Which of the following is not what a port scanner does?

Scans cables plugged into ports

fix protections of Wi-Fi Protected Access (WPA) or WPA2

Which of the following is not what a vulnerability scanner does?

Take action to resolve security problems

anetwork set up with one or more honeypots

Gathering of name and version of software

What is not a consideration in threat evaluation?

Wait for them to happen then study

Which of the following is not what a protocol analyser does?

Send alert admin of vulnerability

Which is not a type of vulnerability scan?

there are no non credential scans

Which of the following are steps to maintain privacy?

Rely on the laws •HIPAA, Sarvox, GLBA, and PCIDSS

What does privacy not mean?

Having your data sold to interested third parties

Which of the following is not a penetration test technique?

Gray Box - old information has been provided to the tester

studbud

Vulnerability Assessment and Data Security 1

34 termsStudBud Administration10 plays

Imported from external platform

Flashcards34 cardsFPractice quizPHost liveL

Questions 34

Answers

1
Which of the following is not what a port scanner does?
Scans exchange between system programs
Scans cables plugged into ports
Scans TCP/IP communication
2
Crackers do not
break the digest of a password to determine its strength
break (“crack”) the security of a system
fix protections of Wi-Fi Protected Access (WPA) or WPA2
3
Which is not a category of threats?
Steel car stereo
Espionage
Extortion
Natural Disaster
4
Which of the following is not what a vulnerability scanner does?
Identify several vulnerabilities and alert network administrators
Take action to resolve security problems
Sends “probes” to network devices and examine the responses received
Can identify the current software OS and applications being used
5
What is not a purpose of hardening?
Enabling unnecessary accounts
Protecting management interfaces and applications
Eliminate as many security risks as possible
Protecting accounts with passwords
6
Which tools is command line?
Netcat alternative to Nmap
Nmap (network mapper) determine whichdevices are connected to the network
7
Which does a secure posture not mean?
Continuous security monitoring
Initial baseline configuration
Ignore exposed vulnerabilities
Standard security checklist
8
Which is not a factor to consider regarding assets
How much time asset generates
Impact of asset unavailability to the organisation
How difficult to replace asset
How critical the asset is to the goals of organisation
9
What is not an aspect of data vulnerability?
Threat identification
Risk mitigation
Vulnerability appraisal
Risk Assessment
10
Which is not what a hacker would use a port scanner for?
Searches system for port vulnerabilities
Open, closed, or blocked
Used to determine port state
Scan connected cables
11
Which of the following are risk impacts?
Catastrophic
Major
No impact
Insignificant
12
A honeynet is
anetwork set up with one or more honeypots
a computer protected by minimal security Intentionally configured with vuln
13
Which is not a tool to perform vulnerability assessment?
Commandline tools
Banner grabbing tools
Honeyeater
Vulnerability scanners
14
Banner grabbing is
Gathering of name and version of software
Grabbing banners from webpages
15
In an attack tree, which is the top?
Key stolen
Stolen car
Broken car window glass
16
Which is not a standard techniques for mitigating and deterring attacks
Softening
Creating a security posture
Reporting
Selecting and configuring controls
17
What is not a consideration in threat evaluation?
Wait for them to happen then study
Threat modeling: Understand attackers and their methods
Attack Tree: visualrepresentation of potential attacks
List potential threats that come from threat agents
18
Which is not true of a penetration test?
Relies on tester’s skill, knowledge, cunning
Conducted outside the security perimeter
Exploit system weaknesses
Always conducted in-house
19
Which is not an Availability control?
Redundancy
Fault tolerance
No Patching
20
Which of the following is not what a protocol analyser does?
Characterising network traffic
Fine-tune the network and manage bandwidth
Send alert admin of vulnerability
Captures packets to decode and analyse contents
21
Which of the following are not correct port allocations
Legal ports (80, 3456)
Well known (0-1023)
Dynamic and private port numbers (49152-65535)
Registered Port Numbers (1024 - 48151)
22
Which is not a Integrity control?
Digital signatures
Hashing
Certificates
Repudiation tools
23
Which is not a type of vulnerability scan?
there are no non credential scans
hypothesizethe status of the vulnerability
provides credentials to the scanner so tests for additional vulnerabilities
penetratethe system to perform a simulated attack
24
Which does a vulnerability scan not do?
Identifycommon misconfigurations
Identify vulnerabilities or security weaknesses found in the system
Fix vulnerability
Identify a lack of security controls that are missing
25
Which is not an Safety control?
Fencing and lighting
Locks
Escape plans and routes, safety drill
Deleting CCTV
26
Which is not a step of a penetration test
Probe system for information
Move around in system
Use information
Lower privileges
27
Which is not a confidentiality control?
Access controls
Encryption
Decryption
Steganography
28
Which of the following are steps to maintain privacy?
Creating and following a overall security methodology
Ensuring that data is destroyed when no longer needed
Rely on the laws •HIPAA, Sarvox, GLBA, and PCIDSS
Properly labeling and handling sensitive data
29
Which of the following is not a concern of data collection?
Associations with groups
Freedom of movement
Individual inconveniences and identity theft
Statistical inferences
30
What does privacy not mean?
Having your data sold to interested third parties
The state or condition of being free from public attention
Right to be left alone to the level that you choose
31
A vulnerability appraisal does not include which of the following?
Snapshot of existing security
Catalogue assets
Current weaknesses
View asset in light of threat
32
Which is not a tool to perform vulnerability assessment?
Port scanner
Risk scanners
Protocol analyser
Honeypot or honeynet
33
Which is not a method to destroy data?
Still be retrieved by using third-party tools
Use OS delete command
Overwriting the disk space with zeros or random data
Degaussing – permanently destroys the entire magnetic-based drive
34
Which of the following is not a penetration test technique?
Gray Box - some limited information has been provided to the tester
Gray Box - old information has been provided to the tester
Black Box - testerhas no prior knowledge of network infrastructure
White Box - testerhas in-depth knowledge of network and systems being tested

Vulnerability Assessment and Data Security 1 Flashcards | StudBud