26 questions · Technology Essentials · All types, answers revealed
You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?
AIDE creates a database of file hashes and compares them to detect changes.
Why this answer
AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that monitors system files against a baseline hash database.
What is the function of the 'netstat' command in a Windows environment?
Netstat is the standard command for listing current network state.
Why this answer
Netstat displays active TCP connections, listening ports, and routing tables, which is critical for network troubleshooting.
You are tasked with securing a database connection. Which technology is best for ensuring data in transit is encrypted?
TLS ensures encrypted, authenticated communication between the client and the database server.
Why this answer
TLS (Transport Layer Security) is the industry standard for encrypting data in transit between clients and databases.
You are investigating a network segment using a protocol analyzer. You see traffic with the RST flag set. What does this typically signify?
RST is used to abruptly close a connection, often when a connection is refused or reset.
Why this answer
The RST (Reset) flag in TCP is used to immediately close a connection, often due to an error or an attempt to terminate a rejected session.
Which protocol is most appropriate for secure remote management of network infrastructure devices?
SSH provides strong encryption for remote administrative sessions.
Why this answer
SSH (Secure Shell) provides encrypted remote access, whereas Telnet, HTTP, and SNMPv1 are insecure.
Which TWO of the following are essential components of a secure network design for a segmented corporate network?
VLANs divide the network into logical segments.
Why this answer
VLANs provide logical isolation, and Firewalls provide traffic control between those segments.
Which TWO of the following are common indicators of a compromised system found during host-based log analysis?
This often signals C2 activity.
Why this answer
Unexpected outbound connections and the creation of new administrative accounts are classic signs of a breach.
You are hardening a virtual machine's security. Which action is the most effective way to prevent VM escape attacks?
Most escape attacks exploit known vulnerabilities in these components.
Why this answer
Keeping the hypervisor and guest tools updated is the primary defense against vulnerabilities that allow a VM to compromise the host.
You have identified a rogue DHCP server on your network. Which switch feature should be implemented to prevent this in the future?
DHCP Snooping allows administrators to specify trusted ports that are authorized to provide DHCP responses.
Why this answer
DHCP Snooping is the standard feature used to validate DHCP messages and prevent rogue server injection.
Which TWO of the following are primary security controls for securing virtual machines in a production environment?
The hypervisor is the foundation; it must be secure against escape vulnerabilities.
Why this answer
Hypervisor hardening and regular patching are essential to prevent VM escape and local exploits.
When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?
Bridged mode bypasses host-level NAT, making the VM visible to other hosts on the LAN.
Why this answer
Bridged networking gives the VM its own IP on the physical network, exposing it directly to network-based attacks like the host machine.
You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?
This tool computes the final permissions for an account based on group memberships and explicit ACLs.
Why this answer
The 'Effective Access' tab in Windows Advanced Security Settings is the standard method for auditing actual permissions for a specific security principal.
Which THREE of the following are standard best practices for securing cloud infrastructure?
Logging provides the necessary visibility for forensic analysis.
Why this answer
Least privilege, MFA, and audit logging are fundamental cloud security pillars.
You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?
This limits the impact if the application is compromised.
Why this answer
Applications should always run with the minimum necessary permissions, usually as a dedicated service account with restricted access.
Which THREE of the following are common steps in performing a security audit of a Linux system?
Checking for over-privileged accounts helps prevent lateral movement.
Why this answer
Checking running processes, user account permissions, and listening ports are key to finding unauthorized activity.
You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?
This directive ensures the page can only be displayed in frames on the same site.
Why this answer
The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.
A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?
Explicit Deny entries in Windows ACLs take precedence over Allow permissions.
Why this answer
In Windows, an explicit 'Deny' permission always overrides any 'Allow' permissions granted through other groups.
In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?
This restricts traffic to the necessary port and limits access to the specific subnet.
Why this answer
The principle of least privilege dictates specifying the exact port and source CIDR block rather than using broad '0.0.0.0/0' entries.
An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?
This cmdlet supports SHA256 and other algorithms to verify file integrity.
Why this answer
Get-FileHash is the native PowerShell cmdlet for calculating file integrity hashes like SHA256.
Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?
Logs capture the malicious input payloads used in the attack.
Why this answer
Input sanitization, database query logic, and logs are the primary areas to investigate during an injection incident.
You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?
CloudTrail provides a comprehensive history of API calls made by users, roles, and services.
Why this answer
AWS CloudTrail records all API activity within an AWS account, including the identity and source of the request.
In the context of the principle of least privilege, why should you avoid using a root or administrator account for daily system administration?
Least privilege limits the damage potential of errors and malware.
Why this answer
Using a high-privilege account for daily tasks increases the risk that an accidental error or a compromised process will have full system control.
During a forensic investigation, you find an entry in the Windows Registry under 'Run' keys. How can you determine if this entry is malicious?
Legitimate services are almost always digitally signed by a trusted publisher.
Why this answer
Checking the 'Image Path' and verifying the digital signature of the file are necessary to confirm if a startup entry is legitimate.
Which of the following best describes the function of a 'container runtime' in a virtualization environment?
Runtime components like containerd or runc are responsible for launching and managing container processes.
Why this answer
The container runtime is responsible for executing containers and managing image layers and namespaces.
When reviewing cloud storage buckets, you find one is configured with 'public read access'. What is the risk?
Anyone on the internet can read and download the bucket's content.
Why this answer
Public read access allows anyone on the internet to list and download the contents of the bucket, leading to data exposure.
A Windows server shows high disk I/O. Which tool can identify which specific process is performing the most write operations?
Resource Monitor provides a detailed breakdown of disk I/O per process.
Why this answer
Resource Monitor is the standard Windows utility for granular monitoring of per-process disk, CPU, and memory activity.
Ready to test yourself?
Try a timed practice session using only Technology Essentials questions.