Correct Answer:

Physical deterrent control is correct.

What can deter you more than the sight of a dog patrolling an area, just waiting for an intruder to chew on? Note the terminology here, though: “preventive” could just has easily been used as a descriptor; however, “deterrent” is usually found with the physical descriptor.

Incorrect Answers:

Technical corrective control, technical preventive control, and physical detective control are incorrect.

Dogs aren’t technical—even smart ones. And while you can use a bloodhound as a means to track down an escapee, dogs are not detective controls.

Correct Answer:

Host -t a somewhere.com is correct.

The host command is one of several DNS lookup utilities in Linux (for example, dig will work as well). It is a simple utility for performing DNS lookups and is normally used to convert names to IP addresses, and vice versa. When no arguments or options are given, the host command displays a short summary of its command-line arguments and options. The -t switch sets the type, followed by which type (in this case, the -a option).

Incorrect Answers:

Host -t ns somewhere.com, host -t soa somewhere.com, and host -p -t somewhere.com are incorrect.

The -ns and -soa switches are for name servers and Start of Authority records, respectively.

The remaining command uses incorrect syntax.

Correct Answer:

DNS poisoning is correct.

In DNS poisoning, the DNS server accepts false information it believes is authentic. This allows an attacker to replace IP address entries for a target site on a given DNS server with IP addresses to malicious locations.

Incorrect Answers:

Network aliasing, Reverse Address Resolution Protocol, and port scanning are incorrect.

Network or IP aliasing usually refers to associating more than one IP address to a network interface, allowing one node on a network to have multiple connections to a network.

Reverse Address Resolution Protocol (RARP) is an obsolete protocol used by a system to request an IP address from a network, when all it has available is its own link layer address.

Port scanning is an effort to determine the status of ports on systems within a network.

Correct Answer:

Watering hole attack is correct.

You might ask why one would go through the trouble of infecting multiple websites that have nothing to do with the target when they could otherwise spend that time attacking…well…the target—but c’est la vie. In this attack, the goal is to gain access to a machine owned by one of the target group’s members. By infecting sites the team members visit frequently, sometimes with unknown (zero-day) exploits, the attacker can get members’ machines infected and use that to attack the rest of the group.

Incorrect Answers:

Shellshock attack, heartbleed attack, and spray and pray attack are incorrect.

Shellshock (aka Bashdoor) is a Linux vulnerability that allows an attacker to cause vulnerable versions of Bash to execute arbitrary commands.

Heartbleed is an SSL vulnerability that exploits the heartbeat issue in data transfer.

Spray and pray isn’t an attack name that I’m aware of (but it should be, because it sounds really cool).

Correct Answer:

A disgruntled employee is correct.

Everyone recognizes insider threats as the worst type of threat, and a disgruntled employee on the inside is the single biggest threat for security professionals to plan for and deal with.

Incorrect Answers:

Script kiddies, phishing, and a white-hat attacker are incorrect.

Script kiddies usually don’t pose much threat—defenses are aligned against them.

Phishing is a definite threat, but again defenses are in place.

White-hat attackers are hired by the organization, so they’re not an intentional threat.

Correct Answer:

Session riding is correct.

Session riding is, in effect, simply CSRF under a different name and deals with cloud services instead of traditional data centers.

Incorrect Answers:

Side session, side channel, and VM straddling are incorrect.

Side-channel attacks, also known as cross-guest VM breach, deal with attackers gaining control of the existing virtualization itself.

Side session and VM straddling are not legitimate terms.

Correct Answers:

Netcraft Toolbar and PhishTank are correct.

Although nothing is foolproof, a couple of options can assist in protecting against phishing.

The Netcraft Toolbar and the PhishTank can help in identifying risky sites and phishing behavior.

Incorrect Answers:

Network IDS and host-based IDS are incorrect.

IDSs are great to have and can help in identifying the effects after social engineering has succeeded, but they do nothing to prevent phishing.

Bluesnarfing is an attack where an attacker tries to gain unauthorized access to a device via Bluetooth and steal information such as contacts, messages, or other data. For example, an attacker could use Bluesnarfing to access and download the victim's phone contacts without permission.

Bluesniffing involves discovering Bluetooth devices. While it can be a step in preparing for an attack, it is not directly used to steal data.

Bluejacking refers to sending unsolicited messages to Bluetooth-enabled devices. It is generally considered harmless and more of an annoyance than a threat.

Bluesmacking is a denial-of-service attack that overwhelms a device with data, causing it to crash. It does not involve stealing data from the device.

Thus, Bluesnarfing is the attack specifically aimed at stealing data from a device via Bluetooth.

Correct Answer:

Private is correct.

Clouds can be deployed as public, private, community, or hybrid. A private cloud (sometimes called a single-tenant cloud) is operated solely for one customer.

Incorrect Answers:

IaaS, SaaS, and hybrid are incorrect.

IaaS is a cloud type providing virtualized servers.

SaaS is a cloud type providing software as a service.

Hybrid is a deployment model combining public and private.

Correct Answer:

False acceptance rate (FAR) is correct.

False acceptance rate (FAR) is the term for the percentage of time an unauthorized user is granted access by the biometric system. Obviously, the lower this number, the better.

Incorrect Answers:

False rejection rate (FRR), crossover error rate (CER), and none are incorrect.

The false rejection rate (FRR) is the percentage of time an authorized user will be rejected by a biometric system.

The crossover error rate (CER) is the intersection of the FAR and FRR—the lower the score, the better.