Chapter 1 – Understanding Security Fundamentals

1. The three components of the CIA triad are confidentiality (where the data is encrypted), integrity (where the data uses hashing), and availability (where the data is available, for example, by restoring data from a backup).
2. An inactive CCTV camera could be used as a deterrent since criminals would not know that it is inactive.
3. Confidentiality means preventing other people from viewing the data; the best way to keep data confidential is to encrypt it.
4. The best way to control entry into a data center is to install a mantrap.
5. The purpose of an air gap is to prevent data theft by removing physical connections between the device and network. The only way to insert or remove data from an air-gapped machine is with removable media like a USB drive.
6. The three control categories are managerial, operational, and technical.
7. Any three of the following physical controls will apply: Lighting, cameras, robot sentries...

Chapter 2 – Implementing Public Key Infrastructure

1. A CA has a root certificate, which it uses to sign keys.
2. You would use a private CA for internal use only; these certificates will not be accepted outside of your organization.
3. You would use a public CA for B2B activities.
4. If you were a military, security, or banking organization, you would keep the CA offline when it is not being used to prevent it from being compromised.
5. PKI uses asymmetric encryption.
6. The CA signs the X509 certificates.
7. Certificate pinning can be used to prevent a CA from being compromised and fraudulent certificates from being issued.
8. If two separate PKI entities want to set up cross-certification, the root CAs would set up a trust model between themselves, known as a bridge trust model.
9. PGP uses a trust model known as a web of trust.
10. A Certificate Revocation List (CRL) is used to determine whether a certificate is valid.
11. If the CRL is going slow, you...

Chapter 3 – Investigating Identity and Access Management

1. A password is most likely to be entered incorrectly; the user may forget the password or may have the Caps Lock key on by accident.
2. When purchasing any device, you should change the default username and password as many of these are available on the internet and could be used to access your device.
3. Password history determines the number of passwords you can use before you can reuse your current password. Some third-party applications or systems may call this a password reuse list.
4. Password history could be set up and combined with a minimum password age to prevent password reuse. If you set the minimum password age to 1 day, a user could only change their password a maximum of once per day. This would prevent them from rotating their passwords to come back to the old password.
5. A complex password uses three of the following: uppercase and lowercase letters, numbers, and special characters not used in...

Chapter 4 – Exploring Virtualization and Cloud Concepts

1. Elasticity allows you to increase and decrease cloud resources as you need them.
2. Infrastructure as a Service (IaaS) requires you to install the operating systems and patch the machines. The CSP provides bare-metal computers.
3. SaaS is a custom application written by a vendor, and you cannot migrate to it.
4. The major benefit of a public cloud is that there is no capital expenditure.
5. A private cloud is a single-tenant setup in which you either own the hardware or the CSP puts you on hardware that's isolated from its other customers.
6. A public cloud is multi-tenant.
7. With a community cloud, people from the same industry (such as a group of lawyers) design and share the cost of a bespoke application and its hosting, making it cost-effective.
8. The CSP is responsible for hardware failure.
9. The CASB enforces security, updates clients, and ensures that the policies between the on-premises situation...

Chapter 5 – Monitoring, Scanning, and Penetration Testing

1. The white box tester can access the source code.
2. It would prevent you from monitoring or auditing an individual.
3. The gray box pen tester would be given at least one piece of information; normally, they get limited data.
4. Rules of engagement must be established.
5. He would have regular meetings with the client, who would tell him if he has been discovered.
6. The scope determines whether the pen test is black, gray, or white.
7. The pen tester would give the internal IT team their IP address so that they can establish whether or not it is the pen tester or an attacker.
8. The credentialed vulnerability scan has more permissions than a non-credentialed one and has the ability to audit, scan documents, check account information, check certificates, and provide more accurate information
9. The cleanup phase is where the systems are returned back to the original state.
10. Open-source intelligence...

Chapter 6 – Understanding Secure and Insecure Protocols

1. When using Kerberos authentication, a TGT session is established, in which the user obtains an encrypted service ticket. Kerberos uses USN and timestamps to prevent replay attacks.
2. IPSec in tunnel mode is used with an L2TP/IPSec VPN session where both the AH and ESP are encrypted.
3. IPSec in transport mode is server to server on a LAN where only the ESP is encrypted.
4. SSH is a secure protocol that replaces Telnet.
5. A router connects external networks and routes IP packets.
6. A switch is an internal device connecting computers being used in the same location.
7. Spotify is a subscription service where the user pays a monthly fee. It is a pay-per-use model.
8. Port security is where a port on a switch is disabled to prevent someone from using a particular wall jack.
9. 802.1x authenticates users and devices connecting to a switch. Normally, the user or device has a certificate to authenticate...

Chapter 7 – Delving into Network and Security Concepts

1. The web application firewall is normally installed on or before a web server as its job is to protect web applications from attack.
2. Implicit Deny is used by both the firewall and the router. If there is no allow rule, they get the last rule, which is deny all. This is known as Implicit Deny.
3. Unified Threat Management (UTM) is a firewall that provides value for money as it can provide URL filtering, content filtering, and malware inspection, as well as firewall functionality.
4. A router connects different networks and works at Layer 3 of the OSI reference model.
5. A switch connects users on an internal network, normally in a star topology. It works at the data link layer.
6. A Network Address Translator (NAT) hides the internal network from those on the external network.
7. An inline NIPS screens incoming traffic as it flows through it.
8. A Host-Based IPS (HIPS) is installed inside the guest...

Chapter 8 – Securing Wireless and Mobile Solutions

1. Visitors and employees on their lunchtime break might access a guest wireless network.
2. The fat wireless controller is standalone; it has its own setting and DHCP addresses configured locally. A thin wireless controller pushes out the setting to multiple WAPs.
3. The WAP master password is the admin password, and it should be encrypted to protect it.
4. A Wi-Fi Analyzer can troubleshoot wireless connectivity and discover a disabled SSID, which is inside a packet going to the WAP.
5. MAC filtering controls who can access a WAP. If your MAC address is not added to the WAP, then you are denied access.
6. To prevent interference by overlapping the wireless channels.
7. He would ensure that the WAPs are placed where there is no interference.
8. No, because it is not secure. Instead, you could tether your 4G phone and then open a VPN connection to the bank.
9. WEP is the weakest as it only has 40-bit encryption...

Chapter 9 – Identifying Threats, Attacks, and Vulnerabilities

1. Because you have parted with money, this is a subtle form of ransomware.
2. A fileless virus piggybacks itself onto a legitimate application, and they both launch together. Using Malwarebytes would alert you of both launching at the same time.
3. Credential harvesting is done by a phishing attack where you are warned that an account has been hacked, and it gives you a link to a website to resolve it. That way, when you try to log in, they collect your details.
4. Pretexting is where an attacker manufactures a scenario, such as saying that there is suspicious activity on your account, and they ask you to confirm your account details. This way, they can steal them.
5. An attacker obtains the details of a legitimate invoice and substitutes the bank details with their own.
6. An attacker works out what standard naming convention a company is using, and they then obtain the names of employees from the internet...

Chapter 10 – Governance, Risk, and Compliance

1. A vulnerability is a weakness that an attacker could exploit.
2. A BPA is used by companies in a joint venture, and it lays out each party's contribution, their rights and responsibilities, how decisions are made, and who makes them.
3. A multi-party risk is where someone wins a contract and sub-contracts to a third party who could sabotage your systems.
4. This occurs when your intellectual property has been stolen, for example, trade secrets, copyright, and patents.
5. A memorandum of understanding is a formal agreement between two parties, but it is not legally binding, whereas a memorandum of agreement is similar, but is legally binding.
6. Tokenization is the process by which data is replaced by a stateless token and the actual data is held in a vault by a payment provider. Because data is held in a remote location, it is stronger than encryption for which keys are held locally.
7. They have carried out a software...

Chapter 11 – Managing Application Security

1. Mobile devices can connect through cellular, wireless, and Bluetooth connections.
2. Embedded electronic systems have software embedded into the hardware; some use SoC. Examples are microwave ovens, gaming consoles, security cameras, wearable technology, smart TVs, medical devices, such as defibrillators, or self-driving cars.
3. SCADA systems are industrial control systems used in the refining of uranium, oil, or gas, or the purification of water.
4. Smart TVs and wearable technology are classified as IoT devices.
5. Home automation is where you can control the temperature, lighting, entertainment systems, alarm systems, and many appliances.
6. An SoC is a low-power integrated chip that integrates all components of a computer or electronic system. An example would be the controller for a defibrillator. Think of it as an operating system stored on a small chip.
7. The Real-Time Operating System (RTOS) processes data as it...

Chapter 12 – Dealing with Incident Response Procedures

1. RAID 5 has a minimum of three disks, and you can afford to lose one disk without losing data. It has single parity.
2. RAID 6 has a minimum of four disks. It can afford to lose two disks as it has double parity.
3. RAID 5 has single parity and can lose one disk, whereas RAID 6 has double parity and can lose two disks.
4. A diskless virtual host will get its disk space from a SAN.
5. A SAN will use fast disks, such as SSDs.
6. Cloud storage for personal users could be iCloud, Google Drive, Microsoft OneDrive, or Dropbox.
7. Eradication refers to the removal of viruses and reduction of the services being used. The domain controller should be isolated, and this is the containment phase. The virus would be removed in the eradication phase, and then be placed back online. This is the recovery phase.
8. A simulation is where the IRP team is given a specific scenario to deal with.
9. This is an aid to help prepare...