Correct Answer:

Elsave is correct.

Elsave is a “public domain” executable that can be used to clear Windows logs.

Incorrect Answers:

Cain, auditpol, and pwdump are incorrect.

Cain is a password cracker/sniffer.

Auditpol is used to disable auditing.

Pwdump is used to extract password hash values.

Correct Answer:

Access gateway layer is correct.

The access gateway layer is where the first data handling takes place, with message identification and routing occurring here.

Incorrect Answers:

Internet layer, application layer, and middleware layer are incorrect.

The Internet layer is a crucial layer, as it serves as the main component to allow all communication.

The application layer is responsible for the delivery of services and data to the user.

The middleware layer sits between the application and hardware layers.

Correct Answer:

Nmap is correct.

Nmap has all sorts of switches that allow you to search for nearly everything. For example, the -O switch would come in handy here.

Incorrect Answers:

Ping, whois, and tracert are incorrect.

The remaining answers don’t help with OS fingerprinting.

Correct Answer:

Hosts is correct.

A Windows system goes through the same process for every name-to-IP resolution. First, it checks its own cache to see if the requested name has already been looked up. Next, it checks the hosts file. The hosts file is a plain-text file that is used manually to map names to IP addresses. If an attacker were to gain access to the hosts file, he could add any name-to-IP mapping he wanted, ensuring the victim wouldn’t even recognize a problem was occurring.

Incorrect Answers:

Passwd, lmhosts, and SAM are incorrect.

The passwd file holds passwords in Linux systems.

The lmhosts file maps IP addresses to NetBIOS names, much like the hosts file does for DNS names.

The SAM file holds the local password hashes on a Windows system.

Correct Answers:

Load balancing, throttling, and drop requests are correct.

Load balancing increases bandwidth for critical connections, balancing the load on servers to mitigate DDoS attacks.

Throttling incoming traffic levels provides safe levels for servers and prevents downtime and damage.

Drop requests is a technique where routers and/or switches drop packets during increased loads.

Incorrect Answers:

Encryption is incorrect.

Encryption does nothing to mitigate a DDoS attack.

Correct Answer:

All of the above is correct.

Enforcing elevated privilege control is a commonsense step because a disgruntled employee with administrator rights on his machine can certainly do more damage than one with just plain user rights. Securing dumpsters and practicing good physical security should help protect against an insider who wants to come back after hours and snoop around. Background checks on employees are by no means a silver bullet, but they can certainly help to ensure you’re hiring the right people in the first place.

Incorrect Answers:

All other statements are all valid; therefore, “All of the above” is the correct choice.

Correct Answer:

Shared hardware between virtualized servers is correct.

One of the primary benefits in virtualization is the reduced cost due to shared hardware. A single physical server can host multiple, concurrent VMs.

Incorrect Answers:

Dedicated hardware per each virtualized server, virtual servers consume less disk space than physical servers, and none of the above are incorrect.

These answers are not benefits of virtualization.

Correct Answer:

Covert channel is correct.

A covert channel is a transmission method used in a way for which it was not intended—generally for the purposes of hiding data transmissions and/or violating security policy.

Incorrect Answers:

Hidden channel, overt channel, and wrapper are incorrect.

An overt channel is one that’s used as designed and within policy.

A wrapper refers to the application used to hide a Trojan by binding it to a legitimate file.

Hidden channel is included as a distractor.

Correct Answer:

Use virtual machines on the test bed system is correct.

When performing malware analysis, first prepare a test bed—usually a system with VMs, all shared drives disabled, and the NIC in host-only mode. After copying the virus to the test system, perform static analysis while the malware is inactive. Next, set up network connections (off the production network, of course) and monitor for errors/activity. Finally, run the malware and note the processes, files added, and network activity.

Incorrect Answers:

After static analysis, run the virus in a sparsely used portion of the network, when preparing the test bed system, enable all shared drives, and after initial static analysis, run the virus on the production network and note the activity are incorrect.

Running a virus on your production network—or even in a sparsely used portion of your network—is a horrible idea, before or after initial static analysis. Also, during testing, all shared drives should be disabled.

Correct Answer:

Device-to-Device is correct.

In this example, an IoT device (the implant) is communicating directly with another IoT device (the smartphone).

Incorrect Answers:

Device-to-Cloud, Device-to-Gateway, and Zigbee are incorrect.

In Device-to-Cloud, the device communicates to the cloud first (the user must interact with the cloud in some format to get the data).

Device-to-Gateway sees the device communicating with a gateway device to upload data to the cloud.

Zigbee is a communications protocol, not an IoT comm method.