CCNA Cybersecurity Operations (Vesion 1.1) – CyberOps Chapter 10 Exam Answers

Which class of metric in the CVSS Basic metric group defines the features ofthe exploit such as the vector, complexity, and user interaction required by the exploit?
- Impact
- Exploitability *
- Modified Base
- Exploit Code Maturity
Which step in the Vulnerability Management Life Cycle performs inventory of all assets across the network and identifies host details, including operating system and open services?
- Assess
- Discover *
- Remediate
- Prioritize assets
In network security assessments, which type of test is used to evaluate the risk posed by vulnerabilities to a specific organization, including assessment of the likelihood of attacks and the impact of successful exploits on the organization?
- Risk analysis *
- Port scanning
- Penetration testing
- Vulnerability assessment
In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?
- intrusion detection and prevention
- anti-phishing
- telemetry
- safe browsing
On a Windows host, which tool can be used to create and maintain blacklists and whitelists?
- Group Policy Editor
- Local Users and Groups
- Computer Management
- Task Manager
Which statement describes agentless antivirus protection?
- Host-based antivirus systems provide agentless antivirus protection.
- The antivirus protection is provided by the router that is connected to a cloud service.
- The antivirus protection is provided by the ISP.
- Antivirus scans are performed on hosts from a centralized system.
In network security assessments, which type of test employs software to scan internal networks and Internet facing servers for various types of vulnerabilities?
- risk analysis
- penetration testing
- vulnerability assessment
- strength of network security testing
The IT security personnel of an organization notice that the web server deployed in the DMZ is frequently targeted by threat actors. The decision is made to implement a patch management system to manage the server. Which risk management strategy method is being used to respond to the identified risk?
- risk avoidance
- risk retention
- risk reduction
- risk sharing
In addressing a risk that has low potential impact and relatively high cost of mitigation or reduction, which strategy will accept the risk and its consequences?
- risk reduction
- risk avoidance
- risk retention
- risk sharing
Which three devices are possible examples of network endpoints? (Choose three.)
- Router
- Sensor *
- Wireless AP
- IoT controller *
- VPN appliance
- Network security camera *
Which antimalware software approach can recognize various characteristics of known malware files to detect a threat?
- Routing-based
- Behavior-based
- Signature-based *
- Heuristics-based
As described by the SANS Institute, which attack surface includes the exploitation of vulnerabilities in wired and wireless protocols used by IoT devices?
- Human Attack Surface
- Internet Attack Surface
- Network Attack Surface *
- Software Attack Surface
In profiling a server, what defines what an application is allowed to do or run on a server?
- User accounts
- Listening ports
- Service accounts *
- Software environment
What is a host-based intrusion detection system (HIDS)?
- It identifies potential attacks and sends alerts but does not stop the traffic.
- It detects and stops potential direct attacks but does not scan for malware.
- It is an agentless system that scans files on a host for potential malware.
- It combines the functionalities of antimalware applications with firewall protection.
What type of antimalware program is able to detect viruses by recognizing various characteristics of a known malware file?
- behavior-based
- agent-based
- signature-based
- heuristic-based
Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?
- firewall
- workstation
- server
- switch
Which criterion in the Base Metric Group Exploitability metrics reflects the proximity of the threat actor to the vulnerable component?
- user interaction
- attack vector
- attack complexity
- privileges required
In addressing an identified risk, which strategy aims to stop performing the activities that create risk?
- risk reduction
- risk avoidance
- risk retention
- risk sharing
Which security procedure would be used on a Windows workstation to prevent access to a specific set of websites?
- whitelisting
- HIDS
- blacklisting
- baselining
Which statement describes the use of a Network Admission Control (NAC) solution?
- It provides network access to only authorized and compliant systems.
- A Network Admission Control solution provides filtering of potentially malicious emails before they reach the endpoint.
- It provides endpoint protection from viruses and malware.
- It provides filtering and blacklisting of websites being accessed by end users.
Which statement describes the Cisco Threat Grid Glovebox?
- It is a network-based IDS/IPS.
- It is a firewall appliance.
- It is a host-based intrusion detection system (HIDS) solution to fight against malware
- It is a sandbox product for analyzing malware behaviors.
Which type of antimalware software detects and mitigates malware by analyzing suspicious activities?
- heuristics-based
- packet-based
- behavior-based
- signature-based
Which regulatory compliance regulation sets requirements for all U.S. public company boards, management and public accounting firms regarding the way in which corporations control and disclose financial information?
- Gramm-Leach-Bliley Act (GLBA)
- Health Insurance Portability and Accountability Act (HIPAA)
- Federal Information Security Management Act of 2002 (FISMA)
- Sarbanes-Oxley Act of 2002 (SOX)
Which statement describes the term attack surface?
- It is the total sum of vulnerabilities in a system that is accessible to an attacker.
- It is the group of hosts that experiences the same attack.
- It is the network interface where attacks originate.
- It is the total number of attacks toward an organization within a day.
Which step in the Vulnerability Management Life Cycle determines a baseline risk profile to eliminate risks based on asset criticality, vulnerability threat, and asset classification?
- assess
- discover
- verify
- prioritize assets
When a network baseline is being established for an organization, which network profile element indicates the time between the establishment of a data flow and its termination?
- session duration
- critical asset address space
- ports used
- total throughput
Which statement describes the term iptables?
- It is a file used by a DHCP server to store current active IP addresses.
- It is a DHCP application in Windows.
- It is a DNS daemon in Linux.
- It is a rule-based firewall application in Linux.
For network systems, which management system addresses the inventory and control of hardware and software configurations?
- asset management
- vulnerability management
- risk management
- configuration management
Which statement describes the anomaly-based intrusion detection approach?
- It compares the signatures of incoming traffic to a known intrusion database.
- It compares the antivirus definition file to a cloud based repository for latest updates.
- It compares the operations of a host against a well-defined security policy.
- It compares the behavior of a host to an established baseline to identify potential intrusions.
What is the first step taken in risk assessment?
- Identify threats and vulnerabilities and the matching of threats with vulnerabilities.
- Establish a baseline to indicate risk before security controls are implemented.
- Compare to any ongoing risk assessment as a means of evaluating risk management effectiveness.
- Perform audits to verify threats are eliminated.
Which statement describes the threat-vulnerability (T-V) pairing?
- It is the identification of threats and vulnerabilities and the matching of threats with vulnerabilities.
- It is the comparison between known malware and system risks.
- It is the detection of malware against a central vulnerability research center.
- It is the advisory notice from a vulnerability research center.
Which two classes of metrics are included in the CVSS Base Metric Group? (Choose two.)
- Modified Base
- Confidentiality Requirement
- Exploit Code Maturity
- Exploitability
- Impact metrics
Which two criteria in the Base Metric Group Exploitability metrics are associated with the complexity of attacks? (Choose two)
- scope
- attack complexity
- user interaction
- attack vector
- privileges required