George, a certified security professional, was hired by an organization to ensure that the server accurately responds to customer requests. In this process, George employed a security solution to monitor the network traffic toward the server. While monitoring the traffic, he identified attack signatures such as SYN flood and ping of death attempts on the server. Which of the following categories of suspicious traffic signature has George identified in the above scenario?
Correct Answer: D
Denial-of-service (DoS) is the category of suspicious traffic signature that George identified in the above scenario. DoS signatures are designed to detect attempts to disrupt or degrade the availability or performance of a system or network by overwhelming it with excessive or malformed traffic. SYN flood and ping of death are examples of DoS attacks that exploit the TCP/IP protocol to consume the resources or crash the target server. A SYN flood attack sends a large number of TCP SYN packets to the targetserver, without completing the three-way handshake, thus creating a backlog of half-open connections that exhaust the server's memory or bandwidth. A ping of death attack sends a malformed ICMP echo request packet that exceeds the maximum size allowed by the IP protocol, thus causing the target server to crash or reboot.DoS attacks can cause serious damage to the organization's reputation, productivity, and revenue, and should be detected and mitigated as soon as possible123.References: * Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34 * What is a denial-of-service attack?, Cloudflare, 2020 * Denial-of-service attack - Wikipedia, Wikipedia, March 16, 2021
Question 2
Barbara, a security professional, was monitoring the loT traffic through a security solution. She identified that one of the infected devices is trying to connect with other loT devices and spread malware onto the network. Identify the port number used by the malware to spread the infection to other loT devices.
Correct Answer: D
Port 48101 is the port number used by the malware to spread the infection to other loT devices. This port is associated with the Mirai botnet, which is one of the most notorious loT malware that targets vulnerable loT devices and turns them into a network of bots that can launch distributed denial-of-service (DDoS) attacks. Mirai scans the internet for loT devices that use default or weak credentials and infects them by logging in via Telnet or SSH. Once infected, the device connects to a command and control (C&C) server on port 48101 and waits for instructions. The C&C server can then direct the botnet to attack a target by sending TCP, UDP, or HTTP requests. Mirai has been responsible for some of the largest DDoS attacks in history, such as the one that disrupted Dyn DNS in 2016 and affected major websites like Twitter, Netflix, and Reddit.References: * Mirai (malware), Wikipedia, March 16, 2021 * Mirai Botnet: A History of the Largest loT Botnet Attacks, Imperva, December 10, 2020 * Mirai Botnet: How loT Devices Almost Brought Down the Internet, Cloudflare, March 17, 2021
Question 3
Which of the following environmental controls options saves the hardware from humidity and heat, increases hardware performance, and maintains consistent room temperature?
Correct Answer: A
Hot and cold aisles are a type of environmental control that saves the hardware from humidity and heat, increases hardware performance, and maintains consistent room temperature. Hot and cold aisles are a layout design for data centers, where the server racks are arranged in alternating rows of cold air intake and hot air exhaust. The cold aislefaces the air conditioner output ducts and provides cool air to the front of the servers. The hot aisle faces the air conditioner return ducts and collects the hot air from the back of the servers. This way, the hot and cold air streams are separated and do not mix, resulting in better cooling efficiency, lower energy consumption, and longer hardware lifespan.References: * Hot and cold aisles- Week 4: Network Security Controls: Physical Controls * Hot and Cold Aisles: The Basics of Data Center Cooling * Hot Aisle vs. Cold Aisle Containment: Which One is Best for Your Data Center?
Question 4
Which of the following solutions is a software or a hardware device on a network or host that filters the incoming and outgoing traffic to prevent unauthorized access to private networks?
Correct Answer: A
A firewall is a software or a hardware device on a network or host that filters the incoming and outgoing traffic to prevent unauthorized access to private networks. A firewall can use various criteria, such as IP addresses, ports, protocols, or application rules, to allow or deny the traffic. A firewall can also perform other functions, such as logging, auditing, encryption, or proxy services.A firewall can be deployed at different levels of a network, such as network perimeter, network segment, or host level12.References:Network Defense Essentials - EC-Council Learning,Firewall (computing) - Wikipedia
Question 5
Finch, a security auditor, was assigned the task of providing devices to all the employees to enable work from remote locations. Finch restricted the devices to work only for organization-relatedtasks, and not for personal use. Which of the following mobile usage policies has Finch implemented in the above scenario?
Correct Answer: B
Finch has implemented the COBO (Corporate-Owned, Business-Only) mobile usage policy in the above scenario. COBO is a policy where the organization provides mobile devices to the employees and restricts them to use the devices only for work-related purposes. The organization has full control over the devices and can enforce security measures, such as encryption, password protection, remote wipe, and application whitelisting or blacklisting. The employees are not allowed to use the devices for personal use, such as browsing the internet, making personal calls, or installing personal apps. COBO is a policy that aims to maximize security and minimize distractions and risks for the organization and the employees.References: * Mobile usage policy in office - sample, cell phone policy in companies and organization, HR Help Board, 2020 * Employee Cell Phone Policy Template, Workable, 2020 * How Employers Enforce Cell Phone Policies in the Workplace, Indeed, 2022
