Correct answer:

E-mail is encrypted with the recipient’s public key and can be decrypted only with the recipient’s private key. A more detailed answer is that the recipient’s public key is used to encrypt a symmetric key and the symmetric key is used to encrypt the actual e-mail, but of the given choices, only the recipient’s public key is used in the encryption process.

Incorrect answers:

The recipient does not have access to the sender’s private key.

The sender’s keys are not used for encryption of e-mail sent to another person.

Correct answer:

An iris scan has the advantage of being almost as accurate as the retina scan, while at the same time it doesn’t require users to come in physical contact with the scanner, thus having increased user acceptance.

Incorrect answers:

Although a retina scanner is highly accurate, it requires physical contact with the scanner, which due to how it operates may result in revealing an individual’s underlying medical conditions. That fact makes it less acceptable for the majority of the users.

Keystroke dynamics isn’t as accurate as an iris scan.

Because a fingerprint is also less accurate than an iris scan.

Correct answer:

SNMPv3 is able to support device authentication and data encryption, which ensure that data originates from a valid entity and the confidentiality of information is maintained.

Incorrect answers:

Neither of SNMPv1 or SNMPv2 versions support encryption.

There’s no SNMPv4.

Correct answer:

The private key is kept private and not shared in the certificate with others.

Incorrect answers:

The certificate will have an expiration date, the name of the certificate authority (CA) that issued it, and the name of the server or the website. It will also include the public key.

Correct answer:

The Remote Authentication Dial-In User Service (RADIUS) is a service that provides centralized authentication, authorization, and accounting (AAA) for virtual private network (VPN) clients.

Incorrect answers:

Layer 2 Tunneling Protocol (L2TP) and Point-to-Point Tunneling Protocol (PPTP) are tunneling protocols used with some remote access solutions. Kerberos is used for network authentication.

Correct answer:

All other options might be typical activities for most company administrators. However, backing up company data (since the question mentions activity on the corporate network) to Google drive is not really standard behavior. Usually, companies would have some third-party cloud provider (like Azure or AWS) and would rarely allow Google Drive use for uploading corporate data (with the exception of some companies that might be using it for that purpose, but that’s not something that is mentioned here).

Incorrect answers:

An administrator could easily be watching a video to see how an administration task is being performed, and YouTube is a fairly common website used for that purpose. There’s certainly no indication in the context of the question to suggest that some type of policy violation is taking place.

Running a PowerShell script is a common method of automating various tasks (i.e., setting local security policies, interrogating systems for information, configuring settings using Config Manager, and many more).

Macros are commonly used by a variety of users (including administrators) for many tasks like inserting company-formatted data (i.e., company letterhead), document templates, data manipulation, filtering, and a lot more, so this activity doesn’t necessarily mean there’s something worthy of further investigation.

Correct answer:

The alert was generated at the time that James attempted to connect to the company network most likely because the company hasn’t enabled its system to allow for any non–U.S.-originating connections (since the company is U.S. based and its employees are only expected to work within the country). However, this is not malicious activity, as James is a valid company employee, thus classifying this event as a “false positive” (meaning an alert was raised without any hostile activity taking place).

Incorrect answer:

True positive is incorrect because a “true positive” occurs when a security device correctly identifies an attack that is occurring and raises an alert to notify the security team or administrator of that fact. However, no actual attack is taking place in this scenario.

True negative is incorrect because a “true negative” event means that there was no suspicious traffic worthy of raising an alert and the security device correctly didn’t raise any alert. However, in the question, although there was no suspicious traffic, an alert was raised.

False negative is incorrect because a “false negative” occurs when a security device fails to generate an alert although a valid attack is taking place (meaning it is unable to detect it). However, no attack was taking place in this example.

Correct answer:

One type of whitelisting restricts the software that can run on a system to specific applications or services.

Incorrect answers:

Signature-based and anomaly-based are two types of detection methods for intrusion detection systems (IDSs) and intrusion prevention systems (IPSs), but they don’t use whitelisting.

Media access control (MAC) filtering is another type of whitelisting, but uses MAC addresses to restrict traffic to specific systems.

Correct answers:

IPsec provides authentication and integrity with Authentication Header (AH).

IPsec with Encapsulating Security Protocol (ESP) provides authentication, integrity, and confidentiality. 

Incorrect answer:

Internet Protocol security (IPsec) does not provide availability.

Correct answer:

A differential backup backs up all the data since the last full backup. A full/differential backup strategy takes longer to back up during the week than a full/incremental strategy. However, the recovery time is reduced because a maximum of two backups are needed to recover the data. 

Incorrect answers:

An incremental backup (used in a full/incremental backup strategy) backs up all the data since the last backup (full or incremental).

A full backup would back up all the data, not just the data that has changed.

Failover clusters are used to provide fault tolerance for servers.