GSEC Practice Test – 334 Free Exam Questions with Answers

Correct answer: D. D) True positive

A true positive occurs when a malicious attack triggers a detection system alarm. It is crucial to distinguish this correct alert from a false positive, where normal behavior is mistakenly flagged, or a false negative, where an actual attack is missed entirely.

Correct answer: C. C) An ICMP Type 3 Code 3

A closed UDP port without a firewall responds with an ICMP Type 3 Code 3 destination unreachable message. Remember that UDP lacks built-in session management, so systems rely on ICMP to signal that the target port is closed.

Correct answer: D. D) It poisons Web content.

Cross-site scripting attacks work by injecting malicious scripts into trusted web content, effectively poisoning the website. The strongest distractors describe delivery methods or unrelated attacks, whereas the core risk of this vulnerability is content manipulation.

Correct answer: B. B) Implementing centralized analysis with numerous remote sensor agents

Large environments achieve network-wide visibility by deploying remote sensor agents that feed data to a centralized analysis engine. While connecting to a SPAN port is necessary for traffic capture, relying on isolated sensors prevents seeing the overall security picture.

Correct answer: A. A) The potential operating system and types of services running on the target

Open TCP and UDP ports reveal the potential operating system and the types of services running on a target machine. Security professionals use these port numbers to infer system characteristics, as specific services typically listen on well-known standard ports.

Correct answer: D. D) It demonstrates an attacker's ability to mask their activities.

The final clearing tracks phase demonstrates an attacker's ability to mask their activities by altering or deleting logs. This step proves that standard logging is vulnerable to tampering, highlighting the need for protected centralized logging solutions.

Correct answer: B. B) Initialization vector

An initialization vector is a cryptographic component used in encryption algorithms, not a detection mechanism used by intrusion detection or prevention systems. For the exam, associate detection methods with anomaly, behavioral, and heuristic analysis, leaving cryptographic terms separate.

Correct answer: A. A) CSRF

Cross-site request forgery works by hijacking a victim's authenticated session to submit unauthorized commands to a web server. Other options like SQL injection exploit database queries, whereas this attack specifically leverages the established trust of an active encrypted connection.

Correct answer: C. C) Discovered weaknesses are secured by the IT staff.

Vulnerability scans improve security only when IT staff actively remediate the discovered weaknesses. Simply generating reports or performing routine scans provides no actual protection unless those identified flaws are properly mitigated and resolved.

Correct answer: C. C) Information gathering and reconnaissance

Information gathering and reconnaissance heavily rely on open-source intelligence, meaning attackers interact mostly with public resources rather than the target's monitored network. Active phases like scanning and exploitation trigger alerts, whereas passive research avoids direct detection.

Correct answer: D. D) White box

A white box test provides ethical hackers with full knowledge and documentation of the target environment prior to the assessment. Black box testing offers zero prior knowledge, while grey box testing only discloses partial documentation to the evaluation team.

Correct answer: D. D) A recent security breach

Having a recent security breach is never a prerequisite for conducting a penetration test. Examiners expect you to know that organizations must possess mature security foundations, such as written policies and reliable backups, before authorized testing begins.

Correct answer: D. D) Impersonation

A stolen cookie allows an attacker to impersonate the victim by reusing the active session token. Session hijacking enables immediate account access, unlike SQL injection or denial of service attacks.

Correct answer: D. D) Notify the administrator.

Notifying the administrator is passive because it does not interfere with the attacker or alter the system state. Active responses actively disrupt the attack, such as terminating processes or disconnecting sessions.

Correct answer: A. A) to defend against SQL injection

Escaping meta-characters neutralizes malicious injected commands, providing a primary defense against SQL injection attacks. Buffer overflows require bounded inputs for mitigation, making length filtering rather than character escaping the relevant control mechanism.

Correct answer: C. C) TLS

Transport Layer Security is the primary protocol used to encrypt and secure web communications across the internet. Secure Shell manages remote administration, while IPsec secures virtual private network tunnels rather than individual web browsing sessions.

Correct answer: B. B) Short and simple passwords

Vulnerability scanners generally cannot detect short and simple passwords because they do not perform brute-force authentication attacks. A separate password cracking tool is required to identify weak credentials, whereas scanners easily find missing updates.

Correct answer: D. D) Use of a honeypot can distract hackers from breaching live systems

A primary advantage of a honeypot is distracting attackers by drawing them toward a decoy system and away from live production servers. The other options represent significant deployment disadvantages, such as increased risk if a honeypot is fingerprinted.

Correct answer: C. C) If the client software is configured to craft IP packets using a specific destination address

A non-transparent proxy requires the client software to be explicitly configured with the proxy server's address as the destination. A transparent proxy intercepts traffic automatically without client configuration, whereas user notification and NAT presence are irrelevant.

Correct answer: D. D) to trick victims into providing sensitive data

Attackers plant unvalidated redirects or forwards on a website to trick victims into visiting malicious sites and providing sensitive data. This stealthy redirection is often used for phishing rather than causing buffer overflows or cloning websites for offline viewing.

Correct answer: A. A) At the primary ISP demarcation point

The primary appliance firewall provides the most benefit when positioned at the network edge, specifically the ISP demarcation point. This perimeter placement filters traffic before it enters the internal network, whereas internal devices rely on software firewalls.

Correct answer: A. A) Behavioral, anomaly, and heuristic detection

Behavioral, anomaly, and heuristic detection mechanisms allow an intrusion detection system to identify new and unknown attacks. Instead of relying on known signatures, these methods evaluate deviations from a baseline to flag suspicious activity, though false positives may occur.

Correct answer: B. B) The source IP address and destination port number

A packet-filtering firewall operates at OSI layers three and four, making decisions based on the source IP address and destination port number. It does not inspect deep packet content or MAC addresses, which are features of higher or lower layer controls.

Correct answer: B. B) IP address detection

An IP address alone merely confirms a device is active on the network, revealing nothing about its operating system or role. Port scanning, banner grabbing, and service enumeration actively probe the host to fingerprint its specific software and configuration.

Correct answer: C. C) With mutual certificate authentication via TLS

Mutual certificate authentication via TLS stops man-in-the-middle attacks by requiring both the client and server to cryptographically prove their identities. Standard TLS without mutual authentication still leaves sessions vulnerable to clever interception and credential theft.

Correct answer: B. B) The site allows hidden form fields.

Relying on hidden HTML form fields for pricing allows attackers to easily modify the price value locally before submitting the form. Servers must always retrieve prices from a secure backend database rather than trusting user-controllable client inputs.

Correct answer: B. B) Stateful inspection firewall

Stateful inspection firewalls maintain context about active network connections, allowing them to easily recognize the rapid sequential probing typical of port scans. Static packet filters lack this contextual memory and cannot effectively correlate the individual probes.

Correct answer: C. C) Heartbleed Bug

The Heartbleed bug was a severe OpenSSL flaw allowing attackers to read protected system memory and steal encryption keys or plaintext data. Zeus and CryptoWall are malware families, while VENOM targeted virtual machine hypervisors.

Correct answer: B. B) A SYN scan duplicates the connection request from a legitimate client.

A TCP SYN scan mimics the initial step of a legitimate connection request, making it stealthier than completing a full handshake. Because it closely resembles normal traffic, simple packet-filtering firewalls often fail to block it, allowing the scanner to detect open ports.

Correct answer: D. D) Testing new code on a live Internet site

Testing new code on a live internet site introduces unnecessary risk, as unvetted changes can expose critical flaws to attackers. For the exam, remember that proper secure development lifecycle practices mandate strict separation of development, testing, and production environments.

Correct answer: A. A) One can stop an attack from becoming successful.

An intrusion prevention system can actively stop an attack from becoming successful, whereas an intrusion detection system generally only alerts on the activity. Remember that prevention systems sit inline to block traffic, while detection systems merely monitor.

Correct answer: A. A) Network topology

A host-based intrusion detection system monitors internal system activities like drive writes and active processes, not network topology. Network topology is strictly a concern for network-based intrusion detection systems, which require strategic sensor placement.

Correct answer: B. B) Host-based systems are dependent upon the stability of the OS.

Host-based security tools depend heavily on the stability of the underlying operating system, meaning an unstable or compromised system might disable the protection. Unlike network sensors, host agents operate as software processes and consume local resources.

Correct answer: B. B) Information gathering and reconnaissance

Information gathering and reconnaissance consumes the most time because testers must thoroughly research leaked data about the target. Remember that while exploitation gets the glory, discovery is the longest phase.

Correct answer: A. A) A honeynet includes multiple systems, while a honeypot includes only a single system.

A honeynet is simply a network constructed of multiple honeypot systems, whereas a honeypot is typically a single decoy system. Do not overthink logging capabilities; focus on the architectural scale difference.

Correct answer: B. B) The honeypot is a false entity.

Honeypots are false entities, which makes prosecution tricky because courts might view them as entrapment or question the damages. Since the system is fake, proving actual harm is difficult.

Correct answer: C. C) Gaining access

Privilege escalation, converting standard access into higher privileges, occurs during the gaining access phase of a penetration test. Testers exploit vulnerabilities here to elevate their permissions after initial compromise.

Correct answer: D. D) Details about a new unknown exploit

Honeypots are valuable for discovering details about new, previously unknown exploits or zero-day attacks. Since any traffic interacting with a honeypot is suspicious by default, analysts can safely analyze novel attack methods.

Correct answer: C. C) Retaliation

Exposed honeypots often trigger retaliation because attackers actively target organizations that attempt to deceive them. Avoidance is unlikely since hackers rarely ignore a discovered system, whereas port scanning is just a precursor to larger retaliatory attacks.

Correct answer: A. A) Encrypting connections with TLS

Transport Layer Security only protects data in transit from eavesdropping and fails to validate server-side payload contents. Filtering input length, blocking known patterns, and escaping meta-characters actively inspect and sanitize data to prevent injection exploits.

Correct answer: A. A) In front of a public Web server

Deploying a honeypot near a public web server ruins the deception because attackers will target the legitimate resource instead. Honeypots are best placed in isolated server farms or near restricted internal access points like VPN concentrators.

Correct answer: B. B) False positives on the report

False positives represent the biggest risk because they waste valuable administrator time and resources during manual verification. A vulnerability scanner is a passive tool, so it discovers configurations and missing patches without actively exploiting or damaging targets.

Correct answer: A. A) Malicious code

Active content risks executing malicious code on a victim system because browsers run downloaded scripts with user privileges. While phishing and social engineering target human behavior, active content directly compromises the local machine through code execution.

Correct answer: C. C) Use an unauthorized direct connection to the victim.

An attacker bypasses perimeter security by establishing an unauthorized direct connection to the victim. Application-layer firewalls inspect traffic deeply, so merely encapsulating payloads or encrypting the attack will still trigger alerts across monitored network paths.

Correct answer: C. C) It discards all unnecessary traffic.

The primary benefit of a firewall is discarding unrecognized traffic by enforcing an implicit deny stance. While modern unified threat management appliances might handle caching or malware scanning, traditional firewalls focus strictly on traffic filtering and load balancing.

Correct answer: A. A) By marking unauthorized communications

A honey token helps investigators track unauthorized activity by marking illegitimate communications with unique identifiers like fake credentials. If an attacker uses these trapped values elsewhere, the resulting alerts pinpoint the compromise without blocking access.

Correct answer: B. B) to discover the status of port numbers and IP addresses

Penetration testers use network discovery tools like nmap and hping to identify active IP addresses and determine the status of port numbers. This scanning phase maps the attack surface, unlike gathering access or initial reconnaissance which relies on public sources.

Correct answer: D. D) Source socket

The source socket identifies the origin of network traffic in a Snort rule, making it essential for detecting unwanted communication from known malicious IP addresses. The rule action then dictates whether to alert or drop that specific matching traffic.

Correct answer: A. A) Detect an attack before it is successful.

Predicting and preventing an attack before it executes is inherently difficult because prevention systems must make rapid decisions with minimal initial data. Notifying administrators or dropping suspicious sessions after detection are far simpler reactive tasks.

Correct answer: B. B) Outside the appliance firewall

Placing sensors outside the primary firewall exposes them to massive volumes of meaningless internet background radiation, causing extreme false positives. You want sensors positioned behind the firewall to inspect filtered traffic heading toward actual internal targets.

Correct answer: C. C) It is unable to detect unknown attacks

Intrusion prevention systems struggle to reliably detect zero-day or unknown attacks because they primarily rely on known signatures and historical patterns. Blocking known malware signatures or abusive IPs is already highly effective and fully realized.

Correct answer: A. A) because of the potential presence of firewalls

Stateful firewalls detect port scans by tracking multiple rapid connection attempts from a single source over a short time window. Spacing out probes prevents triggering this threshold, ensuring the firewall drops your scanning traffic and blocks accurate results.

Correct answer: A. A) Encrypt the connection.

Encrypting the connection blinds a network intrusion detection system because the sensor cannot decrypt the payload to inspect it for malicious signatures. If the NIDS lacks access to the session keys, it cannot evaluate the encrypted traffic contents.

Correct answer: C. C) To confirm discovery of actual systems

Crafting a network visibility map confirms the discovery of actual systems deployed in the infrastructure, ensuring the assessment covers everything. This mapping process verifies that active scanning successfully found legitimate devices and missed nothing important.

Correct answer: D. D) One relies upon manual attacks performed by skilled professionals

Penetration testing relies on manual attacks performed by skilled professionals to actively exploit vulnerabilities, whereas vulnerability scanning uses automated tools to identify weaknesses. Examiners emphasize that scanning finds flaws, while penetration testing actively exploits them.

Correct answer: C. C) To minimize the risk of active content

Managing mobile code per domain minimizes the risk of malicious active content, like JavaScript, executing unchecked in the browser. Plugins restrict scripts to trusted sites, preventing automatic execution everywhere.

Correct answer: D. D) Backdoors

Borrowed scripts from free repositories often contain hidden backdoors providing unauthorized system access. Always review third-party code thoroughly before deployment to prevent hidden administrative logins.

Correct answer: B. B) Inbound ports are always open.

Static packet filters require inbound ports to remain open so clients can receive requested traffic. This exposes clients to arbitrary inbound connections, whereas stateful firewalls dynamically open ports only for valid sessions.

Correct answer: A. A) The weaknesses of your environment are not discoverable with this tool.

A clean report only means the scanner did not find flaws within its specific detection database. Remember that no scanner is omnipotent; many vulnerabilities require manual discovery or are simply unknown to the tool.

Correct answer: A. A) Do not steal funds out of company bank accounts.

Consultants are strictly constrained by law and ethics, meaning they cannot commit actual crimes like stealing funds from company bank accounts. While clients might initially prohibit social engineering or denial of service attacks, testers can negotiate those rules.

Correct answer: C. C) Removing an asset from the environment · D. D) Altering business processes

Risk avoidance involves changing business processes or completely removing an asset to eliminate the associated threat. Outsourcing is a classic example of risk transfer, while ignoring a threat is simply negligence, not a valid strategy.

Correct answer: B. B) Craft a message so that every fourth word is the secret content. · D. D) Use whitespace encoding.

Using a concealment cipher or whitespace encoding allows hidden messages within text without requiring specialized graphical tools. Least significant bit manipulation applies to image or audio files, not standard ASCII text editing.

Correct answer: B. B) A keystroke logger wrapped inside of a browser plug-in

A keystroke logger wrapped inside a browser plug-in is a Trojan horse, not steganography, because it focuses on malware delivery rather than hiding secret messages. Steganography requires concealing information within a carrier file without revealing its presence.

Correct answer: D. D) Secure key exchange

Secure key exchange is the primary challenge of symmetric encryption because both parties need the same key over an insecure medium. Asymmetric cryptography solves this through digital envelopes and key agreement protocols.

Correct answer: A. A) Orthogonal frequency division multiplexing

Orthogonal frequency division multiplexing is a wireless modulation technique for encoding data onto multiple carrier frequencies, not a steganographic method. The other options represent legitimate ways to hide data within various media.

Correct answer: A. A) The private key is generated at random, and then the public key is derived from the private key.

In asymmetric cryptography, the private key is generated randomly, and the public key is derived from it using a one-way mathematical function. This prevents attackers from reverse-engineering the private key if they obtain the public key.

Correct answer: C. C) TLS

Transport Layer Security (TLS) is correct because it is the foundational protocol for VPN solutions like OpenVPN. For the exam, remember that while SSH supports tunneling, Secure Copy (SCP) is only a file transfer utility and not a VPN protocol.

Correct answer: A. A) Equip other organizations to handle a looming security concern.

Sharing threat intelligence equips other organizations to proactively handle looming security concerns. Sharing is about collective defense and awareness, not about removing intellectual property ownership or attempting to trick attackers into abandoning exploits.

Correct answer: A. A) Risk register

A risk register is used to formally list, categorize, and track all discovered risks within an enterprise risk management program. It serves as an actionable tracking document, whereas threat models are used to evaluate specific vulnerabilities.

Correct answer: A. A) Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege

STRIDE correctly stands for Spoofing identity, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Use this mnemonic on the exam to quickly distinguish it from other models like DREAD, which focuses on damage and exploitability.

Correct answer: D. D) Harming the threat agent

Risk deterrence involves discouraging attackers by threatening harm or retaliation, such as actively pursuing prosecution. For the exam, clearly distinguish this from risk mitigation, which focuses on implementing safeguards rather than threatening the threat agent.

Correct answer: A. A) Brute force

A brute force attack systematically attempts every possible key in the keyspace to find the exact symmetric key used for encryption. While dictionary attacks target passwords, brute force is the only method guaranteed to eventually find the specific key.

Correct answer: C. C) It uses changed and unchanged elements to encode the hidden message

LSB steganography is exceptionally difficult to detect because it uses a mixture of changed and unchanged elements to encode hidden messages. This lack of a consistent alteration pattern prevents easy detection, unlike file size or hash value changes.

Correct answer: D. D) Formal risk acceptance

Producing a document showing formal risk acceptance, signed by senior management, defends against accusations of ignoring a risk. Implementing countermeasures after the fact is too late, as proper risk management requires documentation before an incident occurs.

Correct answer: D. D) Reactive state

A reactive state describes an organization that only addresses security incidents after they happen. The proactive state is the opposite, meaning the organization plans ahead and implements controls before a compromise occurs.

Correct answer: B. B) The avalanche effect

The avalanche effect ensures that even a tiny change in the input data produces a significantly different hash output. While binary math is heavily used in cryptography, the avalanche effect specifically guarantees strict integrity violation detection.

Correct answer: A. A) Static symmetric keys

Secure virtual private networks rely on ephemeral session keys rather than static symmetric keys, which are heavily vulnerable to interception. Hashing, digital signatures, and asymmetric key pair sets are all required components to establish secure tunnels.

Correct answer: D. D) To discover flaws

Public algorithms allow the global cryptography community to thoroughly analyze and test the mathematical structure to discover any hidden flaws. Security relies entirely on the secrecy of the private key, not on keeping the algorithm itself hidden.

Correct answer: C. C) Steganography

Steganography hides secret messages within ordinary files and is not a core component of a public key infrastructure. Public key infrastructure strictly combines asymmetric encryption, symmetric encryption, hashing, and digital certificates.

Correct answer: B. B) pagefile.sys

A pagefile is a poor steganography host because the operating system constantly modifies it. Steganography requires a static host file to prevent hidden data from being overwritten or corrupted, making images or executables much safer choices.

Correct answer: D. D) SLE

Single loss expectancy, or SLE, represents the expected financial loss from a single security incident. Remember the exam formula SLE equals asset value multiplied by exposure factor, which contrasts with annualized loss expectancy calculations.

Correct answer: C. C) Assigning a risk to another entity

Risk transfer involves shifting the potential impact of a risk to a third party, typically through purchasing insurance. Do not confuse this with risk mitigation, which reduces the likelihood or severity of the threat using internal safeguards.

Correct answer: C. C) (ALE1 – ALE2) – CCM

The cost benefit equation is calculated by taking the annualized loss expectancy before a safeguard, subtracting the reduced annualized loss expectancy, and then subtracting the cost of the countermeasure. Remember that annualized loss expectancy alone only calculates total potential risk.

Correct answer: D. D) EXXEGO

A four position substitution cipher, commonly known as a Caesar shift, encrypts ATTACK into EXXEGO by shifting each letter forward four positions in the alphabet. Recognizing standard alphabetical shifts helps quickly eliminate transposition or reversal distractors.

Correct answer: B. B) It is derived from historical occurrences.

The annualized rate of occurrence is derived from historical occurrences to estimate how often a threat might materialize over a year. Remember that asset value determines exposure factor or loss, but frequency relies on past incident data.

Correct answer: B. B) Quantitative

Quantitative risk assessment relies on mathematical formulas like annualized loss expectancy to calculate risk. A strong exam cue is to look for dollar amounts, while qualitative methods use subjective rankings like high, medium, and low.

Correct answer: C. C) A request by the Office of the Secretary of Defense to the NSA to assist with prioritizing security controls based on defending against known attacks

The controls originated from a request by the Office of the Secretary of Defense to the National Security Agency to prioritize defenses against known attacks. Remember that these controls focus on mitigating actual, documented real-world threats.

Correct answer: A. A) It focuses on using mostly pre-screened systems.

The Facilitated Risk Assessment Process saves time and money by focusing strictly on pre-screened systems and evaluating risk through a business impact assessment. OCTAVE is the methodology known for using three distinct phases of workshops.

Correct answer: B. B) It helps with internal transparency, risk assessment, risk response, and risk monitoring.

Reporting risks as defined by enterprise risk management directly enables internal transparency, assessment, response, and monitoring. While strategic planning and compliance are essential security concepts, they are not the primary purpose of the risk reporting phase.

Correct answer: D. D) Confidentiality, integrity, authentication, and non-repudiation

Cryptographic solutions provide confidentiality, integrity, authentication, and non-repudiation. Be careful not to confuse these services with the CIA triad, as cryptography does not directly provide availability, or with access control concepts like AAA.

Correct answer: C. C) Decryption

Decryption is the process of converting ciphertext back into readable plaintext. For a quick cue, remember that encryption turns plaintext into ciphertext, while decryption reverses the process using the proper cryptographic key.

Correct answer: A. A) User impersonation

User impersonation is often the most successful way to compromise encryption because it bypasses strong algorithms by stealing access to the keys. Brute forcing modern cryptography takes millennia, making direct attacks highly impractical.

Correct answer: C. C) The steganography encoding technique is unknown.

The stego-only attack rarely reveals hidden data because the analyst lacks knowledge of the specific encoding technique used. Without the right tool or understanding how the payload was concealed, extracting the hidden message from the carrier file is nearly impossible.

Correct answer: D. D) Safeguard selection

Selecting security mechanisms and mitigation options occurs during the safeguard selection phase of risk management. This step happens before cost benefit analysis, where you determine if deploying the chosen countermeasure makes financial sense.

Correct answer: A. A) To prove that a message did not change in transit · E. E) To indicate the communication's sender

Digital signatures use the sender's private key to encrypt a message hash, verifying integrity and authenticating the sender's identity. Be careful not to confuse signatures with encryption; signatures do not provide confidentiality or restrict who can read the message.

Correct answer: B. B) Chosen-message

The chosen-message technique uses an intercepted communication and a known host file with a known tool to re-create steganography outputs. Contrast this with known-cover, which simply compares an original cover file directly against an already embedded version.

Correct answer: A. A) They are a third-party proof with public key cryptography.

Digital certificates are reliable because a trusted third party, known as a certificate authority, validates the subject's identity using public key cryptography. Distractors mentioning biometrics, cloud storage, or memorized information describe different authentication factors or delivery mechanisms, not the core mechanism.

Correct answer: C. C) EFS

The Encrypting File System, or EFS, provides data at rest encryption for files stored on disk. The other choices are protocols designed to encrypt data in transit across a network, protecting communications rather than stored files.

Correct answer: C. C) Asset value * percentage of potential loss * annualized rate of occurrence

The correct formula multiplies asset value by the exposure factor and the annualized rate of occurrence to calculate annualized loss expectancy. The other primary formula shown is used for cost-benefit analysis rather than determining the inherent risk level.

Correct answer: D. D) Trust in the third party is not established.

Accepting an unknown certificate authority establishes trust in an unverified third party, breaking the chain of trust. You should only trust root certificates pre-installed by the operating system or explicitly approved by administrators.

Correct answer: C. C) Using a digital signature

Applying a digital signature uses the sender's private key, which automatically includes their public certificate. This allows the recipient to verify identity and validate the signature.

Correct answer: C. C) Link-based security tunneling

A host-to-site virtual private network provides link-based security tunneling that encapsulates all traffic, not just web communications. However, this is technically ambiguous because modern TLS VPNs also provide host-to-site access using application-layer encryption.

Correct answer: D. D) Check hash, discover CA, check TRL, check validity dates, check for revocation, and make trust choice

The certificate validation process begins by checking the hash to ensure file integrity, then discovering the issuing certificate authority, and ending with a final trust choice. Always verify that the digital fingerprint remains completely unaltered first.

Correct answer: C. C) To provide data confidentiality

The primary purpose of cryptography is to provide data confidentiality through encryption. While hashing provides integrity and digital signatures offer authentication, confidentiality remains the foundational reason for deploying cryptographic solutions.

Correct answer: C. C) Modulo

Modulo arithmetic calculates the remainder of a division operation, serving as a one-way function that improves substitution cipher security. For the exam, remember that modulo mathematics is also the foundational concept used to secure the Diffie Hellman key exchange process.

Correct answer: A. A) Computer evidence is classified as hearsay evidence.

Computer evidence is legally classified as hearsay, requiring strict collection procedures to qualify for the business records exemption. Proper chain of custody and hashing are required to prove that digital evidence remains unaltered.

Correct answer: B. B) One-time password

A hardware token with a display screen generates dynamic one-time passwords for authentication. This time-based password changes frequently, preventing replay attacks even if an attacker intercepts the credentials.

Correct answer: B. B) Monitor which users perform system management or account management operations.

Monitoring which users perform system or account management operations directly evaluates the control of administrative privileges. Watching for unauthorized privileged actions ensures that elevated access is strictly limited and properly tracked.

Correct answer: G. C) $50,000,000

To find the annualized loss expectancy, multiply the asset value by the exposure factor and the annualized rate of occurrence. This calculates the estimated yearly financial loss, helping prioritize which risks require immediate mitigation.

Correct answer: D. D) Initial binary digits

The class of an IPv4 address is determined by its initial binary digits. Remember the leading bits: zero for Class A, one zero for B, one one zero for C, and so on, rather than relying on the subnet mask.

Correct answer: C. C) TCP 989, 990

The TLS encrypted form of FTP, known as FTPS, uses TCP ports 989 and 990 by default. Do not confuse FTPS with SFTP, which operates over SSH on port 22, or standard FTP, which uses ports 20 and 21.

Correct answer: A. A) 20 bytes

The standard size of an IPv4 header is 20 bytes when no options are set. The header length field usually indicates five 4-byte words, meaning five times four equals twenty bytes for your calculations.

Correct answer: B. B) Checksum

The checksum field is used to verify that received data was not corrupted or modified in transit. The acknowledgment number only confirms successful receipt of data, not its integrity against transmission errors.

Correct answer: A. A) De-encapsulation

De-encapsulation describes processing a header, removing it, and passing the payload up to the next layer. This matches the OSI or TCP/IP model flow, whereas checksum verification is only a small step in that overall process.

Correct answer: B. B) Isolation of tasks and operations

The primary security benefit of operating multiple guest OSs is the isolation of tasks and operations. If one application is compromised, the hypervisor prevents the attacker from easily affecting the other isolated guest systems.

Correct answer: D. D) It is based on RC4.

You should avoid WPA because it relies on the vulnerable RC4 streaming cipher. WPA2 provides a significant security upgrade by using the much stronger Advanced Encryption Standard, or AES, for protecting wireless communications.

Correct answer: C. C) 22 MHz

The original IEEE 802.11 standard defined 2.4 GHz channels with a width of 22 MHz. Modern amendments like 802.11n and 802.11ac introduced channel bonding, allowing wider channels like 40 MHz to increase network throughput.

Correct answer: C. C) A command-line raw packet-capturing utility

Tcpdump is a command-line raw packet-capturing utility used extensively in Linux and Unix environments. It is not a port listing tool like netstat, but rather a powerful utility for sniffing and analyzing network traffic.

Correct answer: B. B) Closed port

An ICMP Type 3 Code 3 message indicates a destination port is unreachable, meaning the UDP port is closed. Because UDP lacks internal error tracking, it relies on ICMP to notify senders of these delivery failures.

Correct answer: C. C) To prevent remote control attacks

Port 3389 is used by Microsoft's Remote Desktop Protocol, which allows remote control of a system and poses a serious inbound security risk if exposed. Blocking it prevents attackers from establishing unauthorized remote control sessions, whereas the other options map to completely different ports.

Correct answer: A. A) To establish a session

The TCP three-way handshake synchronizes sequence numbers to reliably establish a session between two endpoints. A helpful exam tip is that basic network protocols do not handle authentication or encryption keys; those functions are left to the application or higher-level security protocols.

Correct answer: D. D) Internetworking layer – Data Link layer

The TCP/IP Internetworking layer correctly maps to the OSI Network layer, making the Data Link mapping in the correct option fundamentally incorrect. When tackling model questions, always assume OSI is the default focus unless the question specifically calls out the TCP/IP or DARPA model.

Correct answer: C. C) Switch

A switch operates at Layer 2 and makes forwarding decisions based on the 48-bit Media Access Control address found in Ethernet frames. Routers and firewalls function at higher layers using IP addresses, while a simple hub just repeats physical signals to all ports.

Correct answer: B. B) TTL

The Time to Live field in the IPv4 header is decremented by each router, ensuring packets are dropped if a routing loop occurs. Remember that Spanning Tree Protocol prevents Layer 2 loops, while the Time to Live field specifically protects Layer 3 routing.

Correct answer: B. B) 169.254.0.1

When a Windows client fails to reach a DHCP server, it assigns itself an Automatic Private IP Addressing address from the 169.254 range. A strong exam cue is to associate the 169.254 prefix directly with DHCP failures, completely ignoring standard private or loopback addresses.

Correct answer: C. C) Type 11

Traceroute relies on ICMP Type 11, which is the Time Exceeded message, to map router hops. Do not confuse this with Type 0 Echo Replies used by ping, or Type 3 Destination Unreachable errors.

Correct answer: A. A) SMTP

Port 587 is the modern submission port for SMTP, used by clients to send email securely. Port 25 is typically for server-to-server routing, while port 110 or 995 is used for retrieving email via POP3.

Correct answer: C. C) Source port

The source port is always the very first field in a TCP header. For the exam, remember that Time to Live is an IP header concept, while the window size and acknowledgement number appear later in the TCP header.

Correct answer: D. D) Link IP address to FQDN

A Pointer record links an IP address to a Fully Qualified Domain Name to support reverse DNS lookups. Address records perform the opposite function, resolving domain names to their respective IP addresses.

Correct answer: B. B) By ANDing the subnet mask with the IP address

ANDing the subnet mask with the IP address mathematically reveals the network ID by dropping the host portion. Relying on legacy IP class assignments is invalid today due to variable length subnet masking.

Correct answer: A. A) IEEE 802.15

The IEEE 802.15 standard defines Bluetooth, which operates in the 2.4 GHz frequency range for personal area networks. Do not confuse this with IEEE 802.11, which is the standard for standard Wi-Fi networks.

Correct answer: B. B) Serial number

The serial number in a Start of Authority record must be incremented each time a zone file is updated. This tells secondary DNS servers that new information is available and a zone transfer is required.

Correct answer: D. D) Ethernet

Ethernet adds a footer, known as the Frame Check Sequence, to the end of a payload during encapsulation to verify data integrity. Other common protocols like IP and TCP only use headers and lack this trailer.

Correct answer: C. C) Physical and Data link layers

Local Area Network protocols like Ethernet operate at the Physical and Data Link layers of the OSI model. Remember that these bottom two layers handle physical connectivity and local hardware addressing.

Correct answer: D. D) To prevent further damage

Containment is performed before recovery to isolate affected systems and prevent further damage to the network. Identifying systems happens earlier, while evidence preservation is a forensic concern, not the primary containment goal.

Correct answer: D. D) Internet isolation

RFC 1918 provides private IP addresses that are not routed across the public Internet, giving an organization natural internet isolation. For the exam, remember that private addressing inherently blocks inbound external traffic, though NAT is still required for outbound connectivity.

Correct answer: B. B) 173.194.200.138

Only the 173.194.200.138 address falls outside the RFC 1918 private ranges, making it a valid public IP address. A strong exam cue is to immediately eliminate any option starting with the ten, 172.16 to 172.31, or 192.168 private ranges.

Correct answer: C. C) Type

The Type field defines the primary function or purpose of an ICMP message. Watch out for Protocol Number or EtherType, because those belong to IP and Ethernet headers respectively, not ICMP.

Correct answer: D. D) The payload is UDP.

A Protocol Number of 17, which is 0x11 in hexadecimal, indicates that the IP payload is UDP. Remember that TCP is protocol 6, so a hex value of 0x06 would be required for the payload to be TCP.

Correct answer: B. B) Home automation

Zigbee is a low-power, low-bandwidth wireless standard designed primarily for home automation and sensor networks. It is not built for high-speed internet connectivity, which relies on technologies like LTE or Wi-Fi.

Correct answer: C. C) Nothing

Because UDP is connectionless, sending data to an open UDP port typically yields no protocol-level response. Remember that ICMP Type 3 Code 3 is only returned when attempting to reach a closed UDP port.

Correct answer: C. C) Whether the destination is in a remote subnet

ANDing the subnet mask with a destination IP address calculates the destination network ID. By comparing this to your local network ID, you immediately know if the target is local or on a remote subnet.

Correct answer: D. D) Subtract 64 bits from the UDP header length field value.

Subtracting 64 bits from the UDP length field calculates the payload size because the 8-byte header is always 64 bits. Remember that the UDP length field includes both the header and the payload, not just the payload itself.

Correct answer: B. B) It rides as the payload of an IP packet.

ICMP relies on riding as the payload of an IP packet, borrowing the necessary addressing from the IP header. A practical cue is that ICMP operates at Layer 3, meaning it completely avoids using Layer 4 ports or sessions.

Correct answer: A. A) Ping in order: loopback, local IP address, default gateway address, an internal LAN address, proxy/gateway internal address, proxy/gateway external address, then several Internet addresses.

Pinging destinations from local to remote allows you to pinpoint exactly where the communication path breaks. If you started from the outside in, you would struggle to isolate whether the failure is local or happening further down the route.

Correct answer: B. B) Network interface capacity

Network interface capacity is critical because a SAN relies on the network for storage traffic, which easily creates bottlenecks. While CPU cores matter, the combined load of client traffic and storage read and writes makes the network card the most likely choke point.

Correct answer: A. A) It reduced the size of routing tables.

CIDR was primarily adopted to reduce the size of core Internet routing tables by combining multiple subnets into a single route. Remember that Variable Length Subnet Masking actually initiated the move away from strict class-based subnetting.

Correct answer: C. C) There is no acknowledgement within a timeout period

A lack of an acknowledgement within a specific timeout period tells the sender to re-transmit the window. A failed checksum silently drops the packet, but it is the resulting timeout on the sender side that actually forces the retransmission.

Correct answer: A. A) All OSs need security management, no matter how they are hosted.

All operating systems need security management, whether they are physical or virtual, because virtualization does not provide inherent protection. Host and guest systems require independent patching and security controls, as host protections do not automatically secure the guests.

Correct answer: C. C) LAN

A Local Area Network is confined to a limited geographical area, such as a single building or campus. For the exam, remember that a Wide Area Network spans large distances, while a Virtual Private Network secures connections across existing networks.

Correct answer: C. C) Cost reduction

Consolidating multiple virtual machines onto fewer physical hosts directly lowers hardware, power, and cooling costs. While deployment might seem easier, managing hypervisors and avoiding a single point of failure actually adds complexity to the infrastructure.

Correct answer: D. D) ARP

When communicating with a distant subnet, Address Resolution Protocol resolves the MAC address of the local default gateway. Devices do not send ARP broadcasts across a router to find the remote destination's MAC address.

Correct answer: D. D) A bus is a series of node connections, while a star consists of connections from nodes to a center device.

A bus topology connects nodes in a series along a single backbone cable, while a star topology links nodes to a central device. Remember that a mesh topology provides direct node-to-node connections.

Correct answer: C. C) 802.11ac provides throughputs up to 1 Gbps.

Deploying 802.11ac provides gigabit throughput speeds, significantly faster than older 802.11g networks. As a practical exam cue, remember that 802.11ac operates strictly in the five gigahertz band, avoiding two point four gigahertz interference.

Correct answer: D. D) Multipath propagation

The multiple-input multiple-output modulation concept introduced by 802.11n uses multiple antennas to take advantage of multipath propagation. Instead of causing interference, bounced radio signals are tuned into unique transmission paths for faster data delivery.

Correct answer: B. B) DHCP leasing

The described four-step exchange represents the Discover, Offer, Request, and Acknowledgment sequence of a DHCP lease. If it were a TCP session establishment, you would only see a three-way handshake.

Correct answer: C. C) It checks with a root DNS server, the global TLD DNS server, and the authoritative server.

A caching DNS server resolves unknown queries by sequentially asking root, top-level domain, and authoritative servers. Checking the cache is always the first step, but the prompt specifies the server does not already know the answer.

Correct answer: A. A) By disabling the MAC filter

A sniffer captures all traffic by placing the network interface card into promiscuous mode, which effectively disables the MAC address filter. This allows the system to read all frames on the local network segment, even those addressed to other devices.

Correct answer: A. A) Bluesnarfing

Bluesnarfing is the specific attack used to unauthorizedly access and steal data from a Bluetooth-enabled device. Bluejacking is often confused here, but it merely sends unsolicited messages rather than extracting sensitive information.

Correct answer: C. C) Bare metal hypervisor

Bare metal hypervisors, or Type 1 hypervisors, are installed directly onto server hardware without a host operating system. This provides better performance and security for server deployments compared to Type 2 hosted hypervisors.

Correct answer: D. D) Potentially, each interface will have three addresses assigned in IPv6, while they have one address assigned in IPv4.

Under the original IPv6 specifications, an interface can hold multiple addresses simultaneously, such as link-local, site-local, and global addresses. Be mindful that modern IPv6 deployment often relies on standard DHCP, making this distinction heavily focused on theoretical specifications rather than modern practice.

Correct answer: C. C) By sending an Acknowledgement flagged TCP segment with the acknowledgement number field set to a value that is one increment higher than the last received segment's sequencing number

The receiver sends a TCP segment with the Acknowledgement flag set, using a value one increment higher than the last sequence number. This confirms successful receipt and prepares the connection for the next expected byte.

Correct answer: A. A) Snapshot

Snapshots provide a quick, live backup and restore mechanism for running virtual machines, allowing admins to revert to a stable state. Standard drive imaging takes too long and is typically used for traditional physical servers rather than active virtualization.

Correct answer: C. C) Platform independence and interoperability

The Point-to-Point Protocol is important because it provides platform independence and interoperability across diverse vendor systems. While it supports authentication protocols like CHAP, its universal connectivity remains its defining legacy.

Correct answer: B. B) A flood in the basement server room

A disaster recovery plan is triggered when mission-critical business functions are interrupted. A data breach is an incident, while flooding a server room threatens operations and invokes recovery procedures.

Correct answer: C. C) Installing and updating anti-virus software

Installing and updating anti-virus software is a preventative cost associated with malware management. Post-infection damages like network downtime and lost productivity are reactive costs, not preventative measures.

Correct answer: A. A) Employee comments

Employee comments are not a formal component of a security policy framework. Policies, standards, guidelines, and procedures are the core documents used to define and enforce an organization's security posture.

Correct answer: B. B) To prevent the spread of a violating event to other systems

The lessons learned phase focuses on documentation to improve future responses, train new team members, and support legal defense. Preventing an incident from spreading is the goal of the containment phase.

Correct answer: D. D) AAA verifies unique identities and then holds them accountable for their actions.

AAA frameworks are essential because they verify unique identities and hold users accountable for their actions. It does not inherently encrypt communications, which requires separate protocols like TLS.

Correct answer: C. C) Ports are kept open for nonessential services.

A vulnerability is a weakness that an attacker may discover and exploit. Open ports for nonessential services expand the attack surface, whereas malware and botnets represent threats or actors causing harm.

Correct answer: D. D) Control access to resources

Authorization controls access to resources based on the privileges granted to a verified user. Exam candidates must carefully distinguish this from authentication, which merely verifies identity, or accounting.

Correct answer: D. D) Eavesdropping on beacon frames

Eavesdropping on beacon frames allows devices to detect wireless networks broadcasting in the area. Ping sweeps and port scans require an existing network connection and cannot discover disconnected networks.

Correct answer: B. B) Strongly encourage workers to always follow company policy, regardless of what someone over the phone or via email demands.

Strongly encouraging workers to follow company policy reduces social engineering risks by preventing attackers from bypassing rules. Technical controls like encryption do little to stop an attacker manipulating human trust.

Correct answer: B. B) Training and awareness

Security vulnerabilities in personnel are most effectively addressed through ongoing security training and awareness programs. Technical controls like firewalls and encryption do not mitigate human weaknesses, so remember that human manipulation requires human-focused defenses.

Correct answer: B. B) It sets boundaries for allowed activities.

Authorization is important because it sets the specific boundaries for what activities an authenticated user is allowed to perform. Do not confuse this with authentication, which merely verifies identity, or auditing, which monitors actions after the fact.

Correct answer: C. C) DAC is decentralized.

Discretionary access control is decentralized because data owners manage permissions directly through access control lists on their objects. A strong exam cue is that mandatory access control is centralized and rigid, whereas discretionary access control distributes control.

Correct answer: B. B) It mimics the identity of a trusted WAP.

An evil twin attack is effective because it mimics the identity of a trusted wireless access point to trick devices into connecting. Clients automatically favor the strongest signal matching a saved profile, allowing the attacker to intercept traffic easily.

Correct answer: B. B) An untrained employee

An untrained employee should never collect evidence because they are likely to damage its integrity or break the chain of custody. Proper evidence handling requires forensically trained personnel to ensure the data remains admissible in legal proceedings.

Correct answer: B. B) nmap

Nmap is the standard network mapping tool used for port scanning, OS fingerprinting, and banner grabbing. Aircrack targets wireless encryption, while Cain and Abel focuses on password cracking.

Correct answer: B. B) Disconnecting systems from the Internet

Disconnecting systems typically happens during containment to isolate threats. The recovery phase focuses on restoring normal operations by applying patches, updating firmware, and validating authentication configurations.

Correct answer: C. C) Define the organization's security intentions and approach

A security policy defines an organization's security intentions and establishes its overall approach to protection. Punishing rule violators or preventing wasted resources might be beneficial outcomes, but they are not the primary purpose of the document.

Correct answer: D. D) SYN flood

A hexadecimal value of 0x02 translates to binary 00000010, indicating the TCP SYN flag is set, which represents a SYN flood. For the exam, remember how to map protocol header flags to hexadecimal values to identify network attacks quickly.

Correct answer: C. C) NTP synchronization logs

NTP synchronization logs are the least helpful because they primarily record time adjustments and rarely reveal direct attack evidence. In contrast, server, DHCP, and IDS logs provide critical context linking malicious activities to specific IP addresses and systems.

Correct answer: C. C) Symmetric encryption

Symmetric encryption provides confidentiality by ensuring only authorized parties with the correct key can access the data. Hashing provides integrity, while redundant servers and periodic backups primarily protect system and data availability.

Correct answer: A. A) Compare before and after hash values.

You verify file integrity by comparing hash values generated before and after an event. Hashing detects unauthorized modifications, whereas backups restore damaged files and digital envelopes focus on securing data confidentiality.

Correct answer: D. D) Corrupt an adversary's ability to act in their own interest

The primary offensive goal of information warfare is to corrupt an adversary's ability to make effective decisions and act in their own interest. A practical exam cue is to focus on the broad objective of decision disruption, whereas reconnaissance is merely a preparatory step.

Correct answer: C. C) Identify the violating activity

An incident response team can only handle an incident after the violating activity has been identified. Detection and identification are absolute prerequisites, whereas patching systems or notifying customers are subsequent actions taken during later recovery phases.

Correct answer: C. C) Taking advantage of social engineering

Malware increasingly bypasses technical security improvements by taking advantage of social engineering tactics. Attackers exploit human trust and curiosity because people are often the weakest link, making user training a critical defensive control.

Correct answer: C. C) When company policy is violated and business tasks are affected

Internal incident response is triggered when policy violations impact business tasks. Automated defenses handle routine scanning or guessing attacks, and law enforcement handles criminal events.

Correct answer: A. A) Denial of service

Denial of service directly violates availability by preventing legitimate access to resources. Disclosure and leakage violate confidentiality, while corruption violates data integrity.

Correct answer: D. D) User identity

Discretionary access control bases permissions directly on user identity or group membership. Object classification is used for mandatory access control, while job roles define role-based access control.

Correct answer: A. A) A security policy should be defined once and then enforced for at least a decade.

Security policies must remain flexible and be updated regularly as threats change, so decade-long enforcement is false. Policies require management support and universal compliance to maintain security effectively.

Correct answer: D. D) Software that causes unwanted harm, often automatically, once it infects a system

Malicious code is software that causes unwanted harm automatically once it infects a system. Remote control tools and password crackers are often classified as potentially unwanted programs rather than malware.

Correct answer: C. C) Minimize the number of open ports.

Minimizing open ports effectively defends against port scanning by reducing the attack surface. Host intrusion detection systems only alert on scanning activity, and multi-factor authentication prevents unauthorized access.

Correct answer: D. D) MAC

Mandatory access control is required because it enforces clearance labels and need-to-know compartmentalization typically seen in military environments. Discretionary access control is ruled out because it relies on data owners rather than strict system rules.

Correct answer: A. A) Offsite storage of backups

Offsite storage of backups is the most critical element because data cannot be recovered if all local copies are destroyed. Warm sites and clusters are useful for availability, but they are useless for data restoration without actual backups.

Correct answer: A. A) By performing a business impact analysis

A business impact analysis evaluates the consequences of disruptions to mission-critical processes during planning. Vulnerability scans and penetration tests are technical assessments, whereas continuity planning focuses on business risk and operational survival.

Correct answer: A. A) They grant ongoing undiscovered continued remote access to an IT infrastructure.

Advanced persistent threats grant attackers ongoing undiscovered remote access, allowing them to quietly mine data over long periods. Despite the name, they do not always cause immediate downtime and are not necessarily the most sophisticated attacks.

Correct answer: B. B) Immediately upon discovery

Law enforcement must be contacted immediately upon discovering a likely crime to ensure proper forensic collection of court-admissible evidence. Waiting until after containment or eradication risks contaminating the scene and destroying evidence.

Correct answer: B. B) To maintain availability

A business continuity plan is essential because it maintains the availability of mission-critical processes during a disruptive event. It focuses on keeping the business running rather than directly protecting confidentiality or reducing operational costs.

Correct answer: A. A) Reconnaissance

Reconnaissance is always the first step of an attack, allowing adversaries to gather preliminary information about the target. Enumeration happens later alongside scanning, while clearing tracks and pilfering data occur after a breach is successful.

Correct answer: B. B) Authentication

Authentication proves identity, and multi-factor authentication makes impersonation much harder. Accounting tracks and logs actions, but strong authentication is the specific mechanism that requires multiple elements and reliably ensures the correct individual is held accountable.

Correct answer: A. A) Business impact analysis

A business impact analysis evaluates risks by focusing on how threats affect critical business tasks rather than individual assets. Threat modeling is closely related, but business impact analysis specifically guides business continuity and disaster recovery planning.

Correct answer: A. A) Radio waves can still be detected. · D. D) Other management frames contain the SSID.

Disabling the SSID broadcast fails because radio waves remain physically detectable and probe responses leak the SSID. Hiding the network name only inconveniences users, as attackers can easily extract it from other wireless management frames.

Correct answer: C. C) Expanded preparedness, including attack analysis, vulnerability research, and response drills

Expanded preparedness through training, vulnerability research, and drills directly improves incident response before an event happens. Post-mortem reviews are valuable, but they occur after an incident, making preparation the correct proactive step.

Correct answer: A. A) They may satisfy due care and due diligence.

Security policies demonstrate that an organization meets legal standards for due care and due diligence. They do not guarantee breach prevention, and simply spending money or logging events does not legally prove proper security practices were followed.

Correct answer: D. D) Educate users.

An incident response team focuses on preventing, detecting, and responding to violations, not educating users. Security awareness training is a critical security management responsibility, but it falls outside the core incident handling lifecycle.

Correct answer: C. C) shadow

Linux and Unix systems store password hashes in the restricted shadow file to protect them from unauthorized access. The passwd file is readable by all users, so it only stores basic account details while omitting the actual hashes.

Correct answer: C. C) Alter user behaviors.

Altering risky user behaviors is the most effective way to reduce malware infections, especially against zero-day threats. Technical controls like encryption or authentication cannot stop malware if a user is tricked into executing it.

Correct answer: D. D) A job label is placed on the user account.

Role-based access control assigns access privileges by placing a job or role label on a user account. This differs from discretionary control, which uses object-level lists, and mandatory control, which assigns security classifications.

Correct answer: A. A) Kerberos

Kerberos is a widely used single sign-on technology that allows users to authenticate once and access multiple services. Certificates and biometrics are individual authentication factors, while access control lists handle authorization.

Correct answer: C. C) Enable WPA-2.

Enabling strong encryption like WPA2 or WPA3 provides the best defense against wireless intrusions. Other measures like MAC filtering or disabling SSID broadcasts offer minimal protection against determined attackers.

Correct answer: B. B) Lessons learned · C. C) Eradication

The original answer keys eradication for removing offending elements like malicious accounts. However, disabling an active account to stop an attack in progress is a textbook containment action. The ambiguous wording makes containment an equally defensible correct answer on the exam.

Correct answer: B. B) Through user activities

Viruses generally propagate through user activities, requiring a host file to be executed. Worms distinguish themselves by self-replicating across networks, and Trojans trick users with benign facades.

Correct answer: B. B) Flattening an organization's hierarchical authority structure

Flattening hierarchical authority is considered the most critical but impractical defense against information warfare because rigid structures collapse if leadership is targeted. For the exam, associate distributed backups and encryption with standard best practices rather than difficult organizational shifts.

Correct answer: C. C) It reduces the potential for impersonation.

Multifactor authentication reduces impersonation risk by forcing attackers to compromise multiple independent authentication factors. It does not inherently prevent data loss or verify accuracy, as those are handled by access controls and hashing.

Correct answer: A. A) Submitting scripted input using meta-characters

Submitting scripted input using meta-characters can alter server-side execution, leading to arbitrary code execution in injection attacks. Pharming and hidden form field manipulation redirect users or alter client-side data without executing code.

Correct answer: A. A) Asymmetric investment vs result

Information warfare is concerning because attackers can cause massive damage with very little investment. Standardized languages and operating systems might make targets easier to understand, but the primary concern remains the highly asymmetric ratio between cost and result.

Correct answer: D. D) Predictable TCP sequence values

The Mitnick-Shimomura attack exploited predictable TCP sequence numbers to hijack a trusted session. Memorizing historical attacks is crucial for the exam, even though modern operating systems now generate sequence numbers randomly to prevent spoofing.

Correct answer: A. A) Follow standard forensic procedures.

Following standard forensic procedures ensures evidence integrity and admissibility in court. Merely copying logs without hashing or improperly imaging drives breaks the chain of custody, making the evidence unusable during legal proceedings.

Correct answer: F. F) Sophistication level: Advanced · G. G) Maturity: Simple, easily accessed tools and not necessarily targeted · H. H) Maturity: Technically mature and developed by advanced hackers

DDoS attacks represent an advanced sophistication level within information warfare, utilizing technically mature tools developed by experienced hackers. Basic levels involve script kiddies, while top levels are advanced persistent threats.

Correct answer: C. C) Workgroup clients

Domain user accounts are strictly managed by Active Directory, meaning they can only authenticate to systems within their own domain or a trusted domain. Workgroups operate as decentralized peer-to-peer networks without a central directory, so domain credentials are completely invalid there.

Correct answer: C. C) It helps detect abnormalities.

Establishing a system baseline defines what normal network or system performance looks like, which is critical for identifying anomalies and potential security incidents. Administrators set warning thresholds based on deviations from this baseline, but baselining itself does not automatically prevent system downtime.

Correct answer: B. B) Altering the authorization of user groups on shared resources

Auditing strictly involves monitoring, recording, and analyzing system activity to ensure security compliance. Altering user authorizations is an active system administration task that should be monitored by an audit trail, but it is not an auditing function itself.

Correct answer: C. C) Open the Shared Folders utility from Computer Management. · D. D) Open a command prompt, and type net share.

Administrative and hidden shares are not visible through standard network browsing or the Run dialog. To view these specific shares, administrators must use command-line utilities like net share or the Shared Folders management console.

Correct answer: A. A) It has knowledge of what constitutes legitimate communications.

Stateful inspection tracks the state of network connections, allowing the firewall to distinguish between legitimate traffic and malicious packets like unsolicited scans. Static packet filtering handles basic IP and port blocking, but lacks this connection awareness.

Correct answer: A. A) Scanning and enumeration

Scanning and enumeration actively probe a target network to map live IP addresses and discover open ports. Information gathering focuses on passive reconnaissance, while gaining and maintaining access occur after vulnerabilities are identified.

Correct answer: A. A) Transport mode VPN

Transport mode VPNs encrypt the payload but leave original IP headers visible. Use tunnel mode to encapsulate the original header and hide internal addresses during transmission.

Correct answer: C. C) After testing

Patches must be installed only after thorough testing to prevent production downtime. Installing immediately upon release risks breaking systems if compatibility issues exist.

Correct answer: D. D) Users

Users is not a default Windows event log. Remember the classic triad of system, security, and application logs when analyzing Windows auditing and troubleshooting.

Correct answer: D. D) Configuring your system to auto-logon after booting

Configuring a system to auto-logon defeats the protection provided by full disk encryption. Once the system boots automatically, the decryption key is exposed to the logged-in account.

Correct answer: C. C) Salting

The NTLMv2 hashing algorithm does not use salting. Salting appends random values to passwords before hashing to mask duplicates, making cracking attacks significantly harder.

Correct answer: C. C) One

A hotfix is specifically designed to address only a single issue. Since hotfixes undergo less rigorous testing, it is generally recommended to wait for a fully tested cumulative update.

Correct answer: D. D) To be notified automatically of issues concerning products under their management

Administrators subscribe to these bulletins to receive automatic notifications about critical issues affecting their managed products. This timely information is vital for protecting infrastructure from compromise.

Correct answer: C. C) Set an SACL on each Registry key to be monitored.

You must set a System Access Control List on each specific Registry key to be monitored. Simply enabling the master Audit Policy setting is insufficient without configuring the target objects.

Correct answer: A. A) WSUS

Windows Server Update Services provides the exact enterprise patch management capabilities described. It downloads updates, allows internal approval, and distributes them to native clients. Tools like MBSA only scan.

Correct answer: A. A) A hierarchical collection of trusted domains

An Active Directory forest is defined as a hierarchical collection of trusted domains that share a common global catalog and schema. For the exam, remember that a tree is a series of linked domains sharing a contiguous namespace, while a forest links multiple trees together.

Correct answer: A. A) Block unauthorized executables

Software restriction policies improve security by blocking unauthorized executables from running, essentially acting as an application allow list. Do not confuse this with network firewalls, which filter application communications, or access control, which limits user permissions.

Correct answer: A. A) Start with implicit deny, accumulate allows, and subtract any denials.

NTFS effective permissions are calculated by starting with an implicit deny, accumulating all assigned allow permissions, and then explicitly subtracting any specific deny permissions. Remember this rule locally, but when accessing via network share, the most restrictive permission applies.

Correct answer: C. C) Centralized authentication

Active Directory is critically important because it provides centralized authentication and security policy enforcement across a network. Be careful not to confuse it with simple resource sharing protocols or network routing mechanisms.

Correct answer: A. A) Interruption of business tasks

Enterprises disable automatic updates because untested patches can interrupt critical business tasks or cause downtime. Remember the core security concept of patch management: always test updates in a staging environment before deployment.

Correct answer: B. B) Reverting password after account lockout

Reverting a password after an account lockout is not a valid feature of the Windows account lockout policy. The three main policy settings you need to know are account lockout duration, account lockout threshold, and resetting the lockout counter.

Correct answer: B. B) To reference the storage device hosting the operating system

The environmental variable percent SYSTEMDRIVE percent specifies the storage device hosting the Windows operating system. Administrators use these variables in scripts so they run correctly across multiple machines without hard-coding a specific drive letter.

Correct answer: B. B) XML

Internet Information Services natively supports W3C, IIS, NCSA, and custom logging formats, but it does not natively support XML logging. For the exam, memorize the specific built-in logging formats available in the IIS manager.

Correct answer: D. D) A network with the correct name of your employer, even though you are far away from the office

An attacker uses a rogue access point with a trusted network name to create an evil twin and steal your data. You should avoid connecting to a familiar network name when you are physically too far away from the legitimate office.

Correct answer: D. D) Users have a tendency to pick poor passwords even after training.

Users often pick poor passwords or revert to bad habits despite receiving comprehensive security awareness training. Technical enforcement through a password policy is required to guarantee minimum length and complexity requirements.

Correct answer: B. B) SMB

Windows uses the Server Message Block protocol for file and print sharing operations across a network. TCP/IP is the underlying transport suite, while DHCP handles dynamic IP addressing rather than managing shared resources.

Correct answer: C. C) Perform a device driver rollback

Performing a device driver rollback is the fastest way to uninstall the faulty driver and restore the previous working version. System Restore points or full backups might alter unrelated system settings, so always try the simplest component fix.

Correct answer: A. A) Reduce the number of attack points

Securely managing default services reduces the attack surface by disabling unnecessary components. This system hardening practice eliminates potential attack vectors. Improved boot times or reduced latency are secondary benefits, not the core security goal.

Correct answer: A. A) OSPF

OSPF is a link-state routing protocol, not a virtual private network protocol. Windows supports VPN protocols like SSTP, L2TP, and PPTP. Associate routing protocols with traffic path selection rather than secure tunnel creation.

Correct answer: A. A) Using the Task Scheduler GUI utility. · C. C) Executing the schtasks.exe command.

Modern Windows systems use the Task Scheduler graphical utility and the schtasks command line tool to schedule periodic tasks. The AT command is deprecated and removed from current versions, making it an incorrect choice for modern systems.

Correct answer: D. D) SPAN port

Network intrusion detection systems must see all traffic to function effectively, so connecting to a switch SPAN or mirror port is essential. Without port mirroring, the switch isolates traffic, and the sensor remains blind to most network activity.

Correct answer: D. D) Preventing unknown attacks

Honeypots are decoy systems designed to detect attacks and gather threat intelligence, but they do not prevent traffic from reaching their targets. Firewalls and intrusion prevention systems are responsible for blocking malicious network traffic.

Correct answer: C. C) type

The type command reveals command types and locations rather than file contents. For the exam, remember tail, more, and awk parse text; type does not.

Correct answer: A. A) Use the apt-get upgrade command. · C. C) Use the yum tool.

The yum and apt-get upgrade commands efficiently install software patches on Linux. Avoid reinstalling the OS or booting from disks, as updates must occur within the running system.

Correct answer: A. A) Daily full

Daily full backups ensure the most efficient restoration by requiring only one media set. While incremental backups take less time, they complicate restores.

Correct answer: A. A) The Audit object access event is not enabled.

You must enable Audit Object Access in Windows policy for file logs to appear. Simply configuring NTFS permissions is insufficient, as auditing is disabled by default.

Correct answer: A. A) Internet zone

Safe public websites are automatically categorized into the Internet zone. The Intranet zone is reserved for local network resources, while Trusted Sites require manual addition by the user.

Correct answer: B. B) Configure a system with a security template. · D. D) Analyze a system in comparison to a security template.

The SECEDIT command is used to configure a system with a security template or analyze it against one. Remember that SECEDIT operates locally and cannot extract templates across a network.

Correct answer: A. A) They can be applied to a system to configure it · B. B) They can be used to compare against a configured system to detect differences · C. C) They can be extracted from manually configured systems

Security templates are useful because they can be applied to configure a system, used to compare against existing configurations, and extracted from manually set systems. They cannot quickly set object permissions.

Correct answer: A. A) Inbound TCP port 3389 connections are not allowed on the company network.

The inbound TCP port 3389 connections used by RDP are likely blocked by the company network firewall. Private networks typically block inbound connection initiations from the public internet.

Correct answer: A. A) Filter based on packet content

Windows Firewall is a stateful packet filter, so it cannot inspect application layer payload content. For the exam, remember it filters traffic by port and IP address, and logs both successful connections and dropped packets.

Correct answer: C. C) A smart card with a 6-digit PIN

A smart card combined with a personal identification number provides secure multi-factor authentication, requiring both possession and knowledge. Remember that multi-factor authentication is always preferred over any single-factor method like a password or biometric alone.

Correct answer: A. A) A service pack is a single install of well-tested updates.

A service pack is a single, well-tested installation package that bundles many updates together. Relying on individual hotfixes is inefficient because each one addresses a single issue and may require a separate reboot.

Correct answer: D. D) System/hardware

System or hardware is not a valid selectable identity for granting resource permissions in Windows. Valid options include built-in groups like Authenticated Users, Everyone, and Anonymous Logon, which are used to manage access control lists.

Correct answer: D. D) Broadcast

Broadcast is a networking concept, not a standard Windows user group category. The standard group scopes in Windows are Local, Global, and Universal, which are essential for managing permissions and group nesting strategies.

Correct answer: A. A) Disable unnecessary services. · B. B) Configure specific registry values. · C. C) Design system role-specific security settings. · D. D) Create, edit, apply, and roll back a security policy.

The Security Configuration Wizard handles all these tasks by creating policies that disable services and tweak registry values. It generates an XML policy file, which is distinct from standard INF security templates, to manage role-based settings.

Correct answer: C. C) Being able to print to a network printer

Printing to a network printer is an object permission, not a system-wide user right. User rights govern logon abilities and system-level privileges like changing the system time or backing up files, which are assigned through local policies.

Correct answer: B. B) Local, Site, Domain, Organizational Unit

Group Policy objects are applied in the order of Local, Site, Domain, and Organizational Unit. Because policies applied last take precedence, Organizational Unit settings overwrite earlier ones. Use the LSDOU mnemonic to easily recall this processing order on the exam.

Correct answer: A. A) Using IPSec policies

Windows systems are configured for specific IPsec connections using IPsec policies. These policies determine how traffic is filtered and secured. Watch for distractors like configuration files, as IPsec relies entirely on defined policies.

Correct answer: D. D) Ticket-granting ticket

A ticket-granting ticket is issued after successful authentication to the Kerberos Key Distribution Center. The user submits this ticket to request service tickets for specific resources. Avoid confusing this with generic access tokens or web session cookies.

Correct answer: B. B) To protect against unauthorized resource access

These controls combine to protect against unauthorized resource access. Encryption secures data at rest and in transit, while multi-factor authentication validates user identities. None of these measures directly prevent malware infections or stop denial of service attacks.

Correct answer: B. B) A collection of registry settings used to enforce security and function

Windows group policy is a collection of registry settings used to enforce security and functionality across systems. It pushes centralized configurations to users and computers. Do not confuse group policy with organizational access guidelines or group membership rules.

Correct answer: A. A) LKGC

Last Known Good Configuration restores the registry to its state after the last successful login, offering a single recovery chance before a new logon overwrites it. System restore points and driver rollbacks can be used repeatedly, regardless of recent login events.

Correct answer: A. A) When there are ten or more systems

Microsoft recommends migrating from a workgroup to a client/server domain model once a network reaches about ten systems due to management overhead. At this scale, decentralized local user accounts become difficult to secure and manage efficiently.

Correct answer: B. B) It creates backups of system components.

Restore points snapshot system components like drivers and registries. Do not rely on them for user data backups or full system recovery after catastrophic loss.

Correct answer: D. D) Encrypt all communications.

Encrypting all communications protects data in transit between the web server and clients. Transport Layer Security prevents eavesdropping and modification of network payloads. Requiring longer passwords helps, but fails to secure the overall transmission channel.

Correct answer: D. D) Implement a single sign-on (SSO) policy.

Implementing single sign-on to allow internal credentials for external public access is not necessary and introduces risk. Internal credentials should remain separate from public-facing services. Defense in depth, patching, and strict authentication remain critical.

Correct answer: C. C) Something that can cause harm to an asset

The correct answer works because a threat is defined as any potential danger that can cause harm to an asset. For the exam, remember that a vulnerability is a weakness, while risk is the likelihood that a threat will exploit that weakness.

Correct answer: D. D) Social engineering

The correct answer works because social engineering targets human vulnerabilities to gain access to systems, information, or physical spaces. Technical attacks like buffer overflows or SQL injection focus on software flaws and rarely grant physical entry.

Correct answer: B. B) Scanning devices can be fooled.

The correct answer works because biometric scanning devices can often be fooled by false versions of a body part. Therefore, relying on biometrics as the sole authentication factor is risky without combining it with additional factors like passwords or tokens.

Correct answer: A. A) Implement defense in-depth.

The correct answer works because implementing defense in depth uses multiple overlapping security controls to protect assets. If one mechanism fails or is compromised, the remaining layers continue to provide protection against the attacker.

Correct answer: A. A) Authorization and defining security protection needs

The correct answer works because defining data classification establishes who is authorized to access information and determines its specific security protection needs. Classification is fundamentally an authorization mechanism, not an authentication or auditing tool.

Correct answer: A. A) Reporting suspicious activity

The correct answer works because reporting suspicious activity is a universal responsibility assigned to all workers within an organization. Technical tasks like backing up servers or configuring encryption are delegated to specific administrative roles.

Correct answer: D. D) pass

The correct answer works because the pass action in a Snort rule explicitly tells the intrusion detection system to ignore matching packets. This prevents unwanted alerts when analyzing benign traffic that might otherwise trigger a rule.

Correct answer: A. A) chmod

The correct answer works because the chmod command is used to modify file mode bits, which control read, write, and execute permissions. Other commands like chown and chgrp only change file ownership or group association.

Correct answer: D. D) It includes recommended best practices for setting up and securing a Linux system.

The correct answer works because CIS Benchmarks provide established configuration baselines and recommended best practices for securely setting up systems. They focus on hardening operating systems against known vulnerabilities rather than improving performance.

Correct answer: C. C) root

The root account is the most powerful default account in Linux, holding complete administrative control over the entire system. A quick exam tip is to associate root with Linux, while the administrator account belongs to Windows environments.

Correct answer: D. D) View the contents of the /var/log/secure file.

Viewing the /var/log/secure file reveals authentication events, including failed logon attempts that indicate credential attacks. For the exam, remember that secure or auth logs are the primary sources for verifying login failures, whereas cron logs track scheduled tasks.

Correct answer: D. D) VFS

The virtual file system, or VFS, enables Linux to support a wide range of file system formats by providing a standard interface. Avoid confusing this with SMB, which is used for sharing network resources rather than managing local storage compatibility.

Correct answer: B. B) To be guided through a systematic security evaluation and hardening process

Bastille Linux guides administrators through a systematic security evaluation and hardening process rather than automatically applying settings. Do not confuse this with robust firewalls or web servers, as Bastille focuses primarily on interactive system configuration improvements.

Correct answer: C. C) To add modern, complex, multi-factor authentication options to Linux

Pluggable authentication modules, or PAM, add modern authentication options like multi-factor support to Linux. PAM does not modify password hashes or relocate them to the shadow file, it integrates advanced authentication mechanisms into the system.

Correct answer: B. B) Use the mount command.

The mount command connects a newly attached storage device to the file system, making it accessible to users. Remember that newly attached devices appear in the dev folder but remain inaccessible until properly mounted.

Correct answer: D. D) Modify the configuration files.

Modifying configuration files is the standard method to alter the operation of programs and services in Linux. Unlike Windows, Linux does not use a centralized registry, relying instead on individual text files for customization.

Correct answer: C. C) passwd

The passwd command allows administrators to set or change user passwords in Linux. Avoid confusing this with the Windows command net user or group management tools, as passwd is the native Linux utility for account credentials.

Correct answer: C. C) xkill

The xkill command allows users to terminate unresponsive graphical programs by changing the cursor into a crosshair to click and close the targeted window. Process viewers like top only display information and do not directly terminate applications.

Correct answer: C. C) Promptly test patches before installing approved updates onto systems.

The most reliable patch management approach is to test updates promptly before deployment to prevent unexpected downtime. Installing patches blindly risks system instability, while waiting for an actual breach causes unnecessary exposure.

Correct answer: B. B) Creating regular backups

Creating regular backups is a security best practice and does not cause system compromise. Actual causes of compromise include unpatched vulnerabilities, leftover default accounts, and installing software from untrusted repositories.

Correct answer: A. A) systemd-analyze blame

The systemd-analyze blame command displays the initialization time for each service during the boot process. This helps administrators identify and optimize slow services, whereas systemctl commands manage active units.

Correct answer: B. B) useradd

Useradd is correct because it directly creates a new user account in Linux. A common exam trap is choosing a fictional command like mkuser, whereas users only displays active login sessions and fuser identifies processes using files.

Correct answer: B. B) FreeBSD

FreeBSD is correct because it is a Unix-derived operating system, not a Linux distribution. While they share similarities, Linux distributions like Ubuntu and Fedora use the Linux kernel rather than a BSD kernel.

Correct answer: D. D) export

Export is correct because it manages environment variables for child processes and has no backup functionality. Remember that native utilities like tar, cpio, and rsync are the standard command-line tools for creating archives or synchronizing data.

Correct answer: D. D) Use the groupadd command.

Groupadd is correct because this is the standard Linux command to create a new user group. Be careful not to confuse it with chgrp, which only changes group ownership of existing files, or fictional commands like mkgroup.

Correct answer: A. A) group · B. B) user

User and group are correct because every Linux file assigns permissions specifically to an owning user and an owning group. The operating system does not define ownership categories for devices or systems, making those options invalid distractors.

Correct answer: B. B) /var/log

Most system and application log files are stored in the /var/log directory. Remember that /var holds variable data like logs that grow over time, whereas /etc stores static configuration files.

Correct answer: C. C) Kernel-level implementation of mandatory access control

SELinux implements mandatory access control at the kernel level to enforce strict security policies. Unlike standard Linux discretionary access control, MAC restricts actions based on system-defined labels.

Correct answer: B. B) Ping sweeps use ICMP Type 8 to Type 0 interactions, which are unreliable.

The correct answer works because ping sweeps rely on ICMP, which is frequently blocked by firewalls, making it an unreliable detection method. Port scans probe thousands of TCP or UDP ports, significantly increasing the chances of eliciting a response from a live system.

Correct answer: B. B) SSH

Secure Shell, or SSH, functions as a secure remote terminal emulation tool and can tunnel traffic to protect other communications. The other tools listed do not provide encrypted terminal access, making SSH the clear choice.

Correct answer: B. B) They set a file to execute as if a different user triggered the execution.

The SUID and SGID special permissions allow a file to execute with the credentials of the file owner or group owner rather than the user running it. Distractors about creating users or changing ownership describe useradd and chown instead.

Correct answer: A. A) the /home directory

The /home directory is the default storage location for personal user folders and profile data in Linux. Administrators often confuse this with the /usr directory, which actually stores system-wide user programs and libraries.

Correct answer: B. B) To evaluate network connectivity

The mtr command combines the functionality of ping and traceroute into a single interface to evaluate network connectivity. This makes it an essential diagnostic tool for identifying exactly where packet loss occurs along a route.

Correct answer: D. D) To check system binaries for rootkit modification

The chkrootkit utility scans local system binaries to detect known rootkit modifications. It operates strictly as a detection tool, whereas commands like chmod manage file permissions or SUID assignments.

Correct answer: D. D) pgrep

The pgrep command looks up and displays the process ID when you provide the process name. The kill command requires this PID to terminate the process, making these tools frequent companions.

Correct answer: A. A) rsync

Rsync is the correct choice because it efficiently synchronizes and backs up files across a network while preserving permissions. For the exam, associate tcpd with TCP wrapper monitoring and mcopy with MS-DOS file copying, not network backups.

Correct answer: D. D) hash

The hash command is correct because it is a bash built-in for caching command paths, not calculating file hashes. Remember that tools like md5sum and shasum generate cryptographic hashes to verify file integrity.

Correct answer: C. C) syslog

Syslog is correct because forwarding logs to a remote central server protects them from local tampering or deletion. Avoid confusing log management with tools like Wireshark or Nmap, which are used for network traffic analysis and mapping.

Correct answer: C. C) compgen

Compgen is correct because this bash built-in lists all available commands, functions, and aliases for the current user. The other options are basic utilities for displaying memory, files, or disk space rather than shell commands.

Correct answer: A. A) Use a grep command to search the /var/log/auth.log file.

Using grep is correct because it extracts specific text patterns from files, making it ideal for quickly filtering relevant entries from large logs. Opening logs in an editor is inefficient compared to command-line searching.

Correct answer: D. D) dm-crypt

The dm-crypt subsystem provides native transparent block device encryption for Linux. For the exam, remember that df reports filesystem space, fsck checks filesystems, and parted manages partitions without providing encryption.

Correct answer: A. A) The file will have r, w, and x set for the owner, r and x for the group, and read for the world.

The octal value 754 sets permissions to read, write, and execute for the owner, read and execute for the group, and read for the world. A quick exam cue is treating each digit as the sum of read (4), write (2), and execute (1).

Correct answer: A. A) iptables

The iptables utility functions as the default command-line firewall for Linux, filtering network traffic based on defined rule chains. Distractors fail because fsck repairs filesystems, nc handles network connections, and busybox provides tools.

Correct answer: B. B) grep

The grep command searches text using regular expressions and does not directly monitor or manage system processes. On the exam, remember that top displays active processes, while kill terminates them by their ID.

Correct answer: D. D) Avoid installing new updates on production systems.

The most critical patching practice is never deploying new updates directly on production systems without prior testing. Always validate patches in a test environment first to prevent unexpected downtime or security regressions.

Correct answer: D. D) Set account lockout policy.

The passwd command manages passwords and aging policies but cannot configure account lockout thresholds. Linux achieves account lockout functionality natively through pluggable authentication modules, rather than the standard passwd utility.

Correct answer: D. D) Use the ifconfig command.

The ifconfig command displays IP addresses and subnet masks on Linux systems. While ipconfig is a Windows command, ifconfig is the classic Linux equivalent you need to know for the exam.

Correct answer: D. D) tcpdump

Tcpdump is a command-line packet analyzer that captures network traffic for sniffing purposes. While nmap and hping3 are used for network discovery and scanning, tcpdump specifically collects raw packets.

Correct answer: D. D) cls

The cls command is a Windows utility used to clear the screen, not a Linux command. The Linux equivalent is clear, while commands like ls and chmod are native to Linux systems.

Correct answer: D. D) It deletes all possible files.

Executing rm -rf / as root recursively deletes every file on the system, destroying the operating system. The rm command removes files, the dash r makes it recursive, and the slash targets root.

Correct answer: D. D) The current folder is not defined in the PATH environmental variable.

The current folder is typically excluded from the PATH environmental variable to prevent malicious scripts from running accidentally. Using the dot slash prefix explicitly tells the system to execute the file locally.

Correct answer: A. A) Have ownership of the file. · B. B) Be the root.

To modify file permissions using chmod, you must either be the file owner or have root privileges. Standard users cannot change permissions for files they do not own without proper authorization.

Correct answer: C. C) Define hard coded mappings of all domain names to 127.0.0.1 in the /etc/hosts file.

Hardcoding all domain names to the loopback IP address in the hosts file breaks name resolution and prevents normal network access. Setting the hostname, verifying memory, and configuring the timezone are standard post-installation tasks.

Correct answer: B. B) Use suid. · D. D) Use sudo.

Configuring sudo access and setting the SUID bit both allow a binary to run with root privileges without requiring the root password. Remember that chmod is used to change permissions, while run as is a Windows concept.

Correct answer: B. B) process <daemon> reset

The phrase process daemon reset is not a valid Linux command for managing services. Valid historical methods include using the service command or calling the init.d scripts directly with start or stop arguments.

Correct answer: A. A) Servers · B. B) Client portable computers · C. C) Smart phones · D. D) Smart TVs

Linux is a highly versatile kernel that runs on a vast array of hardware, including servers, laptops, smartphones, and smart TVs. For the exam, recognize that Linux is not limited to traditional desktop or server environments.