Correct answer:

The protocol number for Internet Control Message Protocol (ICMP) is 1 and a packet-filtering firewall can filter traffic based on the protocol number by using an access control list (ACL).

Incorrect answers:

The protocol number for Transmission Control Protocol (TCP) is 6. ICMP is not identified by a port. Although not included in this question, the protocol number for Internet Group Message Protocol (IGMP) is 2, User Datagram Protocol (UDP) is 17, Internet Protocol security (IPsec) AH is 51, and IPsec Encapsulating Security Protocol (ESP) is 50.

Correct answer:

Preserving the evidence is the primary responsibility of a first responder.

Incorrect answers:

First responders do not analyze or investigate evidence and they should not remove evidence.

Correct answer:

Secure Hashing Algorithm 3 (SHA-3) provides one-way encryption by creating a hash from a file or message, but the hash cannot be used to re-create the original data. This is one of many examples where you’ll be expected to know which acronyms represent hashing algorithms and which acronyms represent encryption algorithms.

Incorrect answers:

Steganography hides data, but the original data can be retrieved.

RSA is an asymmetric encryption algorithm, RC4 is a symmetric encryption algorithm, and both provide two-way encryption.

Correct answer:

A warm site is a compromise between a cold site and a hot site. It would have more than just a building with a roof, running water, and electricity, but it wouldn’t have all the resources needed to go active within minutes.

Incorrect answers:

A cold site is a building with a roof, running water, and electricity. It doesn’t include hardware, software, or personnel.

A hot site includes all of the resources necessary to take over the operations of another location in a very short period of time, sometimes within minutes.

There is no such thing as a business continuity plan (BCP) site as an alternate location.

Correct answer:

File Transfer Protocol (FTP) uses Transmission Control Protocol (TCP) for guaranteed delivery, and Trivial FTP (TFTP) uses User Datagram Protocol (UDP) for best-effort delivery.

Incorrect answers:

FTP does not use UDP and TFTP does not use TCP.

Correct answer:

Wi-Fi Protected Access 2 (WPA2) Personal uses a preshared key (PSK) instead of requiring users to authenticate with credentials.

Incorrect answers:

Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is used with WPA and WPA2. CCMP is based on Advanced Encryption Standard (AES), a strong encryption algorithm. However, the terms CCMP Personal and CCMP Enterprise aren’t valid terms for wireless security.

WPA2 Enterprise uses an 802.1X authentication server to increase wireless security, but it requires users to authenticate rather than just using a PSK. In other words, Personal mode uses a PSK and Enterprise mode uses an authentication server, but the question specifically states that a preshared key should be used.

Correct answer:

You can check the system against a baseline to determine whether it has been modified. Part of configuration management is the establishment of a baseline configuration, and this is often done with imaging.

Incorrect answers:

If the server is reimaged, it will be returned to the original configuration, but this does not indicate whether it has been modified.

Change management logs will identify authorized changes, but not unauthorized changes, so this may not be accurate.

Asking administrators isn’t as reliable as a comparison to the baseline.

Correct answer:

A botnet is group of computers (called zombies) controlled by an attacker via a command and control center. Computers are enlisted in a botnet after being infected with malicious software (malware).

Incorrect answers:

Botnets do not track malware activity, nor do they launch physical attacks with actual robots.

A honeypot (not a botnet) is a server hosted by an organization to attract attackers so that the organization can observe their methods.

Correct answer:

Personally identifiable information (PII) is any information that can be used to distinguish or trace an individual’s identity, and many laws mandate its protection.

Incorrect answers:

Sensitive data includes internal information that requires special precautions to protect, such as financial information about a company.

Internal procedures and internal policies are important internally, but not protected by laws.

Correct answer:

Subject attributes—or in this case, user attributes—can be used to apply restrictions for remote access.

Incorrect answers:

Access is restricted for objects (such as a remote access server) through permissions, not attributes.

A password policy mandates specific characteristics for passwords, and synchronous tokens can be used for authentication, but these do not restrict access for users.