stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Domain 4.0 Application, Data, and Host Security Flashcards | StudBud
Explore
/
Domain 4.0 Application, Data, and Host Security
Domain 4.0 Application, Data, and Host Security
58 terms
·
StudBud Administration
·
67 plays
All-In-One CompTIA Security + Domain 4 SY0-401 Exam Guide Fourth Edition
Flashcards
58 cards
F
Practice quiz
P
Host live
L
Questions
58
Answers
1
Which of the following correctly describe s XXS?
Overflowing the allocated storage area
Braking cryption systems
Exploiting a trust relationship between a user and a site
Exploiting a trust relationship between a site has for user
2
You want to use a special chip that has encryption keys with BitLocker. What is this?
PKI module
BitLocker encryption module
FIPS 140 chip
TPM
3
Which of the following is one of the most common web attacks methodologies?
RPC erros
XXS
Buffer overflows
XSRF
4
Which of the following technologies is used to help secure access to "big data"?
Account whtelisiting
HSM encryption
Kerberos-based authentication
Secure protocol methodologies
5
What is the most important thing to remember regarding performing forensics on a mobile device?
The device will change the state onCe the battery is off
Mobile device forensics is similar to standard workstations
It is best to rely on specially trained personnel
Mobile devices will retain state when powered off
6
What kind of protective mechanism should you deploy to protect against Internet-abased threats?
Host-based firewall
Anti-malware Software
Host-based sandboxing
Anti-spam software
7
What the of testing should be performed to ensure your network systems with mobile devices?
Both blah-box and white-box testing
Regression testing
Load testing
Disaster recover testing
8
What is an issue associated with jailbreaking of a mobile device ?
Geo;oactnokn is more accurate
Applications will rn more efectinelth
Vendor updates to the OS may no longer be properly a[plied
Encryption firm the vendor will work more efficiently
9
Firmware updates in static systwens?
unesscary
None of the above
Run automatted and unattended
Managed by a manual , tightly controlled process
10
Which is not a MDM policy requirement ?
APs to the network need CHAP
Encryption of data on the device
Auto and remote locking or wiping
Locking with strong password or if lost or stolen
11
Why is it important to disable used features on mobile devices?
Disabling unused features reduces the avenues of attack
Enabling unused features reduces the avenues of attack
Disabling unused features increases the avenues of attack
Enabling unused features increases the avenues of attack
12
Is an example of this unique risks associated with an alternative environment ?
it manipulates network configurations
It allows total control of a physical system
It permits access on the internet
It allows data losses of corporate data
13
A wrapper can be used by?
Provide network segregation in an alternative system
Packet size decrees or increases for transport
be a firewall function in static systems
Provide authentication services for data
14
What's the best way to prevent users from running programs you don't want them to run?
Application whitelisting
Trusted OS
Host-based firewall
Application blacklisting
15
Your in the process of securing a Windows Server 2012, what process should you perform?
{Patch management
Security control testing
Production system preparation
OS hardening
16
Which is not apart of a static enicoirmment?
Wrappers
TLS
Network segerartion
Manual updates
17
Which of the following correctly defines SQL injection?
Process by which app programS manipulate e string
Charter code sets that allow mulititgginG capability
Modifying a database query through false input
Inputs to web appS that are oppressed by different parsers
18
The ______ defineS the proper configuration settingS or an application?
Application configuration baleine
NoSQL
Fuzzing
Web application firewall
19
The difference between XXS vs XSRF is?
XXS= exploits trust 4 EAP and XSRF= exploits trust 4 TLS
XXS= exploits trust 4 STH and XSRF= exploits trust 4 PPP
XXS= exploits trust 4 PPP and XSRF= exploits trust 4 PTP
XXS= exploits trust 4 HTS and XSRF= exploits trust 4 STH
20
Which of the allowing is the least favorable location for security checks?
Server-side output validation
Server-side input validation
Sever-side code
Client-side code
21
What virtualization capability will help testing and rollback requirements for systems set up?
Baselining
Host elasticity
Sandboxing
Snapshots
22
Which of the following correctly describes hit listing ?
Denys access to specifically approved applications
Denys access to all applications
Allows access to unapproved access
Allows access to only specifically approved applications
23
What should you develop to help prevent runaway accumulation of log files in your corporation?
Customer service policy
HSM policy
Data encryption
Data retention policy
24
Which of the following correctly describes XSRF?
Enhanced cryptography encapsulation method
Breaks a cryptography system
Attacks a system with script code, execute via victim
Attacks a system with malicious code, executes via victim
25
What should you apply to physical secure the laptops you've placed in the cafe setup?
Locking USB ports
Locking cabinets
Cable locks
Password-protected screensaver
26
Which of the following is a way to defend against buffer overflow attacks?
Use pointers
Treat all input from nth w outside a function as hostile
Write fast code
Use unbound string manipulation
27
If a operating system is certified for use in multilevel security environments?
Resistant OS
Secure OS
Trusted OS
SElinuX
28
You are reminded there is a new vulnerability. Your certain your protected because you employed
Patch management
Trusted OS
Quality assurance
Application blacklisting
29
What type of protection should you install before you allow access to guest who'll use APs?
Anti-spam software
Virtualization
Antivirus software
Pop-up blocker
30
What is the primary security issue associated with embedded systems?
reduce set of functionality
Processing power
Lack of network connections
Cost
31
Which of the following describes fuzzing?
iterative development
Buffer overflows
Removing and not using old code
Systematic application malformed inputs
32
Which is not a example of alternative environment ?
embedded systems/mainframe
SCADA and automation systems
Jailbreaking
mobile devices (iOS and Android)/ game consoles
33
Two challenges that you'll face with BYOD and your corporation is?
Companies has ownership of BYODs and employees own the data
Blurs the line for security of BYODs and sharing devices
Blurs the line for ownership of BYODs and sharing data
Corporations have ownership of BYODs and the data
34
Error and exception handling should be performed in what fashion ?
All erros/exceptions should be trapped and handled in POT
Errors/Exceptions should be logged : handling is optional
Erros/Exceptions should never be handled
Errors/Exceptions should be trapped and handled in proGram
35
Which one his suited for input validation ?
Fuzzing
Buffer overflow
Path traversal
XXS/XSRF
36
Why is it important to terminate employee access upon employee termination?
It's know employees months after termination breach access
The corporation has control of all terminated workers BYOD
Terminated employees can be trusted not to access corp apps
Terminated employees own their devices in a BYOD environment
37
What is not a significant issue associated with jailbroken or rooted mobile devices ?
Allows configuration for live wallpapers
Failure to accept new updates
Unknown state of internal protection mechanisms
Legal issues with respect to licensing
38
What is not a network segmentation accomplishment ?
Application layering
HMAC
VLANs/ACMs
MAC filtering /IP addesss roil ting
39
When dat A is storend on a hard drive and isn't currently being accessed, this is referred to :
Data in transit
Data in use
Data was rest
Data in storage
40
What os the purpose of MDM?
It is a virus found in the wild
It is malicious jailbreak tool
It provides high bandwidth
IT provides the capability to secure and support phones
41
What is the most fundamental security practices that should be followed the use of bluetooth?
devices should be used in TCP mode
Devices should always be kept in discoverable mode
Devices should be exit from BYOD polices
Always have discoverable mode turned off unless in use
42
The process of ensuring the configurations of system are correct is known as...
Host OS hardening
Host image configuration
Host application whitelisting
Host software baselining
43
What is not a protection for mobile devices to access critical data on the network?
File sharing for scalability
Application security
Device encryption
Security of key store
44
Which of the following describes a characteristic of an alternative environment ?
Designed without typical security functions to their system
Embedded security functions that prevents hacks
Only runs Windows
Using Linux makes them more secure
45
The two elements of application hardening are ___ and ___?
Removing unneeded services / options; securing configuration
Patch management / NoSQL
Data integrity with Input / Validation of confidentiality
Error / Exception handling
46
What is http://cwe.mitre.org/top25/ and how does it compare to software errors?
A list matted by NASA of the top 100 most Microsoft errors
A list matted by SCADA of the top 20 most cloud errors
A list matted by CCMP of the top 25 most valued errors
A list matted by MITRE of the top 25 most dangerous errors
47
Application firewalls operate at what layer?
1
3
4
7
48
Why it important to disable geo-tagging on your mobile device?
Geo-tagging can enable correlation of photos and location
Geo-tagging is a great hobby
Geo-tagging makes your friends confirm your photos
Geo-tagging can expose the location where the photo was
49
Which of the following is not a common use of XXS attacks?
Seeion hijacking
Information theft
Website defacement
Deploying maleware
50
Which of the following capabalilites could you recommend to a friend for a possible threat?
host-based pop-up-blocker
Host-based vulbveavjilty scanner
host-based intrusion section system
Host-based anti-spyware
51
What is the concept of transitive trust?
A's authentication for A/B trusts the authentication for C/A
A's authentication for A/B trusts the authentication for G/B
A's authentication for A/B trusts the authentication for B/C
A's authentication for A/B trusts the authentication for C/A
52
What is one reason that mobile devices can complicate support?
Mobile devices are written to specifications and reliability
All devices implement required functions the same
The vendor can provide required support 4 mobile devices
The variety of devices can complicate support training
53
The best process to use for determining unexpected input validation problems is ....
Fuzzing
PEAP
SQL injection
LDAP injection
54
What is unique about mainframes with respect too security?
Run on OS that doesn't have vulnerability
they have all been retired abide op ti longer in function
Highly flexible
they are isolated form the internet
55
Which of the following best defines static systems?
they do not have a user interface
They are designed for only one task
They are configured for specific functions/ run unaltered
They have no memory
56
A threat with respect to loss of data when connecting your mobile device to your corporation ?
SQL injections
MDM attacks
Shoulder surfing
Power outage
57
You use a virtual machine to test software to check for malicious activity. Is what practice ?
Sandboxing
Application whitelisting
Security control testing
Snapshot testing
58
Which not a strategy that should be considered regarding BYOD devices?
Automatic / Device locking
Antenna placement / VoIP connection
Automatic/ Remote wiping
Strong passwords / Encryption
