Question 1

You have determined that the company Web server has several vulnerabilities, including a buffer overflow that has resulted in an attack. The Web server uses PHP and has direct connections to an Oracle database server. It also uses many CGI scripts. Which of the following is the most effective way to respond to this attack?

Accepted Answer

A)  Installing software updates for the Web server daemon 
B)  Using the POST method instead of the GET method for a Web form 
C)  Installing an intrusion detection service to monitor logins 
D)  Using the GET method instead of the POST method for a Web form

Question 2

You have implemented a service on a Linux system that allows a user to read and edit resources. What is the function of this service?

Accepted Answer

A)  Authentication 
B)  Data integrity 
C)  Access control 
D)  Intrusion detection

Question 3

Consider the following diagram:  Which type of attack is occurring?

Accepted Answer

A)  Polymorphic virus-based attack 
B)  Denial-of-service attack 
C)  Distributed denial-of-service attack 
D)  Man-in-the-middle attack using a packet sniffer

Question 4

You want to create a quick solution that allows you to obtain real-time login information for the administrative account on an LDAP server that you feel may become a target. Which of the following will accomplish this goal?

Accepted Answer

A)  Reinstall the LDAP service on the server so that it is updated and more secure. 
B)  Install an application that creates checksums of the contents on the hard disk. 
C)  Create a login script for the administrative account that records logins to a separate server. 
D)  Create a dummy administrator account on the system so that a potential hacker is distracted from the real login account.

Question 5

A security breach has occurred involving the company e-commerce server. Customer credit card data has been released to unauthorized third parties. Which of the following lists the appropriate parties to inform?

Accepted Answer

A)  Shareholders, law enforcement agencies and company employees 
B)  Affected customers, credit card companies and law enforcement agencies 
C)  The Internet Service Provider, ICANN and company shareholders 
D)  External security consultants, company board members and affected customers

Question 6

A new video conferencing device has been installed on the network. You have been assigned to troubleshoot a connectivity problem between remote workers and the central company. Specifically, remote workers are having problems making any connection at all. Which technique will most likely help you solve this problem while retaining the existing level of security at the firewall?

Accepted Answer

A)  Deny all use of UDP above Port 1024. 
B)  Configure the firewall to provide VPN access. 
C)  Configure a second network connection directly to the video conferencing device. 
D)  Allow all use of UDP below Port 1024.

Question 7

What is the primary strength of symmetric-key encryption?

Accepted Answer

A)  It allows easy and secure exchange of the secret key. 
B)  It creates a ash?of a text, enabling data integrity.It creates a ?ash?of a text, enabling data integrity. 
C)  It can encrypt large amounts of data very quickly. 
D)  It provides non-repudiation services more efficiently than asymmetric-key encryption.

Question 8

A security breach has occurred in which a third party was able to obtain and misuse legitimate authentication information. After investigation, you determined that the specific cause for the breach was that end users have been placing their passwords underneath their keyboards. Which step will best help you resolve this problem?

Accepted Answer

A)  Discipline specific end users as object lessons to the rest of the staff and reset passwords on all systems immediately. 
B)  Change all passwords on the company servers immediately and inform end users that their passwords will be changing on a regular basis. 
C)  Set passwords to expire at specific intervals and establish mandatory continual training sessions. 
D)  Inform end users that their passwords will be changing on a regular basis and require more complex passwords.

Exam 4: CIW v5 Security Essentials

You have implemented a service on a Linux system that allows a user to read and edit resources. What is the function of this service?

Consider the following diagram: Which type of attack is occurring?

You want to create a quick solution that allows you to obtain real-time login information for the administrative account on an LDAP server that you feel may become a target. Which of the following will accomplish this goal?

A security breach has occurred involving the company e-commerce server. Customer credit card data has been released to unauthorized third parties. Which of the following lists the appropriate parties to inform?

What is the primary strength of symmetric-key encryption?