Question 1

At what layer of the OSI model do routers function on?

Accepted Answer

A)  4 
B)  3 
C)  1 
D)  5

Question 2

Scenario: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team. During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team's activities?

Accepted Answer

A)  Regular communication of incident status to executives 
B)  Preservation of information 
C)  Eradication of malware and system restoration 
D)  Determination of the attack source

Question 3

Terri works for a security consulting firm that is currently performing a penetration test on First National Bank in Tokyo. Terri's duties include bypassing firewalls and switches to gain access to the network. Terri sends an IP packet to one of the company's switches with ACK bit and the source address of her machine set. What is Terri trying to accomplish by sending this IP packet?

Accepted Answer

A)  Trick the switch into thinking it already has a session with Terri's computer 
B)  Poison the switch's MAC address table by flooding it with ACK bits 
C)  Crash the switch with a DoS attack since switches cannot send ACK bits 
D)  Enable tunneling feature on the switch

Question 4

Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?

Accepted Answer

A)  Implementation of business-enabling information security 
B)  Use within an organization to ensure compliance with laws and regulations 
C)  To enable organizations that adopt it to obtain certifications 
D)  Use within an organization to formulate security requirements and objectives

Question 5

Which of the following is considered one of the most frequent failures in project management?

Accepted Answer

A)  Overly restrictive management 
B)  Insufficient resources 
C)  Excessive personnel on project 
D)  Failure to meet project deadlines

Question 6

Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?

Accepted Answer

A)  Plan-Check-Do-Act 
B)  Plan-Select-Implement-Evaluate 
C)  Plan-Do-Check-Act 
D)  SCORE (Security Consensus Operational Readiness Evaluation)

Question 7

George is the network administrator of a large Internet company on the west coast. Per corporate policy, none of the employees in the company are allowed to use FTP or SFTP programs without obtaining approval from the IT department. Few managers are using SFTP program on their computers. Before talking to his boss, George wants to have some proof of their activity. George wants to use Ethereal to monitor network traffic, but only SFTP traffic to and from his network. What filter should George use in Ethereal?

Accepted Answer

A)  src port 23 and dst port 23 
B)  udp port 22 and host 172.16.28.1/24 
C)  net port 22 
D)  src port 22 and dst port 22

Question 8

When examining the log files from a Windows IIS Web Server, how often is a new log file created?

Accepted Answer

A)  the same log is used at all times 
B)  a new log file is created everyday 
C)  a new log file is created each week 
D)  a new log is created each time the Web Server is started

Question 9

The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong?

Accepted Answer

A)  Failed to identify all stakeholders and their needs 
B)  Deployed the encryption solution in an inadequate manner 
C)  Used 1024 bit encryption when 256 bit would have sufficed 
D)  Used hardware encryption instead of software encryption

Question 10

Credit card information, medical data, and government records are all examples of:

Accepted Answer

A)  None 
B)  Communications Information 
C)  Bodily Information 
D)  Confidential/Protected Information 
E)  Territorial Information

Question 11

The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization's

Accepted Answer

A)  Risk Management Program 
B)  Anti-Spam controls 
C)  Identity and Access Management Program 
D)  Security Awareness Program

Question 12

Study the log given below and answer the following question: Apr 24 14:46:46 [4663]: spp_portscan: portscan detected from 194.222.156.169 Apr 24 14:46:46 [4663]: IDS27/FIN Scan: 194.222.156.169:56693 -> 172.16.1.107:482 Apr 24 18:01:05 [4663]: IDS/DNS-version-query: 212.244.97.121:3485 -> 172.16.1.107:53 Apr 24 19:04:01 [4663]: IDS213/ftp-passwd-retrieval: 194.222.156.169:1425 -> 172.16.1.107:21 Apr 25 08:02:41 [5875]: spp_portscan: PORTSCAN DETECTED from 24.9.255.53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4499 -> 172.16.1.107:53 Apr 25 02:08:07 [5875]: IDS277/DNS-version-query: 63.226.81.13:4630 -> 172.16.1.101:53 Apr 25 02:38:17 [5875]: IDS/RPC-rpcinfo-query: 212.251.1.94:642 -> 172.16.1.107:111 Apr 25 19:37:32 [5875]: IDS230/web-cgi-space-wildcard: 198.173.35.164:4221 -> 172.16.1.107:80 Apr 26 05:45:12 [6283]: IDS212/dns-zone-transfer: 38.31.107.87:2291 -> 172.16.1.101:53 Apr 26 06:43:05 [6283]: IDS181/nops-x86: 63.226.81.13:1351 -> 172.16.1.107:53 Apr 26 06:44:25 victim7 PAM_pwdb[12509]: (login) session opened for user simple by (uid=0) Apr 26 06:44:36 victim7 PAM_pwdb[12521]: (su) session opened for user simon by simple(uid=506) Apr 26 06:45:34 [6283]: IDS175/socks-probe: 24.112.167.35:20 -> 172.16.1.107:1080 Apr 26 06:52:10 [6283]: IDS127/telnet-login-incorrect: 172.16.1.107:23 -> 213.28.22.189:4558 Precautionary measures to prevent this attack would include writing firewall rules. Of these firewall rules, which among the following would be appropriate?

Accepted Answer

A)  Disallow UDP53 in from outside to DNS server 
B)  Allow UDP53 in from DNS server to outside 
C)  Disallow TCP53 in from secondaries or ISP server to DNS server 
D)  Block all UDP traffic

Question 13

Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?

Accepted Answer

A)  Risk Assessment 
B)  Risk Management 
C)  Vulnerability Assessment 
D)  System Testing

Question 14

A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?

Accepted Answer

A)  Information Technology Infrastructure Library (ITIL) 
B)  National Institute for Standards and technology (NIST) standard 
C)  International Organization for Standardization (ISO) standards 
D)  Payment Card Industry Data Security Standards (PCI-DSS)

Question 15

Which of the following is the MOST effective way to measure the effectiveness of security controls on a perimeter network?

Accepted Answer

A)  Perform a vulnerability scan of the network 
B)  Internal Firewall ruleset reviews 
C)  Implement network intrusion prevention systems 
D)  External penetration testing by a qualified third party

Question 16

Which of the following is true regarding expenditures?

Accepted Answer

A)  Capital expenditures are never taxable 
B)  Operating expenditures are for acquiring assets, capital expenditures are for support costs of that asset 
C)  Capital expenditures are used to define depreciation tables of intangible assets 
D)  Capital expenditures are for acquiring assets, whereas operating expenditures are for support costs of that asset

Question 17

What type of attack occurs when an attacker can force a router to stop forwarding packets by flooding the router with many open connections simultaneously so that all the hosts behind the router are effectively disabled?

Accepted Answer

A)  digital attack 
B)  denial of service 
C)  physical attack 
D)  ARP redirect

Question 18

You are working as a Computer forensics investigator for a corporation on a computer abuse case. You discover evidence that shows the subject of your investigation is also embezzling money from the company. The company CEO and the corporate legal counsel advise you to contact law enforcement and provide them with the evidence that you have found. The law enforcement officer that responds requests that you put a network sniffer on your network and monitor all traffic to the subject's computer. You inform the officer that you will not be able to comply with that request because doing so would:

Accepted Answer

A)  Violate your contract 
B)  Cause network congestion 
C)  Make you an agent of law enforcement 
D)  Write information to the subject's hard drive

Question 19

Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server. What action should you take FIRST?

Accepted Answer

A)  Consult with other C-Level executives to develop an action plan 
B)  Contract with a credit reporting company for paid monitoring services for affected customers 
C)  Contact your local law enforcement agency 
D)  Destroy the repository of stolen data

Question 20

What are the three stages of an identity and access management system?

Accepted Answer

A)  Authentication, Authorize, Validation 
B)  Provision, Administration, Enforcement 
C)  Administration, Validation, Protect 
D)  Provision, Administration, Authentication

Exam 2: Certified Network Defender