- What type of attack is a Padding Oracle On Downgrading Legacy Encryption attack? Choose two options from the following list:
A. IV attack
B. Replay attack
C. Man-in-the-middle attack
D. TLS 1.0 with electronic code book
E. SSL 3.0 with chain block cipher
- You are the security administrator for the British secret service. What type of access method will you use for secret and top-secret data?
A. You will use DAC, with the owner of the data giving the access
B. You will use DAC, with the custodian of the data giving access
C. You will use DAC, with the security administrator giving access
D. You will use MAC, with the security administrator giving access
- Your company wants to encrypt DNS traffic by using DNSSEC. Once you have signed the zone, what records are created for each host?
A. CNAME
B. AAAA
C. RRSIG
D. MX
E. PTR
- You are a security administrator. A user called Ben is having a discussion with one of his colleagues. They have four choices for two-factor authentication. They have asked for your advice as to which of the following is a two-factor authentication method. Select the best answer:
A. Smart card
B. Password and PIN
C. Passphrase and username
D. Retina and fingerprint scan
- Two separate CAs need to work together on a joint venture. What can they implement so that certificates can be used for cross certification?
A. Bridge trust model
B. Certificate pinning
C. Certificate stapling
D. Wildcard certificates
- John goes to a sports website and gets the following error:
THIS WEBSITE CANNOT BE TRUSTED.
What two actions does the website administrator need to take to resolve this error?
A. Ask the key escrow to store their private key
B. Ensure that the website uses a valid SAN certificate
C. Update the root certificate in the client computer Trusted Root Certificate Authorities Store
D. Verify that the certificate on the server has not expired
- A security administrator discovers that an attacker used a compromised host as a platform for launching attacks deeper in a company's network. What terminology best describes the use of the compromised host?
A. Brute force
B. Active reconnaissance
C. Pivoting
D. Passing point
- Mary is managing the company's wireless network, which uses WPA2-PSK. What kind of encryption is most likely to be used?
A. SHA-1
B. AES
C. MD5
D. DES
- Who is responsible for setting permissions when using a Mandatory Access Control (MAC) model?
A. Owner
B. Manager
C. Administrator
D. User
- Company A is due to upgrade all of its IT systems, and has been investigating the possibility of moving to the cloud, as there is no capital expenditure because the CSP provides the hardware. Company A would still like to control the IT systems in the cloud. Which cloud model would best serve company A's needs?
A. Software as a Service (SaaS)
B. Infrastructure as a Service (IaaS)
C. Monitoring as a Service (MaaS)
D. Platform as a Service (PaaS)
- You are the security administrator and the IT director has tasked you with collecting the volatile memory on Server 1, as it is currently experiencing a cyberattack. Which of the following are the two best forms of volatile memory to collect?
A. Secure boot
B. Swap/page file
C. USB flash drive
D. ROM
E. RAM
- Bill and Ben, the flowerpot men are going to encrypt data using asymmetric encryption, which uses public and private keys. What is the first step they need to take?
A. Exchange public keys
B. Exchange private keys
C. Exchange digital signatures
D. Exchange telephone numbers
- At what stage in the SDLC are computer systems no longer supported by the original vendor?
A. Sandboxing
B. End-of-life systems
C. Resource exhaustion
D. System sprawl
- Company A has just developed a bespoke system for booking airline tickets. What is it called if a freelance coding specialist tests it for security flaws?
A. Code review
B. Static code review
C. Regression testing
D. Dynamic code review
- You are the security administrator for a company that has just replaced two file servers. Which of the following is the best solution for disposing of the hard drives that are used to store top-secret data?
A. Hashing
B. Degaussing
C. Low-level formatting
D. Shredding
- You are the security administrator for an airline company whose systems suffered a loss of availability last month. Which of the following attacks would most likely affect the availability of your IT systems?
A. Spear phishing
B. Replay
C. Man-in-the-middle (MITM)
C. DoS
- You are a network administrator setting up an L2TP/IPSec VPN tunnel, as your company needs to move a large amount of encrypted data between a branch office and the head office. Why is Diffie Hellman used for an IKE phase before the data is forwarded via symmetric encryption?
A. It is a symmetric encryption technique that protects keys
B. It is a hashing technique that protects keys
C It is an ephemeral technique that protects keys
D. It is an asymmetric technique that protects keys by setting up a secure channel
- You are a lecturer at a college and you need to deliver a session on salting passwords. What are the two main reasons you would salt passwords?
A. To prevent brute force attacks
B. To make access to the password slower
C. To prevent duplicate passwords being stored
D. To stop simple passwords from being used
- Which of the following methods of authentication are known as two-factor authen...
