Sec+ - Vulnerability Assessment & Data Security

Which threat evaluation helps to better understand who, why, and what types of attacks might occur?

Which security procedure is being demonstrated if an admin is using Wireshark to watch for specific in & out traffic?

38. Which of the following is the goal of a vulnerability scan? (Choose all that apply.)

Which item below is the standard security checklist against which systems are evaluated for a security posture?

Which data erasing method will destroy a magnetic-based hard disk by eliminating the magnetic field?

Which scan examines the current security, using a passive method?

What is the TCP/IP registered port range?

What security goal do the following controls address: hashing, digital signatures, certificates, nonrepudiation tools?

TCP/IP uses a numeric value as an identifier to the applications and services on these systems.

Each packet/datagram contains a source port and destination port.

Which is a valid data sensitivity labeling & handling category? (Choose all that apply.)

A user uses the OS's "delete" command to erase data, what type of data removal procedure was used?

A risk management assessment is a systematic and methodical evaluation of the security posture of the enterprise.

What is the name of the process that basically takes a snapshot of the current security of an organization?

What is the TCP/IP well-known port range?

Netstat displays all current TCP/IP network configuration values and refreshes DHCP and DNS settings.

A computer located in an area with limited security and loaded with SW & data that appear to be authentic?

What is the term for a network set up with intentional vulnerabilities?

What type of scanner sends probes to network devices and examine the responses received back?

Determining vulnerabilities often depends on the background and experience of the assessor.

A penetration tester has gained access to a network, then tries to move around inside the network to other resources?

What process does a penetration tester rely on to access an ever higher level of resources?

In white & gray box testing, the first task of the tester is to perform preliminary information gathering, aka OSINT?

During a vulnerability assessment, what type of software can be used to search a system for port vulnerabilities?

The second step in a vulnerability assessment is to determine the assets that need to be protected.

An admin needs to view packets and decode & analyze their contents. What type of application should the admin use?

Realistically, risks can never be entirely eliminated.

Select the vulnerability scan type that uses only the available info to hypothesize the status of the vulnerability.

What type of penetration testing technique is used if the tester has no prior knowledge of the network infrastructure?

What process addresses how long data must be kept and how it is to be secured?

A port in what state below implies that a service/app assigned to that port is listening for any instructions?

Nslookup displays detailed information about how a device is communicating with other network devices.

Which tester has an in-depth knowledge of the network and systems being tested?

Vulnerability scanning should be conducted on existing systems and new technology equipment when deployed.

An admin runs a port scan to ensure that no processes are using port 23. What state should the port be in?

The state or condition of being free from public attention to the degree that you determine?

What type of reconnaissance is a penetration tester performing if they are using tools that do not raise any alarms?

What is the end result of a penetration test?

What security goal do the following common controls address: Redundancy, fault tolerance, and patching?

Used to replicate attacks during a vulnerability assessment by providing a structure of exploits & monitoring tools?

What is another term used for a security weakness?

What is the TCP/IP dynamic port range?