application port. Pause the video now if you want time to think about the answer.
The correct answer is A. Well known port. Port 110 is the well-known port for POP3 (Post Office Protocol 3), used for retrieving email. Well-known ports range from 0 to 1023 and are officially assigned by IANA for specific services. Now, why are the other options incorrect? Option B is incorrect. Dynamic ports (49152-65535) are used for temporary client-side connections, not assigned to standard services like POP3. Option C is incorrect. Private ports (1024-49151) are for less standardized services and are below the dynamic port range. Option D is incorrect. Application port is not a formal port category defined in the standard port classification system. Therefore, A, Well known port, is the correct answer.
Play from 54:16 Question 33. How many bytes does it take to represent the hexadecimal value OxFEDCBA? Here are the options. Option A. 12. Option B. 2. Option C. 3. Option D. 6. Pause the video now if you want time to think about the answer.
The correct answer is C. 3. The hexadecimal value 0xFEDCBA contains 6 hexadecimal digits. Since each hexadecimal digit represents 4 bits, and 8 bits equal 1 byte, 6 hex digits equal 3 bytes (6 digits ÷ 2 = 3 bytes). The value breaks down as: FE (1 byte), DC (1 byte), BA (1 byte). Now, why are the other options incorrect? Option A is incorrect. 12 bytes would represent 24 hexadecimal digits, not 6. Option B is incorrect. 2 bytes would only represent 4 hexadecimal digits. Option D is incorrect. 6 bytes would represent 12 hexadecimal digits. Therefore, C, 3, is the correct answer.
Play from 55:40 Question 34. In order to capture traffic for analysis, Network Intrusion Detection Systems (NIDS) operate with network cards in what mode? Here are the options. Option A. Discrete. Option B. Reporting. Option C. Promiscuous. Option D. Alert. Pause the video now if you want time to think about the answer.
The correct answer is C. Promiscuous. Network Intrusion Detection Systems (NIDS) operate network interface cards in promiscuous mode, which allows the card to capture all traffic on the network segment regardless of whether the packets are addressed to that specific interface. This capability is essential for analyzing network traffic patterns and detecting intrusions. Now, why are the other options incorrect? Option A is incorrect. Discrete mode is not a standard network interface operating mode. Option B is incorrect. Reporting mode is not a recognized network interface mode for traffic capture. Option D is incorrect. Alert mode is not a network interface operational mode; it is a NIDS response state. Therefore, C, Promiscuous, is the correct answer.
Play from 57:06 Question 35. In a /24 subnet, which of the following is a valid broadcast address? Here are the options. Option A. 200.11.11.1. Option B. 221.10.10.10. Option C. 245.20.30.254. Option D. 192.10.10.255. Pause the video now if you want time to think about the answer.
The correct answer is D. 192.10.10.255. In a /24 subnet, the broadcast address is always the last address in the subnet (all host bits set to 1). For the subnet 192.10.10.0/24, the broadcast address is 192.10.10.255. This is the only option that ends in .255 and represents a valid broadcast address within a /24 network. Now, why are the other options incorrect? Option A is incorrect. 200.11.11.1 is a host address, not a broadcast address, and doesn't end in .255. Option B is incorrect. 221.10.10.10 is a host address within its subnet, not the broadcast address. Option C is incorrect. 245.20.30.254 is a host address, one below the broadcast, but not the broadcast address itself. Therefore, D, 192.10.10.255, is the correct answer.
Play from 58:57 Question 36. Which of the following is a private, RFC 1918 compliant IP address that would be assigned to a DHCP scope on a private LAN? Here are the options. Option A. 127.0.0.100. Option B. 169.254.1.50. Option C. 10.254.1.50. Option D. 172.35.1.100. Pause the video now if you want time to think about the answer.
The correct answer is C. 10.254.1.50. RFC 1918 defines three ranges of private IP addresses: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The address 10.254.1.50 falls within the 10.0.0.0/8 range and is a valid private address suitable for DHCP assignment on a private LAN. Now, why are the other options incorrect? Option A is incorrect. 127.0.0.100 is a loopback address, not a private RFC 1918 address. Option B is incorrect. 169.254.1.50 is in the link-local range (169.254.0.0/16), not an RFC 1918 private range. Option D is incorrect. 172.35.1.100 falls outside the RFC 1918 private range of 172.16.0.0/12; it is a public address. Therefore, C, 10.254.1.50, is the correct answer.
Play from 1:01:07 Question 37. Which of the following is used to allow or deny access to network resources? Here are the options. Option A. Spoofing. Option B. ACL. Option C. System hardening. Option D. NFS. Pause the video now if you want time to think about the answer.
The correct answer is B. ACL. ACL (Access Control List) is used to allow or deny access to network resources. ACLs define which users, groups, or systems have permissions to access specific resources and what actions they can perform on those resources. Now, why are the other options incorrect? Option A is incorrect. Spoofing is a security attack where an attacker impersonates another entity; it does not control access to resources. Option C is incorrect. System hardening involves securing a system against attacks through configuration and patch management, not specifically allowing or denying access to network resources. Option D is incorrect. NFS (Network File System) is a protocol for sharing files across networks, not a mechanism for controlling access permissions. Therefore, B, ACL, is the correct answer.
Play from 1:02:36 Question 38. You are an Intrusion Detection Analyst and the system has alerted you to an Event of Interest (EOI) that appears to be activity generated by a worm. You investigate and find that the network traffic was normal. How would this type of alert be categorized? Here are the options. Option A. False Positive. Option B. True Negative. Option C. True Positive. Option D. False Negative. Pause the video now if you want time to think about the answer.
The correct answer is A. False Positive. The system generated an alert about worm activity (positive alert), but upon investigation the network traffic was normal (no actual threat present). This is a False Positive, the IDS incorrectly flagged benign activity as malicious. False positives are common in security monitoring and occur when detection systems raise alarms without legitimate security incidents occurring. Now, why are the other options incorrect? Option B is incorrect. True Negative would mean no alert was raised and no threat existed; here an alert was raised. Option C is incorrect. True Positive would mean an alert was raised and an actual threat was confirmed; investigation showed no threat. Option D is incorrect. False Negative would mean no alert was raised but a threat actually existed; an alert was clearly raised here. Therefore, A, False Positive, is the correct answer.
Play from 1:04:23 Question 39. Which of the following monitors program activities and modifies malicious activities on a system? Here are the options. Option A. Back door. Option B. HIDS. Option C. NIDS. Option D. RADIUS. Pause the video now if you want time to think about the answer.
The correct answer is B. HIDS. HIDS (Host-based Intrusion Detection System) monitors program activities on individual systems and can detect and prevent malicious activities. A back door is a security vulnerability, NIDS is network-based (not host-based), and RADIUS is an authentication protocol, none of these monitor and modify malicious activities on a system. Now, why are the other options incorrect? Option A is incorrect. A back door is a security vulnerability that allows unauthorized access, not a monitoring system. Option C is incorrect. NIDS (Network Intrusion Detection System) monitors network traffic, not individual host program activities. Option D is incorrect. RADIUS is an authentication and authorization protocol, not a system activity monitoring tool. Therefore, B, HIDS, is the correct answer.
Play from 1:05:58 Question 40. Which of the following tools is used to query the DNS servers to get detailed information about IP addresses, MX records, and NS servers? Here are the options. Option A. NBTSTAT. Option B. NSLOOKUP. Option C. PING. Option D. NETSTAT. Pause the video now if you want time to think about the answer.
The correct answer is B. NSLOOKUP. NSLOOKUP is the standard DNS query tool used to retrieve detailed DNS information including A records, MX records, NS records, and other DNS data from DNS servers. It allows administrators to troubleshoot DNS issues and verify DNS configurations. Now, why are the other options incorrect? Option A is incorrect. NBTSTAT queries NetBIOS name resolution, not DNS servers Option C is incorrect. PING tests basic network connectivity but does not query DNS servers for detailed records Option D is incorrect. NETSTAT displays network connections and statistics, not DNS information Therefore, B, NSLOOKUP, is the correct answer.
Play from 1:07:23 Question 41. Which of the following protocols are used to provide secure communication between a client and a server over the Internet? Each correct answer represents a part of the solution. Choose two. Here are the options. Option A. SSL. Option B. HTTP. Option C. TLS. Option D. SNMP. Pause the video now if you want time to think about the answer.
The correct answers are A. SSL, and C. TLS. A. SSL C. TLS SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are the primary cryptographic protocols that provide secure, encrypted communication between clients and servers over the Internet, protecting data confidentiality and integrity. Now, why are the other options incorrect? Option B is incorrect. HTTP is an unsecured application layer protocol without encryption; HTTPS uses SSL/TLS for security. Option D is incorrect. SNMP is a network management protocol primarily for monitoring devices and does not provide secure client-server communication for general purposes. Therefore, A and C are the correct answers.
Play from 1:08:58 Question 42. Which of the following should be implemented to protect an organization from spam? Here are the options. Option A. Auditing. Option B. System hardening. Option C. E-mail filtering. Option D. Packet filtering. Pause the video now if you want time to think about the answer.
The correct answer is C. E-mail filtering. Email filtering is the primary and most effective mechanism to protect organizations from spam by screening incoming messages, identifying spam characteristics, and blocking or quarantining unwanted messages. Auditing monitors activity after the fact rather than preventing spam. System hardening protects against malware and vulnerabilities but does not specifically address spam. Packet filtering operates at the network level and is not designed to identify or filter spam messages based on content or characteristics. Now, why are the other options incorrect? Option A is incorrect. Auditing logs activity but does not prevent spam from arriving. Option B is incorrect. System hardening addresses vulnerability management, not spam prevention. Option D is incorrect. Packet filtering works at the network layer and cannot analyze email content for spam. Therefore, C, E-mail filtering, is the correct answer.
Play from 1:10:33 Question 43. Where is the source address located in an IPv4 header? Here are the options. Option A. At an offset of 20 bytes. Option B. At an offset of 8 bytes. Option C. At an offset of 16 bytes. Option D. At an offset of 12 bytes. Pause the video now if you want time to think about the answer.
The correct answer is D. At an offset of 12 bytes. In an IPv4 header, the source address field is located at offset 12 bytes from the start of the header. The header begins with version/IHL (0-1 bytes), ToS (1-2 bytes), total length (2-4 bytes), identification (4-6 bytes), flags/fragment offset (6-8 bytes), TTL (8-9 bytes), protocol (9-10 bytes), and checksum (10-12 bytes), placing the source address at the 12- byte offset. Now, why are the other options incorrect? Option A is incorrect. 20 bytes is the offset for the destination address, not the source address. Option B is incorrect. 8 bytes is too early in the header and falls within the flags/fragment offset field. Therefore, D, At an offset of 12 bytes, is the correct answer.
Play from 1:12:05 Question 44. Which access control mechanism requires a high amount of maintenance since all data must be classified, and all users granted appropriate clearance? Here are the options. Option A. Mandatory. Option B. Discretionary. Option C. Rule set-based. Option D. Role-Based. Pause the video now if you want time to think about the answer.
The correct answer is A. Mandatory. Mandatory Access Control (MAC) requires high maintenance because it relies on security labels and classifications applied to all data, and all users must be assigned appropriate security clearances. Every resource must be classified at a specific level, and every user must hold matching or higher clearance. This centralized, label-based system demands continuous administrative oversight to maintain proper classification and clearance alignment across the entire system. Now, why are the other options incorrect? Option B is incorrect. Discretionary Access Control (DAC) allows resource owners to set permissions, reducing central administrative burden. Option C is incorrect. Rule set-based access control uses predefined rules and typically requires less maintenance than MAC systems. Option D is incorrect. Role-Based Access Control (RBAC) simplifies management by assigning permissions to roles rather than individual classifications. Therefore, A, Mandatory, is the correct answer.
Play from 1:13:53 Question 45. In PKI, when someone wants to verify that the certificate is valid, what do they use to decrypt the signature? Here are the options. Option A. Receiver's digital signature. Option B. X.509 certificate CA's private key. Option C. Secret passphrase. Option D. CA's public key. Pause the video now if you want time to think about the answer.
The correct answer is D. CA's public key. To verify a digital signature on a certificate, the verifier uses the Certificate Authority's (CA's) public key to decrypt the signature. The CA signs certificates using its private key, and anyone can verify the signature using the corresponding public key, which is widely distributed. This asymmetric process ensures authenticity and non-repudiation of the certificate. Now, why are the other options incorrect? Option A is incorrect. The receiver's digital signature is not used to verify a CA's signature on a certificate. Option B is incorrect. The CA's private key is never shared and cannot be used by others to verify signatures; only the CA uses its private key to create signatures. Option C is incorrect. A secret passphrase is not used in PKI signature verification; public key cryptography is the mechanism. Therefore, D, CA's public key, is the correct answer.
Play from 1:15:35 Question 46. Which of the following is a valid password for a system with the default "Password must meet complexity requirements" setting enabled as part of the GPO Password policy requirements? Here are the options. Option A. The Cat Chased its Tail AII Night. Option B. disk ACCESS failed. Option C. SETI@HOME. Option D. SaNS2006. Pause the video now if you want time to think about the answer.
The correct answer is D. SaNS2006. Windows default password complexity requires at least three of four character types: uppercase letters, lowercase letters, numbers, and special characters. Option D (SaNS2006) contains uppercase (S, N), lowercase (a, n, S), and numbers (2, 0, 0, 6), meeting the three-character-type minimum. Option A lacks numbers and special characters. Option B lacks uppercase letters and special characters. Option C has only uppercase letters and special characters but no lowercase letters. Now, why are the other options incorrect? Option A is incorrect. Lacks both numeric and special characters, only has uppercase and lowercase letters. Option B is incorrect. Lacks uppercase letters and special characters, only has lowercase and numerics. Option C is incorrect. Lacks lowercase letters, only has uppercase letters and special character (@). Therefore, D, SaNS2006, is the correct answer.
Play from 1:17:30 Question 47. Which of the following applications cannot proactively detect anomalies related to a computer? Here are the options. Option A. Firewall installed on the computer. Option B. NIDS. Option C. HIDS. Option D. Anti-virus scanner. Pause the video now if you want time to think about the answer.
The correct answer is A. Firewall installed on the computer. A firewall installed on a computer cannot proactively detect anomalies related to the computer itself. Firewalls focus on controlling network traffic based on rules but lack the monitoring capabilities to detect system-level anomalies, behavioral changes, or suspicious process activity. Now, why are the other options incorrect? Option B is incorrect. NIDS (Network-based Intrusion Detection System) can detect network anomalies such as unusual traffic patterns, port scans, and attack signatures. Option C is incorrect. HIDS (Host-based Intrusion Detection System) specifically monitors host anomalies including process behavior, file modifications, and system calls. Option D is incorrect. Anti-virus scanners proactively detect anomalies by scanning files and memory for malware signatures and suspicious code patterns. Therefore, A, Firewall installed on the computer, is the correct answer.
Play from 1:19:12 Question 48. When no anomaly is present in an Intrusion Detection, but an alarm is generated, the response is known as. Here are the options. Option A. False negative. Option B. False positive. Option C. True positive. Option D. True negative. Pause the video now if you want time to think about the answer.
The correct answer is B. False positive. A false positive occurs in intrusion detection when an alarm is generated when no actual intrusion or anomaly is present. This is a common challenge in IDS systems where legitimate traffic patterns may trigger false alarms. Now, why are the other options incorrect? Option A is incorrect. False negative is when an intrusion occurs but no alarm is generated Option C is incorrect. True positive is when an alarm is generated and an actual intrusion is present Option D is incorrect. True negative is when no alarm is generated and no intrusion is present Therefore, B, False positive, is the correct answer.
Play from 1:20:34 Question 49. Which of the following works at the network layer and hides the local area network IP address and topology? Here are the options. Option A. Network address translation (NAT). Option B. Hub. Option C. MAC address. Option D. Network interface card (NIC). Pause the video now if you want time to think about the answer.
The correct answer is A. Network address translation (NAT). Network Address Translation (NAT) operates at the network layer (Layer 3) and hides internal LAN IP addresses and network topology by translating private IP addresses to public IP addresses at the router boundary. This provides both functional address translation and a degree of network obscurity. A hub operates at Layer 1, a MAC address is a Layer 2 identifier that does not hide topology, and a NIC is a hardware component, none of these hide internal IP addresses and topology as NAT does. Now, why are the other options incorrect? Option B is incorrect. A hub is a Layer 1 device that does not translate addresses or hide topology. Option C is incorrect. MAC addresses operate at Layer 2 and do not hide network topology. Option D is incorrect. A NIC is hardware; it does not perform address translation or topology hiding. Therefore, A, Network address translation (NAT), is the correct answer.
Play from 1:22:17 Question 50. Validating which vulnerabilities in a network environment are able to be exploited by an attacker is called what? Here are the options. Option A. Anomaly detection. Option B. Vulnerability scanning. Option C. Perimeter assessment. Option D. Penetration testing. Pause the video now if you want time to think about the answer.
The correct answer is D. Penetration testing. Penetration testing actively attempts to exploit vulnerabilities to determine which ones are actually exploitable in the network environment. Vulnerability scanning identifies potential vulnerabilities but does not confirm exploitability; penetration testing goes further by validating which vulnerabilities can realistically be leveraged by attackers, providing a practical assessment of actual risk. Now, why are the other options incorrect? Option A is incorrect. Anomaly detection identifies unusual network behavior, not which vulnerabilities are exploitable. Option B is incorrect. Vulnerability scanning identifies weaknesses but does not validate whether they are actually exploitable. Option C is incorrect. Perimeter assessment is a general term for boundary review; it does not specifically validate exploitability of vulnerabilities. Therefore, D, Penetration testing, is the correct answer.
Play from 1:23:57 Question 51. Which Host-based IDS (HIDS) method of log monitoring utilizes a list of keywords or phrases that define the events of interest for the analyst, then takes a list of keywords to watch for and generates alerts when it sees matches in log file activity? Here are the options. Option A. Passive analysis. Option B. Retroactive analysis. Option C. Exclusive analysis. Option D. Inclusive analysis. Pause the video now if you want time to think about the answer.
The correct answer is D. Inclusive analysis. Inclusive analysis in HIDS log monitoring uses a predefined list of keywords or phrases that define events of interest, and generates alerts when matches are found in log activity. This whitelist approach alerts on defined relevant events. The term 'inclusive' refers to including only those events that match the specified criteria. Now, why are the other options incorrect? Option A is incorrect. Passive analysis typically involves monitoring without active intervention, not keyword matching. Option B is incorrect. Retroactive analysis involves examining logs after the fact, not matching keywords in real-time. Option C is incorrect. Exclusive analysis would focus on excluding certain events, which is the opposite of the inclusive keyword-matching approach described. Therefore, D, Inclusive analysis, is the correct answer.
Play from 1:25:45 Question 52. When a packet leaving the network undergoes Network Address Translation (NAT), which of the following is changed? Here are the options. Option A. TCP Sequence Number. Option B. Source address. Option C. Destination port. Option D. Destination address. Pause the video now if you want time to think about the answer.
The correct answer is B. Source address. Network Address Translation (NAT) changes the source address of packets leaving the network, translating private internal addresses to public routable addresses. This is the fundamental function of NAT, rewriting the source IP address to enable communication between private and public networks. Now, why are the other options incorrect? Option A is incorrect. TCP sequence numbers are not modified during standard NAT operations. Option C is incorrect. Destination ports are typically not changed by basic NAT (port translation is a separate feature). Option D is incorrect. Destination addresses remain unchanged; NAT modifies the source address. Therefore, B, Source address, is the correct answer.
Play from 1:27:08 Question 53. Which common firewall feature can be utilized to generate a forensic trail of evidence and to identify attack trends against your network? Here are the options. Option A. NAT. Option B. State Table. Option C. Logging. Option D. Content filtering. Pause the video now if you want time to think about the answer.
The correct answer is C. Logging. Logging is the firewall feature that records network traffic and security events, creating a forensic trail of evidence that can be analyzed to identify attack patterns and trends. Logs capture detailed information about connections, blocked traffic, and suspicious activities that are essential for forensic analysis and trend identification. Now, why are the other options incorrect? Option A is incorrect. NAT translates addresses but does not inherently generate forensic evidence trails. Option B is incorrect. State tables track active connections but are not primarily designed for forensic analysis or trend identification. Option D is incorrect. Content filtering blocks certain content but does not create the detailed forensic trail needed for evidence and trend analysis. Therefore, C, Logging, is the correct answer.
Play from 1:28:41 Question 54. Which class of IDS events occur when the IDS fails to alert on malicious data? Here are the options. Option A. True Negative. Option B. True Positive. Option C. False Positive. Option D. False Negative. Pause the video now if you want time to think about the answer.
The correct answer is D. False Negative. A False Negative occurs when the IDS fails to detect and alert on malicious data that is actually present. This is the most critical failure mode of an IDS because malicious traffic passes through undetected. True positives correctly identify attacks, true negatives correctly identify legitimate traffic, and false positives incorrectly flag legitimate traffic as malicious. Now, why are the other options incorrect? Option A is incorrect. True Negative refers to correctly identifying legitimate (non-malicious) traffic and not alerting. Option B is incorrect. True Positive refers to correctly detecting actual malicious data and alerting appropriately. Option C is incorrect. False Positive refers to incorrectly alerting on legitimate traffic as if it were malicious. Therefore, D, False Negative, is the correct answer.
Play from 1:30:08 Question 55. If the NET_ID of the source and destination address in an IP (Internet Protocol) packet match, which answer BEST describes the routing method the sending host will use? Here are the options. Option A. Local (or direct) routing. Option B. Circuit switch routing. Option C. Dynamic (or changeable) routing. Option D. Remote (or indirect) routing. Pause the video now if you want time to think about the answer.
The correct answer is A. Local (or direct) routing. When the NET_ID (network portion) of the source and destination IP addresses match, both hosts are on the same local network segment. The sending host will use local or direct routing, delivering the packet directly to the destination without requiring a router. Now, why are the other options incorrect? Option B is incorrect. Circuit switching is a telephone network concept unrelated to IP packet routing. Option C is incorrect. Dynamic routing refers to routing protocol adaptation, not the method used when addresses share the same network. Option D is incorrect. Remote routing is used when NET_IDs differ, requiring an intermediary router. Therefore, A, Local (or direct) routing, is the correct answer.
Play from 1:31:43 Question 56. Which of the following protocols implements VPN using IPSec? Here are the options. Option A. SLIP. Option B. PPP. Option C. L2TP. Option D. PPTP. Pause the video now if you want time to think about the answer.
The correct answer is C. L2TP. L2TP (Layer 2 Tunneling Protocol) is specifically designed to implement VPN connections using IPSec for encryption and authentication, making it the protocol that combines tunneling with IPSec security. Now, why are the other options incorrect? Option A is incorrect. SLIP (Serial Line Internet Protocol) is an older point-to-point protocol without built-in security features and does not use IPSec. Option B is incorrect. PPP (Point-to-Point Protocol) is a basic link layer protocol that can be used with IPSec but does not inherently implement VPN with IPSec. Option D is incorrect. PPTP (Point-to-Point Tunneling Protocol) uses its own encryption method, not IPSec, for VPN implementation. Therefore, C, L2TP, is the correct answer.
Play from 1:33:18 Question 57. Which of the following commands is used to change file access permissions in Linux? Here are the options. Option A. chgrp. Option B. chperm. Option C. chmod. Option D. chown. Pause the video now if you want time to think about the answer.
The correct answer is C. chmod. The chmod command is used to change file access permissions in Linux systems. It allows administrators to modify read, write, and execute permissions for users, groups, and others. chgrp changes group ownership, chown changes file ownership, and chperm is not a valid Linux command. Now, why are the other options incorrect? Option A is incorrect. chgrp is used to change the group ownership of a file, not file permissions. Option B is incorrect. chperm is not a valid Linux command. Option D is incorrect. chown is used to change the owner/user of a file, not file permissions. Therefore, C, chmod, is the correct answer.
Play from 1:34:36 Question 58. It is possible to sniff traffic from other hosts on a switched Ethernet network by impersonating which type of network device? Here are the options. Option A. Switch. Option B. Bridge. Option C. Hub. Option D. Router. Pause the video now if you want time to think about the answer.
The correct answer is A. Switch. By impersonating a switch (specifically through ARP spoofing and MAC flooding techniques or by acting as a rogue switch), an attacker can redirect traffic and sniff frames from other hosts on a switched network. This works because switches learn MAC addresses and can be manipulated to send traffic to the attacker's port. Now, why are the other options incorrect? Option B is incorrect. A bridge operates similarly to a switch; impersonating one doesn't provide the same sniffing advantage. Option C is incorrect. A hub already broadcasts to all ports, so impersonating it doesn't help an attacker gain additional sniffing capability. Option D is incorrect. A router operates at Layer 3 and doesn't directly control switched Ethernet frame delivery at Layer 2. Therefore, A, Switch, is the correct answer.
Play from 1:36:06 Question 59. Which of the following protocols allows an e-mail client to access and manipulate a remote e-mail file without downloading it to the local computer? Here are the options. Option A. IMAP. Option B. SNMP. Option C. POP3. Option D. SMTP. Pause the video now if you want time to think about the answer.
The correct answer is A. IMAP. IMAP (Internet Message Access Protocol) allows email clients to access and manipulate email on a remote server without downloading messages to the local computer. Users can read, organize, and manage emails while they remain stored on the server. Now, why are the other options incorrect? Option B is incorrect. SNMP (Simple Network Management Protocol) is used for network device management, not email access. Option C is incorrect. POP3 (Post Office Protocol 3) downloads email from the server to the local computer, rather than accessing it remotely without downloading. Option D is incorrect. SMTP (Simple Mail Transfer Protocol) is used for sending email, not for accessing or retrieving remote email. Therefore, A, IMAP, is the correct answer.
Play from 1:37:40 Question 60. Which of the following protocols provides maintenance and error reporting function? Here are the options. Option A. UDP. Option B. ICMP. Option C. PPP. Option D. IGMP. Pause the video now if you want time to think about the answer.
The correct answer is B. ICMP. ICMP (Internet Control Message Protocol) is specifically designed to provide network maintenance, diagnostics, and error reporting functions such as ping, traceroute, and unreachable destination notifications. Now, why are the other options incorrect? Option A is incorrect. UDP is a transport layer protocol for data transmission and does not provide maintenance or error reporting functions. Option C is incorrect. PPP is a point-to-point link layer protocol for establishing connections, not for network-wide maintenance and error reporting. Option D is incorrect. IGMP is used for multicast group management and does not provide general network maintenance and error reporting capabilities. Therefore, B, ICMP, is the correct answer.
Play from 1:39:07 Question 61. The TTL can be found in which protocol header? Here are the options. Option A. It is found in byte 8 of the ICMP header. Option B. It is found in byte 8 of the IP header. Option C. It is found in byte 8 of the TCP header. Option D. It is found in byte 8 of the DNS header. Pause the video now if you want time to think about the answer.
The correct answer is B. It is found in byte 8 of the IP header. The Time-To-Live (TTL) field is located in byte 8 of the IP header (IPv4). It is an 8-bit field that decreases by one at each hop and is used to prevent packets from circulating indefinitely in routing loops. Now, why are the other options incorrect? Option A is incorrect. ICMP messages are carried within IP packets; the TTL is in the enclosing IP header, not the ICMP header. Option C is incorrect. TCP operates at Layer 4 and does not contain a TTL field; that function belongs to the IP layer. Option D is incorrect. DNS operates over UDP or TCP at Layer 4; the TTL function exists at Layer 3 in the IP header. Therefore, B, It is found in byte 8 of the IP header, is the correct answer.
Play from 1:40:47 Question 62. You have implemented a firewall on the company's network for blocking unauthorized network connections. Which of the following types of security control is implemented in this case? Here are the options. Option A. Detective. Option B. Preventive. Option C. Directive. Option D. Corrective. Pause the video now if you want time to think about the answer.
The correct answer is B. Preventive. A firewall that blocks unauthorized network connections is a preventive control because it acts before an attack occurs to prevent unauthorized access. Preventive controls stop security incidents from happening, whereas detective controls identify incidents after they occur, directive controls guide behavior, and corrective controls remediate damage after an incident. Now, why are the other options incorrect? Option A is incorrect. Detective controls identify and alert on security issues after they happen, not prevent them. Option C is incorrect. Directive controls provide guidance and policies, not technical prevention mechanisms. Option D is incorrect. Corrective controls fix issues after they have already occurred. Therefore, B, Preventive, is the correct answer.
Play from 1:42:18 Question 63. When should you create the initial database for a Linux file integrity checker? Here are the options. Option A. Before a system is patched. Option B. After a system has been compromised. Option C. Before a system has been compromised. Option D. During an attack. Pause the video now if you want time to think about the answer.
The correct answer is C. Before a system has been compromised. A file integrity checker database must be created before a system is compromised to establish a clean baseline of file hashes and metadata. This baseline is then used to detect unauthorized changes by comparing current file states against the original baseline. Creating the database after compromise would capture malicious modifications as legitimate, rendering the tool ineffective for detecting the attack. Now, why are the other options incorrect? Option A is incorrect. Creating the baseline before patching could capture an insecure state; it should be created after hardening but before exposure to attack. Option B is incorrect. Creating a database after compromise defeats the purpose, as malicious changes would be included in the baseline. Option D is incorrect. Creating a database during an active attack is too late to establish a trustworthy baseline. Therefore, C, Before a system has been compromised, is the correct answer.
Play from 1:44:02 Question 64. IPS devices that are classified as "In-line NIDS" devices use a combination of anomaly analysis, signature-based rules, and what else to identify malicious events on the network? Here are the options. Option A. Firewall compatibility rules. Option B. Application analysis. Option C. ICMP and UDP active scanning. Option D. MAC address filtering. Pause the video now if you want time to think about the answer.
The correct answer is B. Application analysis. In-line NIDS/IPS devices use three primary detection methodologies: signature-based rules (matching known attack patterns), anomaly analysis (detecting deviations from normal behavior), and application analysis (understanding and inspecting application-layer protocols and behavior). Application analysis helps identify sophisticated attacks that operate at the application layer. Now, why are the other options incorrect? Option A is incorrect. Firewall compatibility rules are not a detection methodology used by IPS devices. Option C is incorrect. ICMP and UDP active scanning describes offensive reconnaissance techniques, not IPS detection methods. Option D is incorrect. MAC address filtering is a Layer 2 access control mechanism, not part of IPS malicious event detection. Therefore, B, Application analysis, is the correct answer.
Play from 1:45:53 Question 65. Which of the following protocols is used to send e-mails on the Internet? Here are the options. Option A. SMTP. Option B. IMAP4. Option C. POP3. Option D. HTTP. Pause the video now if you want time to think about the answer.
The correct answer is A. SMTP. SMTP (Simple Mail Transfer Protocol) is the standard protocol used to send emails across the Internet. It handles the transmission of messages from a client to a mail server or between mail servers. While IMAP4 and POP3 are used for receiving/retrieving emails and HTTP is a web protocol, SMTP is the designated protocol specifically for sending emails. Now, why are the other options incorrect? Option B is incorrect. IMAP4 is used for receiving and accessing emails on a mail server, not sending them. Option C is incorrect. POP3 is used for retrieving emails from a mail server, not sending them. Option D is incorrect. HTTP is a general web protocol used for transferring web pages and content, not the standard email transmission protocol. Therefore, A, SMTP, is the correct answer.
Play from 1:47:34 Question 66. Which Defense-in-Depth principle starts with an awareness of the value of each section of information within an organization? Here are the options. Option A. Information centric defense. Option B. Uniform information protection. Option C. General information protection. Option D. Perimeter layering. Pause the video now if you want time to think about the answer.
The correct answer is A. Information centric defense. Information-centric defense is a defense-in-depth approach that classifies and prioritizes information based on its value and sensitivity to the organization, then applies appropriate protection layers accordingly. This principle recognizes that not all information has equal value and requires customized protection strategies based on organizational assets. Now, why are the other options incorrect? Option B is incorrect. Uniform information protection applies the same security controls to all information regardless of value, which contradicts the value-awareness principle. Option C is incorrect. General information protection is not a recognized defense-in-depth principle and is too vague. Option D is incorrect. Perimeter layering focuses on network boundary protection, not on classification based on information value. Therefore, A, Information centric defense, is the correct answer.
Play from 1:49:14 Question 67. Which of the following terms is used for the process of securing a system or a device on a network infrastructure? Here are the options. Option A. Hardening. Option B. Authentication. Option C. Cryptography. Option D. Sanitization. Pause the video now if you want time to think about the answer.
The correct answer is A. Hardening. Hardening is the term used for the process of securing a system or device by reducing its vulnerability surface through configuration changes, updates, and security controls. Authentication is identity verification, cryptography is encryption, and sanitization is data destruction, none of these describe the overall process of securing a system's infrastructure. Now, why are the other options incorrect? Option B is incorrect. Authentication is the process of verifying identity, not the overall process of securing a system. Option C is incorrect. Cryptography involves encryption and decryption, not the comprehensive security process. Option D is incorrect. Sanitization refers to secure data destruction, not the overall securing of a system infrastructure. Therefore, A, Hardening, is the correct answer.
Play from 1:50:46 Question 68. When a host on a remote network performs a DNS lookup of www.google.com, which of the following is likely to provide an Authoritative reply? Here are the options. Option A. The local DNS server. Option B. The top-level DNS server for .com. Option C. The DNS server for google.com. Option D. The root DNS server. Pause the video now if you want time to think about the answer.
The correct answer is C. The DNS server for google.com. An authoritative DNS reply comes from the authoritative nameserver for the domain in question. For www.google.com, the authoritative reply would come from Google's own DNS server (or servers designated by Google), which contains the actual resource records for that domain. While a local DNS server may cache and return the answer, it would be a cached (non-authoritative) response. Now, why are the other options incorrect? Option A is incorrect. A local DNS server provides a cached, non-authoritative response, not an authoritative one. Option B is incorrect. Top-level domain servers direct queries to authoritative servers but do not provide the authoritative answer themselves. Option D is incorrect. Root DNS servers direct queries further down the hierarchy; they do not provide authoritative answers for specific domains. Therefore, C, The DNS server for google.com, is the correct answer.
Play from 1:52:36 Question 69. An IT security manager is trying to quickly assess the risks associated with not implementing a corporate firewall system. What sort of risk assessment is most appropriate? Here are the options. Option A. Annualized Risk Assessment. Option B. Qualitative risk assessment. Option C. Quantitative risk assessment. Option D. Technical Risk Assessment. Option E. Iterative Risk Assessment. Pause the video now if you want time to think about the answer.
The correct answer is B. Qualitative risk assessment. When a manager needs to quickly assess risks without extensive data collection or calculations, qualitative risk assessment is most appropriate. Qualitative assessment uses descriptive categories (high/medium/low) and subjective judgment, allowing for rapid evaluation. Quantitative assessment requires detailed metrics and financial modeling, which is more time-consuming. Annualized, Technical, and Iterative are either too specific or not standard risk assessment methodologies. Now, why are the other options incorrect? Option A is incorrect. Annualized Risk Assessment requires detailed financial calculations and historical data, making it slower. Option C is incorrect. Quantitative risk assessment requires extensive metrics, calculations, and cost data, which is time-consuming. Option D is incorrect. Technical Risk Assessment is not a standard risk assessment classification. Option E is incorrect. Iterative Risk Assessment is not a standard risk assessment type in this context. Therefore, B, Qualitative risk assessment, is the correct answer.
Play from 1:54:38 Question 70. An organization monitors the hard disks of its employees' computers from time to time. Which policy does this pertain to? Here are the options. Option A. Privacy policy. Option B. Backup policy. Option C. User password policy. Option D. Network security policy. Pause the video now if you want time to think about the answer.
The correct answer is A. Privacy policy. Monitoring employee hard disks pertains to privacy policy, as it concerns what personal or professional data employees may store and how that data is monitored or accessed by the organization. Now, why are the other options incorrect? Option B is incorrect. Backup policy deals with procedures for backing up and recovering data, not monitoring hard disk contents. Option C is incorrect. User password policy governs password creation and management requirements, not hard disk monitoring. Option D is incorrect. Network security policy addresses network-level security measures rather than individual employee computer monitoring. Therefore, A, Privacy policy, is the correct answer.
Play from 1:56:03 Question 71. Why are false positives such a problem with IPS technology? Here are the options. Option A. File integrity is not guaranteed. Option B. Malicious code can get into the network. Option C. Legitimate services are not delivered. Option D. Rules are often misinterpreted. Pause the video now if you want time to think about the answer.
The correct answer is C. Legitimate services are not delivered. False positives in IPS systems cause legitimate network traffic and services to be blocked or terminated, resulting in denial of service to legitimate users and applications. This disrupts normal business operations. Now, why are the other options incorrect? Option A is incorrect. File integrity relates to file systems and data, not IPS false positive impacts. Option B is incorrect. False positives block legitimate traffic, not allow malicious code through. Option D is incorrect. While rule misinterpretation may cause false positives, the problem with false positives is the operational impact, not the cause. Therefore, C, Legitimate services are not delivered, is the correct answer.
Play from 1:57:33 Question 72. When you log into your Windows desktop what information does your Security Access Token (SAT) contain? Here are the options. Option A. The Security ID numbers (SIDs) of all the groups to which you belong. Option B. A list of cached authentications. Option C. A list of your domain privileges. Option D. The Security ID numbers (SIDs) of all authenticated local users. Pause the video now if you want time to think about the answer.
The correct answer is A. The Security ID numbers (SIDs) of all the groups to which you belong. A Security Access Token (SAT) contains the Security ID (SID) numbers of all groups to which the authenticated user belongs. This information is used throughout the Windows session to determine access rights and permissions for resources. Now, why are the other options incorrect? Option B is incorrect. Cached authentications are stored separately in credential caches, not in the SAT itself. Option C is incorrect. Domain privileges are determined by group memberships and policy, not directly stored in the SAT structure. Option D is incorrect. The SAT contains information about the authenticated user and their groups, not a list of all authenticated local users on the system. Therefore, A, The Security ID numbers (SIDs) of all the groups to which you belong, is the correct answer.
Play from 1:59:15 Question 73. Which of the following is a required component for successful 802.lx network authentication? Here are the options. Option A. Supplicant. Option B. 3rd-party Certificate Authority. Option C. Ticket Granting Server (TGS). Option D. IPSec. Pause the video now if you want time to think about the answer.
The correct answer is A. Supplicant. The Supplicant is a required component of 802.1X network authentication. It is the software or device (client) that authenticates to the network by requesting access and responding to authentication challenges from the authenticator (network switch or access point). Now, why are the other options incorrect? Option B is incorrect. While a Certificate Authority may be used in some 802.1X implementations, it is not a required component for all 802.1X deployments. Option C is incorrect. A Ticket Granting Server belongs to Kerberos authentication, not 802.1X. Option D is incorrect. IPSec is a network security protocol unrelated to the core components required for 802.1X authentication. Therefore, A, Supplicant, is the correct answer.
Play from 2:00:50 Question 74. Which of the following is a characteristic of hash operations? Here are the options. Option A. Asymmetric. Option B. Non-reversible. Option C. Symmetric. Option D. Variable length output. Pause the video now if you want time to think about the answer.
The correct answer is B. Non-reversible. The primary characteristic of hash operations is that they are non-reversible (one-way functions). Given a hash output, it is computationally infeasible to derive the original input. This property is fundamental to their use in security applications like password storage and data integrity verification. Now, why are the other options incorrect? Option A is incorrect. Hash functions are neither asymmetric nor symmetric, they are one-way functions distinct from both categories. Option C is incorrect. Hash operations are not symmetric; symmetric operations are reversible with a key, unlike hashing. Option D is incorrect. Hash functions produce fixed-length output regardless of input size, not variable length output. Therefore, B, Non-reversible, is the correct answer.
Play from 2:02:20 Question 75. Which of the following Unix syslog message priorities is the MOST severe? Here are the options. Option A. err. Option B. emerg. Option C. crit. Option D. alert. Pause the video now if you want time to think about the answer.
The correct answer is B. emerg. Unix syslog defines eight priority levels in decreasing severity: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), and debug (7). 'Emerg' is the most severe level, used for emergency conditions where the system is unusable. The other options represent progressively lower severity levels. Now, why are the other options incorrect? Option A is incorrect. err (3) is less severe than both emerg and alert. Option C is incorrect. crit (2) is less severe than both emerg and alert. Option D is incorrect. alert (1) is the second-most severe, less severe than emerg. Therefore, B, emerg, is the correct answer.
Play from 2:03:44 Question 76. Which of the following is a standard Unix command that would most likely be used to copy raw file system data for later forensic analysis? Here are the options. Option A. dd. Option B. backup. Option C. cp. Option D. gzip. Pause the video now if you want time to think about the answer.
The correct answer is A. dd. The `dd` command is the standard Unix utility for copying raw disk and file system data byte-by-byte, preserving all data including unallocated space, metadata, and deleted files. This makes it essential for forensic analysis where maintaining a bit-for-bit copy of the original media is critical. The `dd` command can create forensic images without interpreting the file system, which is exactly what forensic analysis requires. Now, why are the other options incorrect? Option B is incorrect. The `backup` command is not a standard Unix command for this purpose. Option C is incorrect. The `cp` command copies files at the file system level, missing unallocated space and not suitable for forensic imaging. Option D is incorrect. The `gzip` command is a compression utility, not designed for raw data acquisition or forensic imaging. Therefore, A, dd, is the correct answer.
Play from 2:05:16 Question 77. Which of the following is a type of countermeasure that can be deployed to ensure that a threat vector does not meet a vulnerability? Here are the options. Option A. Prevention controls. Option B. Detection controls. Option C. Monitoring controls. Option D. Subversive controls. Pause the video now if you want time to think about the answer.
The correct answer is A. Prevention controls. Prevention controls are countermeasures designed to stop threats from reaching vulnerabilities by blocking or eliminating the threat vector before it can exploit a weakness. Prevention controls proactively defend against attacks, representing the most direct approach to ensuring a threat vector cannot meet a vulnerability. Now, why are the other options incorrect? Option B is incorrect. Detection controls identify and alert on threats after they occur, but do not prevent threat vectors from reaching vulnerabilities. Option C is incorrect. Monitoring controls observe and record system activity but do not prevent threats from exploiting vulnerabilities. Option D is incorrect. Subversive controls is not a recognized standard security control category in established frameworks. Therefore, A, Prevention controls, is the correct answer.
Play from 2:06:54 Question 78. Which of the following Linux commands can change both the username and group name a file belongs to? Here are the options. Option A. chown. Option B. chgrp. Option C. chmod. Option D. newgrp. Pause the video now if you want time to think about the answer.
The correct answer is A. chown. The chown command can change both the owner (user) and group of a file in a single operation using the syntax 'chown user:group filename'. It is the only command that can modify both attributes simultaneously. Now, why are the other options incorrect? Option B is incorrect. chgrp only changes the group ownership, not the username. Option C is incorrect. chmod changes file permissions (read, write, execute), not ownership or group membership. Option D is incorrect. newgrp changes the user's current group in the login session but does not change file ownership. Therefore, A, chown, is the correct answer.
Play from 2:08:08 Question 79. Which of the following is an UDP based protocol? Here are the options. Option A. telnet. Option B. SNMP. Option C. IMAP. Option D. LDAP. Pause the video now if you want time to think about the answer.
The correct answer is B. SNMP. SNMP (Simple Network Management Protocol) operates over UDP port 161 for queries and port 162 for traps. SNMP was designed to use UDP because it provides lightweight, connectionless communication suitable for network monitoring without the overhead of TCP. Now, why are the other options incorrect? Option A is incorrect. Telnet uses TCP port 23 for establishing terminal sessions. Option C is incorrect. IMAP (Internet Message Access Protocol) uses TCP port 143 for secure email retrieval. Option D is incorrect. LDAP (Lightweight Directory Access Protocol) primarily uses TCP port 389, though it can also use TCP. Therefore, B, SNMP, is the correct answer.
Play from 2:09:40 Question 80. Which of the following systems acts as a NAT device when utilizing VMware in NAT mode? Here are the options. Option A. Guest system. Option B. Local gateway. Option C. Host system. Option D. Virtual system. Pause the video now if you want time to think about the answer.
The correct answer is C. Host system. In VMware NAT mode, the host system acts as the NAT device, translating network addresses between the guest virtual machines and the external network. The host system performs the address translation, allowing guest systems to communicate with external networks while appearing to use the host's address. Now, why are the other options incorrect? Option A is incorrect. Guest systems do not perform NAT; they are behind the NAT device. Option B is incorrect. Local gateway is not the component performing NAT in VMware NAT mode. Option D is incorrect. Virtual system is too vague; the host system specifically performs the NAT function. Therefore, C, Host system, is the correct answer.
Play from 2:11:05 Question 81. Which of the following protocols is used by a host that knows its own MAC (Media Access Control) address to query a server for its own IP address? Here are the options. Option A. RARP. Option B. ARP. Option C. DNS. Option D. RDNS. Pause the video now if you want time to think about the answer.
The correct answer is A. RARP. RARP (Reverse Address Resolution Protocol) is specifically designed for a host to discover its own IP address when it knows its MAC address. A host with a known MAC address sends a RARP request to obtain the corresponding IP address from a RARP server. Now, why are the other options incorrect? Option B is incorrect. ARP does the opposite, it resolves IP addresses to MAC addresses, not MAC to IP. Option C is incorrect. DNS resolves domain names to IP addresses, not MAC addresses to IP addresses. Option D is incorrect. RDNS (Reverse DNS) performs reverse lookups of IP addresses to domain names, not MAC to IP resolution. Therefore, A, RARP, is the correct answer.
Play from 2:12:40 Question 82. What would the following IP tables command do? IP tables -I INPUT -s 99.23.45.1/32 -j DROP Here are the options. Option A. Drop all packets from the source address. Option B. Input all packers to the source address. Option C. Log all packets to or from the specified address. Option D. Drop all packets to the specified address. Pause the video now if you want time to think about the answer.
The correct answer is A. Drop all packets from the source address. The command 'iptables -I INPUT -s 99.23.45.1/32 -j DROP' inserts (-I) a rule into the INPUT chain that matches packets from the source (-s) address 99.23.45.1 and applies the DROP action (-j DROP) to them. This drops all incoming packets originating from that specific source address. The /32 indicates a single host. Option B incorrectly describes the action as 'input,' option C mentions logging which isn't part of this command, and option D is incorrect because the rule targets source addresses, not destination addresses. Now, why are the other options incorrect? Option B is incorrect. The command drops packets; it does not input or forward them to the source address. Option C is incorrect. This command uses DROP action, not LOG; no logging occurs without explicit -j LOG specification. Option D is incorrect. The -s flag specifies source address filtering, not destination; packets are dropped based on origin. Therefore, A, Drop all packets from the source address, is the correct answer.
Play from 2:15:00 Question 83. When discussing access controls, which of the following terms describes the process of determining the activities or functions that an Individual is permitted to perform? Here are the options. Option A. Authentication. Option B. Identification. Option C. Authorization. Option D. Validation. Pause the video now if you want time to think about the answer.
The correct answer is C. Authorization. Authorization is the process of determining what actions, permissions, and functions an authenticated user or entity is allowed to perform. It answers the question 'what can this user do?' after they have been identified and authenticated. Now, why are the other options incorrect? Option A is incorrect. Authentication is the process of verifying identity (proving you are who you claim to be), not determining what activities are permitted. Option B is incorrect. Identification is simply claiming or stating an identity, not determining what permissions are granted. Option D is incorrect. Validation refers to confirming the correctness or integrity of data, not defining user permissions. Therefore, C, Authorization, is the correct answer.
Play from 2:16:29 Question 84. To be considered a strong algorithm, an encryption algorithm must be which of the following? Here are the options. Option A. Secret. Option B. Well-known. Option C. Confidential. Option D. Proprietary. Pause the video now if you want time to think about the answer.
The correct answer is B. Well-known. A strong encryption algorithm must be well-known and publicly scrutinized. The security of a strong algorithm relies on the strength of the key and the mathematics behind it, not on keeping the algorithm itself secret. Public algorithms undergo extensive peer review and cryptanalysis, which actually strengthens confidence in their security. Kerckhoffs's principle states that a cryptosystem should be secure even if everything about the system is public except the key. Now, why are the other options incorrect? Option A is incorrect. Keeping an algorithm secret (security through obscurity) is not a sign of strength; it often masks weaknesses. Option C is incorrect. Confidentiality of an algorithm does not contribute to its cryptographic strength; strong algorithms are openly published. Option D is incorrect. Proprietary algorithms are not necessarily strong; in fact, closed algorithms often lack the peer review necessary to identify weaknesses. Therefore, B, Well-known, is the correct answer.
Play from 2:18:09 Question 85. What would the file permission example "rwsr-sr-x" translate to in absolute mode? Here are the options. Option A. 1755. Option B. 6755. Option C. 6645. Option D. 1644. Pause the video now if you want time to think about the answer.
The correct answer is B. 6755. The symbolic permission string 'rwsr-sr-x' breaks down as follows: the first 's' in position 4 indicates setuid (4), the second 's' in position 7 indicates setgid (2), and the owner permissions are 'rws' (7), group permissions are 'sr' (5), and other permissions are 'r-x' (5). The special bits (setuid + setgid) total 6 (4+2), giving the octal notation 6755. Now, why are the other options incorrect? Option A is incorrect. 1755 would indicate a sticky bit (1) with wrong base permissions; there is no sticky bit in this string. Option C is incorrect. 6645 misrepresents the permissions; the group and other sections should be 5 and 5, not 4 and 5. Option D is incorrect. 1644 incorrectly assumes a sticky bit and wrong base permissions entirely. Therefore, B, 6755, is the correct answer.
Play from 2:19:51 Question 86. What type of malware is a self-contained program that has the ability to copy itself without parasitically infecting other host code? Here are the options. Option A. Trojans. Option B. Boot infectors. Option C. Viruses. Option D. Worms. Pause the video now if you want time to think about the answer.
The correct answer is D. Worms. A worm is a self-contained, self-replicating program that spreads independently without needing to parasitically attach to host code. Worms can propagate across networks and systems autonomously, unlike viruses which require a host program to execute. Trojans are deceptive programs that don't self-replicate, boot infectors attack the boot sector, and viruses require host code infection to propagate. Now, why are the other options incorrect? Option A is incorrect. Trojans are deceptive programs that do not have self-replication capability. Option B is incorrect. Boot infectors target boot sectors but are not self-contained or self-replicating in the typical sense. Option C is incorrect. Viruses require parasitic infection of host code to replicate, making them dependent on hosts unlike worms. Therefore, D, Worms, is the correct answer.
Play from 2:21:28 Question 87. What is the first thing that should be done during the containment step of incident handling? Here are the options. Option A. Change all the passwords. Option B. Secure the area. Option C. Prepare the Jump bag. Option D. Notify management. Option E. Prepare a report. Pause the video now if you want time to think about the answer.
The correct answer is B. Secure the area. During the containment phase of incident handling, securing the area is the foundational first step to prevent further compromise, preserve evidence, and control access. This must occur before other actions like password changes, which could alter evidence, or notifications that might alert the threat actor. Jump bag preparation is a pre-incident activity, and reporting occurs after investigation. Now, why are the other options incorrect? Option A is incorrect. Changing passwords could alter evidence and should not be done before securing the area and assessing the incident. Option C is incorrect. Preparing the jump bag is a pre-incident preparation activity, not part of active incident containment. Option D is incorrect. Management notification typically occurs after initial containment and assessment, not as the first containment action. Option E is incorrect. Reporting is completed after investigation and analysis, not during the initial containment phase. Therefore, B, Secure the area, is the correct answer.
Play from 2:23:13 Question 88. The process of enumerating all hosts on a network defines which of the following activities? Here are the options. Option A. Port scanning. Option B. Vulnerability scanning. Option C. GPS mapping. Option D. Network mapping. Pause the video now if you want time to think about the answer.
The correct answer is D. Network mapping. Network mapping is the process of discovering and identifying all hosts and devices connected to a network. Enumerating all hosts on a network is the core definition of network mapping. Now, why are the other options incorrect? Option A is incorrect. Port scanning identifies open ports on known systems, not the enumeration of all hosts on a network. Option B is incorrect. Vulnerability scanning assesses known hosts for weaknesses, rather than discovering which hosts exist. Option C is incorrect. GPS mapping is geographic location mapping unrelated to network administration. Therefore, D, Network mapping, is the correct answer.
Play from 2:24:32 Question 89. When are Group Policy Objects (GPOs) NOT applied automatically to workstations? Here are the options. Option A. At 90-minute intervals. Option B. At logon. Option C. Every time Windows Explorer is launched. Option D. At boot-up. Pause the video now if you want time to think about the answer.
The correct answer is C. Every time Windows Explorer is launched. Group Policy Objects are automatically applied at logon (B), at boot-up (D), and at periodic intervals of 90 minutes (A) for refreshing policies. However, GPOs are NOT automatically applied every time Windows Explorer is launched. Windows Explorer is a file manager utility and does not trigger GPO reapplication; policy updates occur at defined intervals and system events, not application launches. Now, why are the other options incorrect? Option A is incorrect. GPOs are applied at 90-minute intervals for periodic refresh. Option B is incorrect. GPOs are applied automatically at logon. Option D is incorrect. GPOs are applied automatically at boot-up. Therefore, C, Every time Windows Explorer is launched, is the correct answer.
Play from 2:26:01 Question 90. Which of the following terms refers to the process in which headers and trailers are added around user data? Here are the options. Option A. Encapsulation. Option B. Authentication. Option C. Authorization. Option D. Encryption. Pause the video now if you want time to think about the answer.
The correct answer is A. Encapsulation. Encapsulation is the networking concept where headers and trailers (protocol-specific information) are added around user data at each layer of the OSI model. This allows each layer to add its own addressing and control information as data moves through the network stack. Now, why are the other options incorrect? Option B is incorrect. Authentication verifies the identity of users or systems, not the addition of headers and trailers Option C is incorrect. Authorization controls what authenticated users are permitted to access, not data formatting Option D is incorrect. Encryption scrambles data for confidentiality but doesn't define the addition of headers and trailers Therefore, A, Encapsulation, is the correct answer.
Play from 2:27:25 Question 91. What file instructs programs like Web spiders NOT to search certain areas of a site? Here are the options. Option A. Robots.txt. Option B. Restricted.txt. Option C. Spider.txt. Option D. Search.txt. Pause the video now if you want time to think about the answer.
The correct answer is A. Robots.txt. The robots.txt file is the standard text file placed in a website's root directory that provides instructions to web crawlers and spiders about which areas of the site should or should not be accessed. Search engines and web spiders consult this file to respect website owners' preferences. The other filenames (Restricted.txt, Spider.txt, Search.txt) are not recognized standards in web protocol specifications. Now, why are the other options incorrect? Option B is incorrect. Restricted.txt is not a recognized standard file for controlling web crawler access. Option C is incorrect. Spider.txt is not the standard filename; the actual standard is robots.txt. Option D is incorrect. Search.txt is not a recognized standard for instructing search engines or spiders. Therefore, A, Robots.txt, is the correct answer.
Play from 2:29:02 Question 92. Which of the following proxy servers provides administrative controls over the content? Here are the options. Option A. Content filtering web proxy server. Option B. Caching proxy server. Option C. Forced proxy server. Option D. Web proxy server. Pause the video now if you want time to think about the answer.
The correct answer is A. Content filtering web proxy server. A content filtering web proxy server is specifically designed to provide administrative controls over the content that users can access. It inspects traffic and applies policies to block or allow content based on categories, keywords, or other criteria defined by administrators. Now, why are the other options incorrect? Option B is incorrect. Caching proxy servers focus on performance improvement by storing frequently accessed content. Option C is incorrect. Forced proxy servers enforce proxy usage but don't specifically provide content control. Option D is incorrect. A generic web proxy server provides basic proxy functions without specialized content filtering controls. Therefore, A, Content filtering web proxy server, is the correct answer.
Play from 2:30:32 Question 93. How often is session information sent to the web server from the browser once the session information has been established? Here are the options. Option A. With any change in session data. Option B. With every subsequent request. Option C. With any hidden form element data. Option D. With the initial request to register the session. Pause the video now if you want time to think about the answer.
The correct answer is B. With every subsequent request. Session information is sent to the web server with every subsequent request after the session is established. The browser includes session identifiers (typically in cookies, headers, or URL parameters) with each HTTP request so the server can maintain session state and associate requests with the authenticated user. Now, why are the other options incorrect? Option A is incorrect. Session information is sent continuously with each request, not just when session data changes. Option C is incorrect. Hidden form elements may contain session data, but session information itself is sent with every request regardless. Option D is incorrect. The initial request registers the session, but subsequent requests also carry session information with every new request. Therefore, B, With every subsequent request, is the correct answer.
Play from 2:32:11 Question 94. What technical control provides the most critical layer of defense if an intruder is able to bypass all physical security controls and obtain tapes containing critical data? Here are the options. Option A. Camera Recordings. Option B. Security guards. Option C. Encryption. Option D. Shredding. Option E. Corrective Controls. Pause the video now if you want time to think about the answer.
The correct answer is C. Encryption. Encryption is the critical technical control that protects data confidentiality even after physical security is breached. If an intruder obtains encrypted tapes, the data remains unreadable without the decryption keys. This is a detective/preventive control that provides the last line of defense when physical security fails, making it more effective than other options which either don't protect the data itself or are detective-only controls. Now, why are the other options incorrect? Option A is incorrect. Camera recordings document a breach but do not protect the data on the tapes from unauthorized access. Option B is incorrect. Security guards are a physical control that has already been bypassed by assumption in the question. Option D is incorrect. Shredding is a destruction method, not applicable to tapes still in use for critical data. Option E is incorrect. Corrective controls address issues after they occur but do not prevent unauthorized data access if tapes are obtained. Therefore, C, Encryption, is the correct answer.
Play from 2:34:03 Question 95. Which Defense-in-Depth model involves identifying various means by which threats can become manifest and providing security mechanisms to shut them down? Here are the options. Option A. Vector-oriented. Option B. Uniform protection. Option C. Information centric defense. Option D. Protected enclaves. Pause the video now if you want time to think about the answer.
The correct answer is A. Vector-oriented. Vector-oriented defense involves identifying the various attack vectors (means by which threats manifest) and implementing specific security controls to neutralize each threat vector. This approach focuses on understanding threat pathways and deploying countermeasures against each identified vector. Now, why are the other options incorrect? Option B is incorrect. Uniform protection applies the same security measures across all systems without regard to specific threat vectors. Option C is incorrect. Information centric defense focuses on protecting data based on its classification and sensitivity, not on threat vectors. Option D is incorrect. Protected enclaves involve creating isolated security zones rather than addressing specific threat manifestation paths. Therefore, A, Vector-oriented, is the correct answer.
Play from 2:35:34 Question 96. You work as a Network Administrator for Tech Perfect Inc. The company has a Linux- based network. You want to kill a process running on a Linux server. Which of the following commands will you use to know the process identification number (PID) of the process? Here are the options. Option A. killall. Option B. ps. Option C. getpid. Option D. kill. Pause the video now if you want time to think about the answer.
The correct answer is B. ps. The ps command is used to display information about running processes, including their process identification numbers (PIDs). This is the standard tool for identifying which PID corresponds to a specific process before terminating it with kill or killall. Now, why are the other options incorrect? Option A is incorrect. killall terminates processes by name but doesn't display their PIDs Option C is incorrect. getpid is a programming function call, not a command-line utility for identifying running processes Option D is incorrect. kill is used to terminate a process once you know its PID, not to find the PID Therefore, B, ps, is the correct answer.
Play from 2:37:05 Question 97. Which of the following are the types of access controls? Each correct answer represents a complete solution. Choose three. Here are the options. Option A. Physical. Option B. Administrative. Option C. Automatic. Option D. Technical. Pause the video now if you want time to think about the answer.
The correct answers are A. Physical, and B. Administrative, and D. Technical. The three primary categories of access controls are: Physical (locks, guards, facilities), Administrative (policies, procedures, training), and Technical (firewalls, encryption, authentication systems). Option C, 'Automatic,' is not a recognized category of access controls in standard security frameworks. Now, why are the other options incorrect? Option C is incorrect. Automatic is not a recognized category of access controls; controls require design and implementation by security professionals. Therefore, A and B and D are the correct answers.
Play from 2:38:28 Question 98. Which of the following types of computers is used for attracting potential intruders? Here are the options. Option A. Files pot. Option B. Honey pot. Option C. Data pot. Option D. Bastion host. Pause the video now if you want time to think about the answer.
The correct answer is B. Honey pot. A honeypot is a security tool designed to attract and deceive potential intruders by appearing as a legitimate system or network resource. It is intentionally made attractive to attackers to study their behavior, detect intrusion attempts, and gather intelligence about attack methods. Honeypots collect data on attack patterns without exposing actual production systems to risk. Now, why are the other options incorrect? Option A is incorrect. Honeypot is the correct term; 'Files pot' is not a recognized security concept. Option C is incorrect. Data pot is not a standard security term or defensive mechanism. Option D is incorrect. A bastion host is a hardened server that acts as a gateway or control point, not a tool designed to attract intruders. Therefore, B, Honey pot, is the correct answer.
Play from 2:39:57 Question 99. At what point in the Incident Handling process should an organization determine its approach to notifying law enforcement? Here are the options. Option A. When performing analysis. Option B. When preparing policy. Option C. When recovering from the incident. Option D. When reacting to an incident. Pause the video now if you want time to think about the answer.
The correct answer is B. When preparing policy. Law enforcement notification decisions must be made during the preparation phase when policies are being established, not reactively during an incident. This allows the organization to understand legal obligations, jurisdictional requirements, and notification procedures before a crisis occurs. Making this decision during analysis, recovery, or reaction would be too late and could compromise investigations or violate legal requirements. Now, why are the other options incorrect? Option A is incorrect. Analysis phase is too late; decisions should be pre-established in policy. Option C is incorrect. Recovery is the final phase and too late for initial law enforcement decisions. Option D is incorrect. Reaction phase occurs during the incident; planning should happen beforehand. Therefore, B, When preparing policy, is the correct answer.
Play from 2:41:34 Question 100. The Linux command to make the /etc/shadow file, already owned by root, readable only by root is which of the following? Here are the options. Option A. chmod 444/etc/shadow. Option B. chown root: root/etc/shadow. Option C. chmod 400/etc/shadow. Option D. chown 400 /etc/shadow. Pause the video now if you want time to think about the answer.
The correct answer is C. chmod 400/etc/shadow. The command chmod 400 /etc/shadow sets permissions to read-only (4) for the owner (root) with no permissions for group or others (00). In octal notation, 4 = read, 2 = write, 1 = execute, so 400 means owner can only read. Option A uses invalid syntax (missing space), Option B uses chown which changes ownership not permissions, and Option D incorrectly uses chown with a numeric mode instead of an owner specification. Now, why are the other options incorrect? Option A is incorrect. This command has invalid syntax; there is a missing space between "chmod 444" and "/etc/shadow". Option B is incorrect. The chown command changes file ownership, not permissions; it would not make the file readable only by root. Option D is incorrect. The chown command expects owner:group format, not a numeric permission code like 400. Therefore, C, chmod 400/etc/shadow, is the correct answer.
