Correct answer:

Put the new IDS/IPS into a passive “learning” mode first so it can collect traffic over a specified period of time to develop a normal traffic baseline is correct. Baselining is the process by which the new system will learn the normal traffic flows for the infrastructure; the new IDS/IPS must collect this data in passive learning mode for a reasonable period of time so that it can make better decisions on which traffic is normal in which is not.

Incorrect answers:

Perform a penetration test on the IDS/IPS so it can learn what different attack signatures look like is incorrect. Performing a penetration test on the new system will not enable it to learn what attack signatures look like. Signature-based detection involves downloading and installing known attack signatures on the device.

Put the new IDS/IPS into a fully operational mode so that it can collect network traffic and performance detection/prevention activities immediately is incorrect. Putting a new system in a fully operational mode causes it to make immediate decisions on which traffic may be a potential malicious attack, likely resulting in many false positives and causing network disruption. It should be placed in a learning mode first so it can determine what normal traffic behavior looks like.

Download and install the latest traffic baseline signatures from the vendor is incorrect. Normal traffic patterns for a particular infrastructure must be learned over a defined time period; they cannot be simply downloaded from a vendor because they are unique to the organization.

Correct answer:

Scope of impact is correct. The scope of impact is the formal determination of whether an event is enough of a deviation from normal operations to be called an incident and the degree to which services have been affected.

Incorrect answers:

Incident category is incorrect. The organization can create its own incident categories, but the correct term for the degree to which services in the organization have been affected is the scope of impact.

Level of risk is incorrect. The level of risk an organization assigns to a potential incident depends on the likelihood that a threat will exercise a vulnerability in the organization or asset and the impact the threat has on that asset or the organization. The scope of impact is not potential risk; it measures the actual impact once the risk has been realized.

Threat level is incorrect. The threat level describes different aspects of a threat actor or event, rather than the impact level if the threat materializes.

Correct answer:

SOAP is correct. Simple Object Access Protocol (SOAP) is an older messaging protocol that uses XML over HTTP to enable clients to invoke processes on a remote host in a platform-agnostic way. SOAP uses a message envelope that defines the messages that are allowed and how they are to be processed by the recipient, as well as a set of encoding rules used to define data types. SOAP includes conventions on what remote procedures can be called and how to interpret their responses between applications.

Incorrect answers:

REST is incorrect. Representational State Transfer (REST) is not a protocol; it is an architecture style that describes how systems can leverage the inherent statelessness and standardization of operations in HTTP for communications.

Microservices is incorrect. Microservices are an architectural style rather than a protocol; they are small, decentralized, individually deployable services built around business capabilities. They are loosely coupled, which means they do not require a lot of dependencies between the individual services or between the applications.

XML is incorrect. eXtensible Markup Language (XML) is not a messaging protocol; rather, it is a markup language used in a variety of applications, including SOAP applications.

Correct answer:

Hardware security module is correct. A hardware security module (HSM) is a removable expansion card or an external device that can generate, store, and manage cryptographic keys. It can be used if the device does not have a built-in TPM, since it serves the same functions.

Incorrect answers:

eFuse is incorrect. An eFuse is a single bit of nonvolatile memory that, once set to 1, can never be reverted to 0. It relies on a special compound that normally conducts electricity just fine, but if you apply a specific amount of power, its chemical composition changes, and it becomes a resistor instead. Once an eFuse is programmed or blown, it cannot be reverted to its unprogrammed state.

BIOS is incorrect. The Basic Input Output System (BIOS) is an older firmware technology used to interface between the hardware in the operating system.

UEFI is incorrect. The Unified Extensible Firmware Interface (UEFI) is a software interface standard that describes the way in which firmware executes its tasks. It replaces the older BIOS, and allows for larger disk partitions, multiple boot options, and much more comprehensive security.

Correct answer:

Reverse engineering involves disassembling or decompiling binary code into either assembly language or another high-level language to determine all possible functions of the softwar is correct. Reverse engineering involves disassembling or decompiling binary code into either assembly language or another high-level language to determine all possible functions of the software.

Incorrect answers:

Reverse engineering involves submitting a variety of unconventional inputs into a running program to determine how it behaves under those conditions is incorrect. Submitting a variety of unconventional inputs into a running program to determine how it behaves is a testing technique known as fuzzing.

Reverse engineering involves an automated static code review is incorrect. An automated code review is called a static code analysis.

Reverse engineering involves running an unknown binary in a sandbox environment to determine its behavior is incorrect. Running an unknown binary in a sandbox environment to determine its behavior is known as dynamic code analysis.

Correct answer:

Five is correct. The permissions assigned to the group for the X11 directory are read and execute. In octal, this is notated as 4 for read, 2 for write, and 1 for execute. Since octal permissions are additive, this would be represented as the numeral 5 (4 + 1 = 5).

Incorrect answers:

Six is incorrect. Octal six would mean that the permissions are read and write.

Four is incorrect. Octal four would mean that the permission is read-only.

Seven is incorrect. Octal seven would mean the permission consists of read, write, and execute.

Correct answer:

SSLis correct. Host 192.168.189.130 is running Secure Sockets Layer (SSL) versions 2 and 3, which have both been deprecated in favor of Transport Layer Security (TLS).

Incorrect answers:

TLS is incorrect. The output from the vulnerability scanner does not indicate that any host is running TLS.

SSH is incorrect. The output from the vulnerability scanner does not indicate that any host is running SSH.

IPSec is incorrect. The output from the vulnerability scanner does not indicate that any host is running IPSec.

Correct answer:

Atomic execution is correct. Atomic execution means that certain sections of a program run so that they cannot be interrupted between the start and the end of the section. This prevents other processes from interfering with resources being used by the protected process. This is useful in preventing attacks targeted at time-of-check to time-of-use (TOCTOU) vulnerabilities.

Incorrect answers:

Processor security extensions is incorrect. Processor security extensions are instructions that provide security features in the CPU and can be used to support a TEE.

Bus encryption is incorrect. Bus encryption is a method of keeping data secure by decrypting between the storage media in the CPU.

Trusted execution environment is incorrect. A TEE is a software environment in which special applications and resources (such as files) have undergone rigorous checks to ensure that they are trustworthy and remain protected.

Correct answer:

Heuristics is correct. Heuristics is a type of analysis that looks at known characteristics, such as those of malware, and attempts to make a best guess based upon experience with those characteristics. It is useful when there is no known pattern for comparison or baseline for behavioral analysis.

Incorrect answers:

Signature-based analysis is incorrect. Signature-based analysis looks at known patterns or signatures for comparison to see if there is a match.

Behavior-based analysis is incorrect. Behavior-based analysis looks at unusual variations of behavior from a baseline.

Temporal-based analysis is incorrect. Temporal-based analysis examines data collected over a period either to predict future events or to explain past events.

Correct answer:

Piping enables the standard output (stdout) of a command to be connected to the standard in (stdin) of another command is correct.

Incorrect answers:

The other answers are not the correct definition of piping.