While analyzing a packet capture log, you notice the following entry: 16:12:50, src 10.80.1.5:3389, dst 192.168.1.100:8080, syn/ack Of the following choices, what is the BEST explanation of this entry?
A. An HTTP connection attempt
B. An RDP connection attempt
C. An FTP connection attempt
D. A buffer overflow attack
Answer: B. An RDP connection attempt
Learn More :
Implementing Host
- Your organization wants to ensure that security controls continue to function, helping to maintain an appropriate security posture. Which of the following is the BEST choice to meet this goal?
- Your organization's security policy states that administrators should follow the principle of least privilege. Which of the following tools can ensure that administrators are following the policy?
- Your organization recently hired an outside security auditor to review internal processes. The auditor identified several employees who had permissions for previously held jobs within the company. What should the organization implement to prevent this in the future?
- Security administrators have recently implemented several security controls to enhance the network's security posture. Management wants to ensure that these controls continue to function as intended. Which of the following tools is the BEST choice to meet this goal?
- A network administrator needs to identify the type of traffic and packet flags used in traffic sent from a specific IP address. Which of the following is the BEST tool to meet this need?
- A network administrator is troubleshooting a communication problem between a web server and a database server. Which of the following tools would MOST likely be useful in this scenario?
- Your organization has hired a group of external testers to perform a black box penetration test. One of the testers asks you to provide information about your internal network. What should you provide?
- Testers do not have access to product documentation or any experience with an application. What type of test will they MOST likely perform?
- An organization has a legacy server within the DMZ. It is running older software that is not compatible with current patches, so it remains unpatched. Management accepts the risk on this system, but wants to know if attackers can access the internal network if they successfully compromise this server. Which of the following is the MOST appropriate test?
- Your organization develops web application software, which it sells to other companies for commercial use. Your organization wants to ensure that the software isn't susceptible to common vulnerabilities, such as buffer overflow attacks and race conditions. What should the organization implement to ensure software meets this standard?
- A recent vulnerability stream-7 can reported that a web application server is missing some patches. However, after inspecting the server, you realize that the patches are for a protocol that administrators removed from the server. Which of the following is the BEST explanation for this disparity?
- Lisa needs to identify if a risk exists on a web application and if attackers can potentially bypass security controls. However, she should not actively test the application. Which of the following is the BEST choice?
- You need to perform tests on your network to identify missing security controls. However, you want to have the least impact on systems that users are accessing. Which of the following tools is the best to meet this need?
- You suspect that a database server used by a web application does not have current patches. Which of the following is the BEST action to take to verify the server has up-to-date patches?
- You recently completed a vulnerability scan on your network. It reported that several servers are missing key operating system patches. However, after checking the servers, you've verified the servers have these patches installed. Which of the following BEST describes this?
- You want to identify all of the services running on a server. Which of the following tools is the BEST choice to meet this goal?
- You need to calculate the expected loss of an incident. Which of the following value combinations would you MOST likely use?
- You need to calculate the ALE for a server. The value of the server is $3,000, but it has crashed 10 times in the past year. Each time it crashed, it resulted in a 10 percent loss. What is the ALE?
- Which of the following is most closely associated with residual risk?
Cyber Security
- What is the purpose of suspending a digital certificate rather than revoking it?
- How does an attacker successfully alter a message that was sent with a digital certificate?
- What is concerning about entry-level certificates?
- On which of the following devices is IPsec likely to be implemented?
- Which of the following is used to digitally sign a certificate?
- If a browser cannot connect to the OSCP responder, what does the browser receive in return?
- Why would an administrator NOT renew a key?
- What is involved in key escrow?
- A hierarchical trust model signs digital certificate authorities with how many keys?
- PKI consists of all of the following EXCEPT what?
- Which of the following does a digital certificate NOT contain?
- How can an EV SSL help users avoid dangerous sites?
- Why is a pre-master secret an important component of a web browser and web server handshake?
- Why would an administrator choose to use multiple Registration Authorities when processing certificate requests?
- Public Key Cryptography Standards are based on which of the following?
- Where are private keys NOT stored?
- How are TLS and SSL currently different in regards to security?
- What is the biggest difference between a CA and an RA?
- Which of the following is provided by a server digital certificate?
- Which of the following explains the importance of a "facilitator?"
- NTRUEncrypt is based on which cryptography method?
- "Plaintext" is a term that is best described as what?
- Which of the following is an advantage of the Keccak algorithm?
- What is a benefit of using a combination of symmetrical and asymmetrical cryptography when transferring data across the internet?
- Why is a homoalphabetic substitution considered a stream cipher?