Correct answer:

Recasting a risk changes the severity level of the risk. In this scenario, the risk is recast from a lower-level risk to one more severe.

Incorrect answers:

To avoid the risk, the organization could choose to eliminate the web server.

An organization could transfer or share the risk by purchasing insurance.

Security control recommendations would mitigate the risk, but only after they are implemented.

Correct answer:

A business impact analysis (BIA) is part of a business continuity plan (BCP) and it identifies the impact to the organization if any business functions are lost due to any type of incident.

Incorrect answers:

A disaster recovery plan (DRP) provides an organization with a plan to restore critical operations after a disaster.

The BIA is an important part of a BCP, but the BCP is much broader.

Annual loss expectancy (ALE) is used in a quantitative analysis of a risk assessment.

Correct answer:

A packet-filtering firewall typically uses an implicit deny rule, placed at the end of the access control list (ACL). All traffic is blocked (implicitly denied) unless there is a rule in the ACL that explicitly allows the traffic.

Incorrect answers:

Defense diversity uses more than one brand of firewall in a demilitarized zone (DMZ).

Explicit deny includes the rule.

Defense in depth includes multiple layers of security.

Correct answers:

A content-filtering appliance can filter spam and malware going into a network, and provide proxy server services.

Incorrect answer:

A honeypot is a server with fake content designed to attract an attacker. It is not part of a content-filtering appliance.

Correct answer:

Elliptic curve cryptography (ECC) is often used in smaller mobile devices because it requires less processing power than other solutions. It uses a mathematically defined curve to create relatively smaller public and private keys when compared to other solutions.

Incorrect answers:

RSA is strong, but it requires larger keys and more processing power.

A 256-bit ECC key provides similar strength as a 3072-bit RSA key.

Advanced Encryption Standard (AES) and Triple Data Encryption Standard (3DES) are symmetric encryption algorithms.

Correct answer:

An anomaly-based intrusion detection system (IDS) attempts to document normal behavior in the form of a baseline. It then monitors the activity and constantly compares it to the baseline, looking for anomalies.

Incorrect answers:

A signature-based (not anomaly-based) detection method uses signatures.

A reporting subsystem or e-mail server is not needed for the detection of potential intrusions.

Correct answer:

A distributed denial of service (DDoS) attack comes from multiple sources and attempts to reduce a system’s ability to respond to legitimate requests for services. When effective, it reduces the operability of the system.

Incorrect answers:

While the DDoS attack may be coming from systems in a botnet, the scenario doesn’t give enough information to make that conclusion.

An insider threat is from personnel within the organization, such as a disgruntled employee.

A data theft results in loss of data, but the scenario doesn’t mention data loss.

Correct answer:

Addresses starting with 192.168 are designated as private IP addresses and are not routed on the Internet.

Incorrect answers:

Private IP addresses are designated in RFC 1918 in the following ranges: 10.0.0.0 through 10.255.255.255.255, 172.16.0.0 through 172.31.255.255, and 192.168.0.0 through 192.168.255.255.

Correct answer:

Secure Hashing Algorithm 3 (SHA-3) is a stronger hashing algorithm than Message Digest 5 (MD5). This is one of many examples where you’ll be expected to know which acronyms represent hashing algorithms and which acronyms represent encryption algorithms.

Incorrect answers:

MD5 has known vulnerabilities and it is no longer recommended for use.

Advanced Encryption Standard (AES) is a symmetric encryption algorithm.

Transport Layer Security (TLS) is used to encrypt traffic over the Internet.

Correct answer:

A digital signature provides nonrepudiation with the use of asymmetric cryptography. An audit trail provides nonrepudiation by logging the actions of logged-in users. Nonrepudiation prevents individuals from believably denying they took an action.

Incorrect answers:

A salt is a set of bits added to passwords or encryption keys to thwart brute-force attacks, but the salt does not provide nonrepudiation.

A rainbow table is a table of guessed passwords and hashes.

Salting hashed passwords thwarts rainbow table attacks.