Correct answer:

An attacker will usually try to evade detection during a reconnaissance attempt by reducing attack speed and/or request volume in order to not trigger any IDS/IPS (or similar security device) alerts.

Incorrect answer:

Gain administrator access is incorrect because an attacker wouldn’t gain administrator access during a reconnaissance attempt, which is something that would take place during exploitation.

Increase request volume is incorrect because increasing the request volume would increase the odds of any activity being identified by security devices. Decreasing the volume of such requests would be the proper way to go.

Use manual exploits is incorrect because using manual exploits is an action that would take place when someone tries to actively attack the network, not something that would happen during a reconnaissance phase, which is when information is being gathered.

Correct answers:

Physical access controls include items you can touch. Examples of physical access controls include locked doors, alarm systems, guards, cipher locks, and cameras.

Incorrect answer:

Account lockout is a technical control that can be used to lock out an account after too many incorrect password attempts.

Correct answer:

When using RAID 1, data is written (being mirrored) to both drives. That way, if one of them fails, the data is fully recoverable from the remaining drive. This also makes recovery from such a state a fairly straightforward process, as data doesn’t need rebuilding. Once the faulty drive is replaced, the data needs to be copied to it.

Incorrect answers:

RAID 0 uses striping, not mirroring. The disadvantage of this RAID type is that it doesn’t offer any fault tolerance, as data is being written across to two different drives. That means that if one of the drives fails, all data is lost. It does, however, offer really good read/write performance, which is the predominant reason for using it.

RAID 5 uses striping, not mirroring. The main difference with RAID 1 is that parity is also being used in RAID 5 (which needs at least three drives), thus making it possible to reconstitute data if a single drive fails.

RAID 6 uses striping, not mirroring. It is similar to RAID 5, but the main difference is that parity data is written on two drives (using at least four drives in total), extending the fault tolerance of the model to two drives. That means that if two disks fail, the parity data is still sufficient to reconstitute the information that was contained on the faulty drives.

Correct answer:

RSA uses large prime numbers. Its strength lies in the fact that it is computationally infeasible to factor the composite number created from these prime numbers as long as the prime numbers are sufficiently large.

Incorrect answers:

RSA uses public and private keys in a matched pair, and the keys in the pair are not changed.

Keys are varying sizes and not always over 2,048 bits.

The private key is kept private, but the public key is shared.

Correct answer:

One main concern with any devices connected in read-only mode to a corporate machine is that even if an antivirus is in place to scan the external drives for any malicious items, it won’t be able to delete related artifacts if the drive is not writable. However, any malicious files can be copied from that device to the company machine.

Incorrect answers:

The policy has been implemented by the company on purpose. As such, a great benefit is not allowing any of the company employees to transfer corporate documents to external drives in order to limit data loss, which doesn’t make this a concern.

The fact that USB drives may be lost or stolen shouldn’t concern the business if no company data is present on those, which is what is being enforced with having USB drives only connect in read-only mode. Please note that there are always ways to circumvent policies. This doesn’t account for a user uploading company data to a cloud account and then using a USB drive to store that. However, the question doesn’t aim to address policy circumventions, but rather to focus on immediate gains and consequences of having devices connect to a machine only in read-only mode.

Not all of the answer options pose a concern.

Correct answers:

Layer 2 Tunneling Protocol (L2TP), Transport Layer Security (TLS), and Internet Protocol security (IPsec) can all be used as VPN tunneling protocols.

Incorrect answer:

Secure Real-time Transport Protocol (SRTP) provides confidentiality, message authentication, and replay protection for audio and video traffic, including VoIP. It is not used as a virtual private network (VPN) tunneling protocol.

Correct answer:

A smurf attack uses ICMP (Internet Control Message Protocol) ping broadcast packages, while spoofing the source IP address of those, to make it look like the originating traffic was sourced from the system being attacked. That way, the ICMP replies would then reach the target, which would be overwhelmed by excessive traffic.

Incorrect answers:

A smurf attack doesn’t use TCP (Transmission Control Protocol).

A smurf attack doesn’t use UDP (User Datagram Protocol), which is something that is used by a fraggle attack.

A smurf attack doesn’t use DNS (Domain Name System).

Correct answer:

File integrity checkers work by recalculating hashes of files at regular intervals. That doesn’t take place when a system is powered on. Various systems (i.e., servers) rarely restart or power off. In addition, if a change is made to a critical file, it would be ideal if that can be identified as soon as possible, which would be the case if the file integrity checker performs periodic checks.

Incorrect answers:

File integrity checkers periodically compute file hashes and compare them with the ones that were previously calculated. If the hashes don’t match, that’s an indication that a modification took place.

File integrity checking aims to detect any file changes. However, note that various files are modified legitimately all the time, so all of those can be excluded from any checks. Usually, a file checker will monitor the state of critical system files and alert upon any unauthorized modification of those.

Most file integrity checkers can often be configured to alert (i.e., send an e-mail) a system administrator or security analyst each time a critical file has been modified in order for further investigation to be performed.

Correct answer:

A risk assessment looks at risks at a specific time and needs to be repeated periodically to ensure that current risks are assessed.

Incorrect answers:

While a risk assessment will attempt to look at known threats and vulnerabilities, it’s unlikely it will uncover all threats or all vulnerabilities.

Risk management (not a risk assessment) is an ongoing practice.

Correct answer:

The drive should be copied before it is examined. Forensic experts use bit-copy or drive-imaging tools to capture the contents of a drive without modifying the data. This copy is known as a forensic duplicate image. While not given as a possible answer, the forensic expert would create a hash from the original drive before copying it. This can be used to verify the bit-copy didn’t modify the data.

Incorrect answers:

Volatile memory is not on the hard drive.

A chain of custody should be created. A chain-of-custody (not a chain-of-evidence) document shows exactly where a piece of evidence is from the point it is collected until it is disposed.

A sanitization tool can write ones and zeroes across a drive to sanitize it, but this would remove all evidence