Security+ Certification Questions:



Security+ Certification Questions

Chapter 6: Host Hardening

Identify non-essential services and protocols and know what actions to take to reduce the risks

of those services and protocols (3 questions)

QUESTION NO: 1

Which of the following represents the best method for securing a web browser?

A. Do not upgrade, as new versions tend to have more security flaws.

B. Disable any unused features of the web browser.

C. Connect to the Internet using only a VPN (Virtual Private Network) connection.

D. Implement a filtering policy for illegal, unknown and undesirable sites.

Answer: B

Explanation:

Features that make web surfing more exciting like: ActiveX, Java, JavaScript, CGI scripts, and

cookies all pose security concerns. Disabling them (which is as easy as setting your browser

security level to High) is the best method of securing a web browser, since its simple, secure, and

within every users reach.

Incorrect answers:

A: As newer versions one expects them to be better than the predecessors. However, this is not

the best method to secure a web browser.

C: VPN tunnels through the Internet to establish a link between two remote private networks.

However, these connections are not considered secure unless a tunneling protocol, such as PPTP,

and an encryption protocol, such as IPSec is used.

D: This does not represent the best method for securing a web browser.

QUESTION NO: 2

How many ports in TCP/IP (Transmission Control Protocol/Internet Protocol) are

vulnerable to being scanned, exploited, or attached?

A. 32

B. 1,024

C. 65,535

D. 16,777,216

Answer: C

Explanation:

Internet Control Message Protocol (ICMP) abuse and port scans represent known attack

signatures. The Ping utility uses ICMP and is often used as a probing utility prior to an attack or

may be the attack itself. If a host is being bombarded with ICMP echo requests or other ICMP

traffic, this behavior should set off the IDS. Port scans are a more devious form of

attack/reconnaissance used to discover information about a system. Port scanning is not an attack

but is often a precursor to such activity. Port scans can be sequential, starting with port 1 and

scanning to port 65535, or random. A knowledge-based IDS should recognize either type of scan

and send an alert.

QUESTION NO: 3

Which of the following ports does a DNS (Domain Name Service) server require?

A. 21

B. 23

C. 53

D. 55

Answer: C

Explanation:

Port 53 is used for Domain Name System (DNS) Name Queries

Incorrect answers:

A: Ports 20 and 21 are associated with FTP, where 20 are used for file transfer data and 21 for

command and control data.

B: Telnet uses port 23.

D: DHCP makes use of port 55.

QUESTION NO: 4

For security purposes, which of the following should be implemented after installing a new

operating system?

A. Create application user accounts.

B. Rename the guest account.

C. Rename the administrator account, disable the guest accounts.

D. Create a secure administrator account.

Answer: C

Explanation:

Renaming the administrator account name and disabling the guest account will reduce the risk of

a computer being attacked, because administrator accounts typically have full rights to all

network resources.

Incorrect answers:

A: This can be done after application has been installed.

B: The guest account is not as vulnerable or exploitable as an administrator account.

D: Creating a secure administrator account is still an administrator account that can be exploited

if it is not renamed after installing a new operating system.

QUESTION NO: 9

Which of the following can limit exposure and vulnerability exposed by port scans?

A. Disable the ability to remotely scan the registry.

B. Leave all processes running for possible future use.

C. Close all programs or processes that use a UDP (User Datagram Protocol) or TCP

(Transmission Control Protocol) port.

D. Uninstall or disable any programs or processes that are not needed for the proper use of the

server.

Leading the way in IT testing and certification tools, testking.in

- 184 -

Answer: D

Explanation:

Hackers perform port scans to find out which of the 65,535 ports are being used in hope of

finding an application with a vulnerability. By uninstalling and disabling any program or

processes that aren't really necessary, one greatly reduces the likelihood of an attack.

Incorrect answers:

A, B and C: Disabling all the unnecessary programs and processes is the best way of

safeguarding yourself against vulnerabilities that can be exploited via port scans.

QUESTION NO: 10

Which of the following represents an advantage of using the NTFS file system over the

FAT16 and FAT32 file systems?

A. Integral support for streaming audio files.

B. Integral support for UNIX compatibility.

C. Integral support for dual-booting with Red Hat Linux.

D. Integral support for file and folder level permissions.

Answer: D

Explanation:

The NTFS was introduced with Windows NT to address security problems. With NTFS files,

directories, and volumes can each have their own security.

Incorrect answers:

A, B and C: Unlike any of the FAT file systems, NTFS supports file-and folder-level

permissions. FAT file systems provide complete access locally to the entire FAT partition.

Network access can be achieved regardless of the file system used; therefore, answer B is

incorrect. Support for multiple operating systems is not a feature of NTFS over FAT file

systems; therefore, answer C is incorrect. Streaming video is not a function of the type of file

system; therefore, answer A is incorrect.

QUESTION NO: 12

Which of the following can help secure DNS (Domain Name Service) information?

A. Block all unnecessary traffic by using port filtering.

B. Prevent unauthorized zone transfers.

C. Require password changes every 30 days.

D. Change the default password.

Answer: B

Explanation:

Leading the way in IT testing and certification tools, testking.in

- 186

A DNS zone is an area in the DNS hierarchy that is managed as a single unit. If a domain name

server allows zone transfer, it will allow another DNS server (one from a different domain) to

access its DNS library of IP addresses and names; which could fall into hackers' hands if they

were to pose as a DNS server.

Incorrect answers:

A: Blocking all unnecessary traffic will not help secure DNS information.

C: Password changes are not meant to secure DNS information.

D: The default password, whether changed or not, will not secure DNS information.

QUESTION NO: 18

What should be a system administrator's line of action when a patch is released for a

server?

A. Immediately download and install the patch.

B. Test the patch on a non-production server then install the patch to production.

C. Not install the patch unless there is a current need.

D. Install the patch and then backup the production server.

Leading the way in IT testing and certification tools, testking.in

- 190

Answer: B

Explanation:

Software patches are good for network security, because they are developed the fix known

vulnerabilities. So even if everything's operating normally, a patch is still very beneficial. When

you patch an operating system, there's always a risk that something can go wrong which can

compromise your data and server operation. It would be wise to backup your data BEFORE,

installing a patch, and it would also be wise to test the patch on your least important servers first.

Incorrect answers:

A: This is not advisable because the patch could be a backdoor attack. C:

This is not what a patch is meant for. A Patch could be useful. D: Backing

up after installing the patch is foolhardy.

QUESTION NO: 19

When disabling services to harden a machine against external attacks, what process should

be followed?

A. Disable services such as DHCP (Dynamic Host Configuration Protocol) client and print

servers from servers that do not use/serve those functions.

B. Disable one unnecessary service after another, while reviewing the effects of the previous

action.

C. Research the services and their dependencies before disabling any default services.

D. Disable services not directly related to financial operations.

Answer: C

Explanation:

Platform hardening procedures can be categorized into three basic areas:

* The first area to address is removing unused software and processes from the workstations. The

services and processes may create opportunities for exploitation.

The second are involves ensuring that all services and applications are up-to-date and configured

in the most secure manner allowed. This may include assigning passwords, limiting access, and

restricting capabilities.

* The third area to address involves the minimization of information dissemination about the operating system, services, and capabilities of the system.

Basically this means do some research insofar as services and their dependencies are concerned

for your system.

Incorrect answers:

A: DHCP is meant to assign IP addresses and should not be disabled.

B: This does not mean that you will be protected against external attacks. This is only disabling

any service as this option suggests.

D: This would be irrelevant as this option suggests that you do actually put financial operations

at risk.

-----------------------

Page 1 of 4

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download