GSNA questions and answers

Explanation:

COSO defines internal control as, "a process, influenced by an entity's board of directors, management, and other personnel, that is designed to provide reasonable assurance in the effectiveness and efficiency of operations, reliability of financial reporting, and the compliance of applicable laws and regulations". The auditor evaluates the organization's control structure by understanding the organization's five interrelated control components, which are as follows:

1. Control Environment: It provides the foundation for the other components and encompasses such factors as management's philosophy and operating style.
2. Risk Assessment: It consists of risk identification and analysis.
3. Control Activities: It consists of the policies and procedures that ensure employees carry out management's directions.

The types of control activities an organization must implement are preventative controls (controls intended to stop an error from occurring), detective controls (controls intended to detect if an error has occurred), and mitigating controls (control activities that can mitigate the risks associated with a key
control not operating effectively).
4. Information and Communication: It ensures the organization obtains pertinent information, and then communicates it throughout the organization.
5. Monitoring: It involves reviewing the output generated by control activities and conducting special evaluations. In addition to understanding the organization's control components, the auditor must also evaluate the organization's General and Application controls. There are three audit risk components: control risk, detection risk, and inherent risk.

Explanation:
Circuit-level firewall operates at the Session layer of the OSI model. This type of firewall regulates traffic based on whether or not a trusted connection has been established.

Explanation:
According to the question, the network is a routed network where two segments have been divided and each segment has a switch. These switches are connected to a common router. All workstations in a segment are connected to their respective subnet's switches.
Failure of the switch in Subnet B will make all workstations connected to it offline. Moreover, communication between the two subnets will be affected, as there will be no link to connect to Subnet B.

Explanation:
The more command is used to view (but not modify) the contents of a text file on the terminal screen at a time. The syntax of the more command is as follows: more [options] file_name Where,

Answer: A is incorrect. The concatenate (cat) command is used to display or print the contents of a file.Syntax: cat filename For example, the following command will display the contents of the /var/log/ dmesg file: cat /var/log/dmesg
Note: The more command is used in conjunction with the cat command to prevent scrolling of the screen while displaying the contents of a file.
Answer: C is incorrect. The less command is used to view (but not change) the contents of a text file, one screen at a time. It is similar to the more command. However, it has the extended capability of allowing both forward and backward navigation through the file. Unlike most Unix text editors/viewers, less does not need to read the entire file before starting; therefore, it has faster load times with large files. The command
syntax of the less command is as follows: less [options] file_nameWhere,

Answer: B is incorrect. The tail command is used to display the last few lines of a text file or piped data.

Explanation:
Cain is a multipurpose tool that can be used to perform many tasks such as Windows password cracking, Windows enumeration, and VoIP session sniffing. This password cracking program can perform the following types of password cracking attacks:
1. Dictionary attack
2. Bruteforce attack
3. Rainbow attack
4. Hybrid attack Answer: A is incorrect. L0phtcrack is a tool which identifies and remediate security vulnerabilities that result from the use of weak or easily guessed passwords. It recovers Windows and Unix account passwords to access user and administrator accounts.
Answer: D is incorrect. John the Ripper is a fast password cracking tool that is available for most versions of UNIX, Windows, DOS, BeOS, and Open VMS. It also supports Kerberos, AFS, and Windows NT/2000/ XP/2003 LM hashes. John the Ripper requires a user to have a copy of the password file.
Answer: B is incorrect. Obiwan is a Web password cracking tool that is used to perform brute force and hybrid attacks. It is effective against HTTP connections for Web servers that allow unlimited failed login attempts by the user. Obiwan uses wordlists as well as alphanumeric characters as possible passwords.

Explanation:
According to the network diagram, the IP address range used on the network is from the class C private address range. The class C IP address uses the following default subnet mask: 255.255.255.0 The question specifies that the subnet mask used in Host B is 255.255.0.0, which is an incorrect subnet mask.

Explanation:
The Digest Authentication scheme is a replacement of the Basic Authentication scheme. This authentication scheme is based on the challenge response model. In Digest authentication, the password is never sent across the network in clear text format but is always transmitted as an MD5 digest of the user's password. In this way, the password cannot be determined with the help of a sniffer.
How does it work? In this authentication scheme, an optional header allows the server to specify the algorithm used to create the checksum or digest (by default, the MD5 algorithm). The Digest Authentication scheme provides the challenge using a randomly chosen value. This randomly chosen value is a server-specified data string which may be uniquely generated each time a 401 response is made. A valid response contains a checksum (by default, the MD5 checksum) of the username, the password, the given random value, the HTTP method, and the requested URL. In this way, the password is never sent in clear text format.
Drawback: Although the password is not sent in clear text format, an attacker can gain access with the help of the digested password, since the digested password is really all the information needed to access the web site.
Answer: B, C, D are incorrect. These statements are true about the Basic Authentication scheme.

Explanation:

According to the question, you are required to prevent outside computers from accessing your network.
You should therefore configure the switch's port access based on the MAC address, which can be done by configuring port security. Port security is a feature of Cisco Catalyst series switches. Port security is used to block input based on the media access control (MAC) address to an Ethernet, Fast Ethernet, or Gigabit

Ethernet port. It denies the port access to a workstation when the MAC address of the station attempting to access the port is different from any of the MAC addresses specified for that port. Internet or other outside networks.
Answer: D is incorrect. A port scanner is a software tool that is designed to search network host for open ports. This tool is often used by administrators to check the security of their networks. It is also used by hackers to compromise the network and systems.

Explanation:
The <session-timeout> element of the deployment descriptor sets the session timeout. If the time specified for timeout is zero or negative, the session will never timeout.

Explanation:
In order to provide the best level of security for the kind of authentication used by the company, Mark will have to use the PEAP protocol. This protocol will provide the strongest password-based authentication for a WEP solution with 802.1x. Implementing 802.1x authentication for wireless security requires using an Extensible Authentication Protocol (EAP)-based method for authentication. There are two EAP-based methods:
1. EAP-Transport Layer Security (EAP-TLS)
2. Protected EAP (PEAP) Answer: A is incorrect. IPSec has nothing to do with this issue.

Explanation:

The steps to display the status of Windows Firewall are as follows:

1. Click the Start button, then click Control Panel.

2. In the Control Panel window, click Security.

3. In the Security window, click Windows Firewall.

4. The Windows Firewall dialog box appears, displaying the status of Windows Firewall.

Explanation:
NetStumbler is one of the most famous wireless auditing tools. It works with a wide variety of cards. If it is loaded on a computer, it can be used to detect 802.11 networks. It can easily identify the SSIDs and security tools. It can even identify the channel being used. This tool can also be integrated with the GPS to identify the exact location of AP for plotting onto a map.
Answer: B is incorrect. It can identify the channel being used. NetStumbler can be used for a variety of services:
1. For war driving

2. To verify network configurations
3. To find locations with poor coverage in a WLAN 4. To detect causes of wireless interference
5. To detect unauthorized ("rogue") access points 6. To aim directional antennas for long-haul WLAN links

Explanation:

In the given scenario, you will add constraints to the EmpID and DeptNo columns of the EmployeeData table, as you want EmpID to be unique, and the number entered in the DeptNo column to be valid. A constraint enforces the integrity of a database. It defines rules regarding the values allowed in the columns of a table. A constraint is the standard mechanism for enforcing integrity. Using constraints is preferred to using triggers, rules, and defaults. Most of the RDBMS databases support the following five types of constraints:

NOT NULL constraint: It specifies that the column does not accept NULL values.
CHECK constraint: It enforces domain integrity by limiting the values that can be placed in a column.
UNIQUE constraint: It enforces the uniqueness of values in a set of columns.
PRIMARY KEY constraint: It identifies the column or set of columns whose values uniquely identify a row in a table.
FOREIGN KEY constraint: It establishes a foreign key relationship between the columns of the same table or different tables.

Following are the functions of constraints: Constraints enforce rules on data in a table whenever a row is inserted, updated, or deleted from the table.
Constraints prevent the deletion of a table if there are dependencies from other tables.
Constraints enforce rules at the column level as well asat the table level.
Defining indexes in the EmployeeData table will help you find employee information based on EmpID, very fast.
An index is a pointer to a table.
It speeds up the process of data retrieval from a table.
It is stored separately from a table for which it was created.
Indexes can be created or dropped without affecting the data in a table.
The syntax for creating an index is as follows: CREATE INDEX <Index name>
Indexes can also be used for implementing data integrity in a table.
A unique index does not allow duplicate values to enter in a row if a particular column is indexed as a unique index.
The syntax for creating a unique index is as follows: CREATE UNIQUE INDEX <Index name> You will also add a stored procedure named AddEmp by using Transact-SQL queries. AddEmp will accept data values for new employees and will subsequently add a row in the EmployeeData table. Stored procedures are precompiled SQL routines that are stored on a database server. They are a combination of multiple SQL statements that form a logical unit and perform a particular task. Stored procedures provide the capability of combining multiple SQL statements and improve speed due to precompiled routines. Most of the DBMS provide support for stored procedures. They usually differ in their syntax and capabilities from one DBMS to another.
A stored procedure can take three parameters: IN, OUT, and INOUT. Note: Stored procedures are very similar to functions and procedures of common programming languages. You will also define a view named DeptEmpView that will combine data from the Department and EmployeeData tables and thus produce the required result. A view can be thought of as a virtual table. The data accessible through a view is not stored in the database as a distinct object. Views are created by defining a SELECT statement. The result set of the SELECT statement forms the virtual table. A user can use this virtual table by referencing the view name in SQL statements in the same way a table is referenced. Answer: A is incorrect. You do not need to define any triggers in the EmployeeData table, as they are not required while making the EmpID unique, or while entering valid data values in DeptNo. A trigger is a special kind of stored procedure that automatically runs when data in a specified table is updated, inserted, or deleted. Triggers can query other tables and can include complex SQL statements.

Explanation:
Some of the specific tasks require additional detailed controls to ensure that the workers perform their job correctly. These controls refer to some specific tasks or steps to be performed such as:
1. The way system security parameters are set.
2. How input data is verified before being accepted into an application.
3. How to lock a user account after unsuccessful logon attempts.
4. How the department handles acquisitions, security, delivery, implementation, and support of IS services.
5. Answer: C is incorrect. Input data should be verified before being accepted into an application.

The HttpSessionActivationListener interface notifies an attribute that the session is about to be activated or passivated. Methods of this interface are as follows:

public voidsessionDidActivate(HttpSessionEvent session): It notifies the attribute that the session has just been moved to a different JVM. public void sessionWillPassivate(HttpSessionEvent se): It notifies the attribute that the session is about to move to a different JVM.
Answer: B, C are incorrect. These functions are performed by the HttpSessionBindingListener interface.
The HttpSessionBindingListener interface causes an object of the implementing class to be notified when it is added to or removed from a session. The HttpSessionBindingListener interface has the following methods:
1. public void valueBound(event): This method takes an object of type HttpSessionBindingEvent as an argument. It notifies the object when it is bound to a session.
2. public void valueUnbound(HttpSessionBindingEvent event): This method takes an object of type

HttpSessionBindingEvent as an argument. It notifies the object when it is unbound from a session.

Explanation:
Axence nVision is an advanced solution for a comprehensive network management. It is used to monitor network infrastructure such as Windows, TCP/IP services, web and mail servers, URLs, and applications (MS Exchange, SQL, etc.). It is also used to monitor routers and switches such as network traffic, interface status, and connected computers. It collects the network inventory and audit license usage. It also gives alerts in case of a program installation or any configuration change on a remote node. With the agent, an administrator can easily monitor user activities and can access computers remotely.
Answer: B is incorrect. CommandCenter NOC is a simple and effective tool that performs network monitoring with a powerful polling engine. It provides polling, Windows and UNIX/Linux server management, intrusion detection, vulnerability scanning, and traffic analysis in an integrated appliance.
Answer: D is incorrect. Cymphonix Network Composer is a precise Web gateway appliance. It is used to monitorInternet traffic by user, application, and threat. It consists of controls to shape access to Internet resources by user, group, and/or time of day. It also supports anonymous proxy blocking, policy management, and real time monitoring.
Answer: C is incorrect. Network Monitor (Netmon) is a protocol analyzer. It is used to analyze the network traffic. It is installed by default during the installation of the operating system. It can be installed by using Windows Components Wizard in the Add or Remove Programs tool in Control Panel. Network Monitor is used to perform the following tasks:

1. Capture frames directly from the network.
2. Display and filter captured frames immediately after capture or a later time.
3. Edit captured frames and transmit them on the network.
4. Capture frames from a remote computer.

Explanation:
FAT16 file system was developed for disks larger than 16MB. It uses 16-bit allocation table entries. FAT16 file system supports all Microsoft operating systems. It also supports OS/2 and Linux.
Answer: C, D are incorrect. All these statements are true about FAT16 file system.

Explanation:
A relational database is a collection of data items organized as a set of formally-described tables from which data can be accessed or reassembled in many different ways without having to reorganize the database tables.
Answer: B is incorrect. The standard user and application program interface to a relational database is the
structured query language (SQL).
Answer: A is incorrect. In addition to being relatively easy to create and access, a relational database has the important advantage of being easy to extend.
Answer: D is incorrect. A relational database is a set of tables containing data fitted into predefined categories. Each table (which is sometimes called a relation) contains one or more data categories in columns. Each row contains a unique instance of data for the categories defined by the columns.

Explanation:

Between an access point and a wireless LAN controller, you will have to execute the following commands in command-line mode:

Switch1(config)#interface fa0/1
Switch1(config-if)#switchport trunk encapsulation dot1q
Switch1(config-if)#switchport mode trunk
Switch1(config-if)#exit
You will have to use the interface fa slot/port global configuration command to select a specific Fast Ethernet interface that you want to configure.
The switchport trunk encapsulation dot1q command is used to define a trunking protocol as 802.1Q.
The switchport mode trunk command is used to define an interface as a trunk.

The exit command is used to return to the previous mode.

Explanation:
In Unix, the /dev/MAKEDEV file is used by system administrators for local device files or links to device filesfor a non-standard device driver.
Answer: A is incorrect. In Unix, the profile file stores the system wide environment and startup script program.
Answer: D is incorrect. In Unix, the /etc/aliases file is where the user's name is matched to a nickname fore-mail.
Answer: B is incorrect. In Unix, the /etc/bootptab/ file contains the configuration for the BOOTP server daemon.

Explanation:
In DNS poisoning attack, an attacker distributes incorrect IP address. DNS cache poisoning is a maliciously created or unintended situation that provides data to a caching name server that did not originate from authoritative Domain Name System (DNS) sources. Once a DNS server has received such non-authentic data, Caches it for future performance increase, it is considered poisoned, supplying the non-authentic data to the clients of the server. To perform a cache poisoning attack, the attacker exploits a flaw in the DNS software. If the server does not correctly validate DNS responses to ensure that they are from an authoritative source, the server will end up caching the incorrect entries locally and serve them to other users that make the same request.
Answer: B is incorrect. IP (Internet Protocol) address spoofing is an attack in which an attacker creates the IP packets with a forged (spoofed) source IP address with the purpose of concealing the identity of the sender or impersonating another computing system. The basic protocol for sending data over the Internet and many other computer networks is the Internet Protocol ("IP"). The header of each IP packet contains, among other things, the numerical source and destination address of the packet. The source address is normally the address that the packet was sent from. By forging the header so it contains a different address, an attacker can make it appear that the packet was sent by a different machine. The machine that receives spoofed packets will send response back to the forged source address, which means that this technique is mainly used when the attacker does not care about the response or the attacker has some way of guessing the response.
Answer: D is incorrect. Man-in-the-middle attacks occur when an attacker successfully inserts an intermediary software or program between two communicating hosts. The intermediary software or program allows attackers to listen to and modify the communication packets passing between the two hosts. The software intercepts the communication packets and then sends the information to the receiving host. The receiving host responds to the software, presuming it to be the legitimate client.
Answer: C is incorrect. MAC flooding is a technique employed to compromise the security of network switches. In a typical MAC flooding attack, a switch is flooded with packets, each containing different source MAC addresses. The intention is to consume the limited memoryset aside in the switch to store the MAC address-to-physical port translation table. The result of this attack causes the switch to enter a state called fail open mode, in which all incoming packets are broadcast out on all ports (as with a hub), instead of just down the correct port as per normal operation. A malicious user could then use a packet sniffer (such as Wireshark) running in promiscuous mode to capture sensitive data from other computers(such as unencrypted passwords, e-mail and instant messaging conversations), which would not be accessible were the switch operating normally.

Explanation:
AiroPeek is a Windows-based commercial wireless LAN analyzer for IEEE 802.11b. It supports all high level protocols such as TCP/IP, NetBEUI, IPX, etc. It can be used to perform the following tasks:
1. Site surveys
2. Security assessments
3. Channel scanning 4. Real time and past capture
5. WEP decryption
6. Client troubleshooting
7. WLAN monitoring
8. Remote WLAN analysis 9. Application layer protocol analysis ting tool
Answer: A is incorrect. Sam Spade is a penetration-testing tool that is used in the discovery phase. It provides GUI graphics and a lot of functionalities. It can perform mainly who is queries, ping requests, DNS requests, tracerouting, OS finger-printing, zone transferring, SMTP mail relay checking, and Web site crawling and mirroring. Sam Spade runs on Windows operating systems.
Answer: B is incorrect. John the Ripper is a fast password cracking tool that is available for most versions of UNIX, Windows, DOS, BeOS, and Open VMS. It also supports Kerberos, AFS, and Windows NT/2000/ XP/2003 LM hashes. John the Ripper requires a user to have a copy of the password file.

Answer: C is incorrect. Cheops-ng is a network management tool that is used for mapping and monitoring networks. It can detect a network of a host and provides OS detection for hosts. On some services, Cheops-ng is able to see what program is running for a service and what is the version number of that program. The main difference between Cheops and Cheops-ng is that Cheops-ng does not have monitoring capabilities.

Explanation:
To define styles only for the active page you should use embedded style sheet. Cascading style sheets (CSS) are used so that the Website authors can exercise greater control on the appearance and presentation of their Web pages. And also because they increase the ability to precisely point to the location and look of elements on a Web page and help in creating special effects. Cascading Style Sheets have codes, which are interpreted applied by the browser on to the Web pages and their elements. There are three types of cascading style sheets. External Style Sheets Embedded Style Sheets Inline Style Sheets External Style Sheets are used whenever consistency in style is required throughout a Web site. A typical external style sheet uses a .css file extension, which can be edited using a text editor such as a Notepad. Embedded Style Sheets are used for defining styles for an active page. Inline Style Sheets are used for defining individual elements of a page.
References:
TechNet, Contents: Microsoft Knowledgebase, February 2000 issue PSS ID Number: Q179628
You want to enable Host A to access the Internet. For this, you need to configure the default gateway settings. Choose the appropriate address to accomplish the task.

Explanation:
You will use the tee command to write its content to standard output and simultaneously copy it into the specified file. The tee command is used to split the output of a program so that it can be seen on the display and also be saved in a file. It can also be used to capture intermediate output before the data is altered by another command or program. The tee command reads standard input, then writes its content to standard output, and simultaneously copies it into the specified file(s) or variables. The syntax of the tee command is as follows: tee [-a] [-i] [File] where, the -a option appends the output to the end of File instead of writing over it and the -i option is used to ignore interrupts.
Answer: A is incorrect. The concatenate (cat) command is used to display or print the contents of a file.
Syntax: cat filename For example, the following command will display the contents of the /var/log/dmesg file: cat /var/log/dmesg Note: The more command is used in conjunction with the cat command to prevent scrolling of the screen while displaying the contents of a file.
Answer: C is incorrect. The less command is used to view (but not change) the contents of a text file, one screen at a time. It is similar to the more command. However, it has the extended capability of allowing both forward and backward navigation through the file. Unlike most Unix text editors/viewers, less does not need to read the entire file before starting; therefore, it has faster load times with large files. The command
syntax of the less command is as follows: less [options] file_name Where,

Answer B is incorrect. The more command is used to view (but not modify) the contents of a text file on the terminal screen at a time. The syntax of the more command is as follows: more [options] file_name Where,

Explanation:

You took 3 seconds to establish a connection. During this time, the value of the Initial Sequence Number would become [24171311 + (1 * 64000) + (3 * 128000)], i.e., 24619311.

Explanation:

Windows Defender is a software product designed by Microsoftto provide continuous security against malware. If it detects anything suspicious, an alert will appear on the screen. Windows Defender can also be used to scan a computer for suspicious software. It can remove or quarantine any malware or spyware it finds.
Clicking on the Security Center icon will show the status of malware protection, status of firewall, and other security settings.
Clicking on the Windows Firewall icon will open the Windows Firewall dialog box and allow a user to configure the Windows Firewall settings.

Explanation:
In computer security, the term vulnerability is a weakness which allows an attacker to reduce a system's
Information Assurance. A computer or a network can be vulnerable due to the following reasons: Complexity: Large, complex systems increase the probability of flaws and unintended access points.
Familiarity: Using common, well-known code, software, operating systems, and/or hardware increases the probability an attacker has or can find the knowledge and tools to exploit the flaw.
Connectivity: More physical connections, privileges, ports, protocols, and services and time each of those are accessible increase vulnerability.
Password management flaws: The computer user uses weak passwords that could be discovered by brute force. The computer user stores the password on the computer where a program can access it. Users re-use passwords between many programs and websites.
Fundamental operating system design flaws: The operating system designer chooses to enforce sub optimal policies on user/program management. For example, operating systems with policies such as default permit grant every program and every user full access to the entire computer. This operating system flaw allows viruses and malware to execute commands on behalf of the administrator.
Internet Website Browsing: Some Internet websites may contain harmful Spyware or Adware that can be installed automatically on the computer systems. After visiting those websites, the computer systems become infected and personal information will be collected and passed on to third party individuals.
Software bugs: The programmer leaves an exploitable bug in a software program. The software bug may allow an attacker to misuse an application.
Unchecked user input: The program assumes that all user input is safe. Programs that do not check user input can allow unintended direct execution of commands or SQL statements (known as Buffer overflows, SQL injection or other non-validated inputs).
Answers B, C are incorrect. Use of common software and common code can make a network vulnerable.

Explanation:
Audit account management is one of the nine audit settings that can be configured on a Windows computer. This option is enabled to audit each event that is related to a user managing an account in the user database on the computer where the auditing is configured. These events include the following:
1. Creating a user account
2. Adding a user account to a group
3. Renaming a user account
4. Changing password for a user account
This option is also used to audit the changes to the domain account of the domain controllers.

Explanation:
The Trojan Man is a Trojan wrapper that not only combines two programs, but also encrypts the resulting package in an attempt to foil antivirus programs.

Explanation:
Storage and retention policies will determine how long you keep records (such as records of customers Web activity), how you will store them, and how you will dispose of them. This will allow you to know what records you should still have on hand should a legal request for such records come in.
Answer: C is incorrect. User policies might determine what a customer has access to, but won't help you identify what they actually did access.
Answer: A is incorrect. Group policies are usually pertinent to network administration, not the open and uncontrolled environment of an ISP.
Answer B is incorrect. Backup policies dictate how data is backed up and stored.

Explanation:
Data aggregation is any process in which information is gathered and expressed in a summary form, for purposes such as statistical analysis. A common aggregation purpose is to get more information about particular groups based on specific variables such as age, profession, or income. The information about such groups can then be used for Web site personalization to choose content and advertising likely to appeal to an individual belonging to one or more groups for which data has been collected. For example, a site that sells music CDs might advertise certain CDs based on the age of the user and the data aggregate for their age group. Online analytic processing (OLAP) is a simple type of data aggregation in which the marketer uses an online reporting mechanism to process the information.
Answer: B is incorrect. Data aggregation can be user-based. Personal data aggregation services offer the user a single point for collection of their personal information from other Web sites. The customer uses a single master personal identification number (PIN) to give them access to their various accounts (such as those for financial institutions, airlines, book and music clubs, and so on). Performing this type of data aggregation is sometimes referred to as "screen scraping."

Explanation:
Most often user rights are determined by the groups the user belongs to. In some cases a user may mistakenly be added to a group they should not be. It is also common that a user moves within the organization, but is still retained in their previous group giving them those rights.
Answer: B is incorrect. Access Control Lists are usually setup up manually. This means that a person would not likely be inadvertently added. You might want to check the ACL's, and you might find some issues, but this is not the most likely way to find users with inappropriate rights.
Answer: C is incorrect. At best server logs can show you if a user accessed a resource. But a user could have access to a resource, and simply not have used that access yet.
Answer: A is incorrect. IDS logs will only help you identify potential attacks. Unless you suspect the user of intentionally trying to break into resources, an IDS log will not help in this scenario.

In order to fulfill the requirements, you should use the following set of commands: RouterA(config)#service password-encryption RouterA(config)#username cisco password PaS$w0Rd RouterA(config)#enable
secret n56e&$te RouterA(config)#line vty 0 4 RouterA(config-line)#login local
Answer: D is incorrect. This configuration does not apply password encryption correctly. The command service enable-password-encryption is incorrect. The correct command is service password-encryption.
Answer: A is incorrect. This configuration applies the login command to the VTY lines. This would require the password to be set at the VTY Line 0 4 level. This effectively will not configure user-level access for the
VTY lines.
Answer: B is incorrect. The enable password command is obsolete and considered insecure. The proper command is enable secret followed by the password value.

Explanation:
An event-based token, by its nature, has a long life span. They work on the one-time password principle and so once used, the next password is generated. Often the user has a button to press to receive this new code via either a token or via an SMS message. All CRYPTOCard's tokens are event-based rather than time-based.
Answer: C is incorrect. Bluetooth tokens are often combined with a USB token, and hence work in both a connected and disconnected state. Bluetooth authentication works when closer than 32 feet (10 meters). If the Bluetooth is not available, the token must be inserted into a USB input device to function.
Answer: A is incorrect. Virtual tokens are a new concept in multi-factor authentication first introduced in 2005 by security company Sestus. Virtual tokens work by sharing the token generation process between the Internet website and the user's computer and have the advantage of not requiring the distribution of additional hardware or software. In addition, since the user's device is communicating directly with the authenticating website, the solution is resistant to man-in-the-middle attacks and similar forms of online fraud.
Answer: D is incorrect. Single sign-on software tokens are used by the multiple, related, but independent software systems. Some types of single sign-on (SSO) solutions, like enterprise single sign-on, use this token to store software that allows for seamless authentication and password filling. As the passwords are stored on the token, users need not remember their passwords and therefore can select more secure passwords, or have more secure passwords assigned.

Explanation:

In order to accomplish this task, you will have to issue the following commands:
interface s0/0
no cdp enable
According to the question, you are required to disable CDP only on the interface that is connected to the Internet. For this, you will have to run the no cdp enable command on the interface. To select the interface, the interface <interface id> command is issued. This will disable CDPonly on the interface selected.
The no cdp run command is a global command and is used to disable CDP for the entire switch.

Explanation:
Durability is the attribute of ACID which confirms that the committed data will be saved by the system such that, even in the event of a failure or system restart, the data will be available in its correct state.

Answer: B is incorrect. Atomicity is the attribute of ACID which confirms that, in a transaction involving two or more discrete pieces of information, either all of the pieces are committed or none are.
Answer: D is incorrect. Consistency is the attribute of ACID which confirms that a transaction either creates a new and valid state of data, or, if any failure occurs, returns all data to its state before the transaction was started.
Answer: C is incorrect. Isolation is the attribute of ACID which confirms that a transaction in process and not yet committed must remain isolated from any other transaction.

Explanation:

The user can then select a program and restore it.

Explanation:
Removing the IPP printing capability from a server is a good countermeasure against an IIS buffer overflow attack. A Network Administrator should take the following steps to prevent a Web server from IIS buffer overflow attacks: Conduct frequent scans for server vulnerabilities.
Install the upgrades of Microsoft service packs.
Implement effective firewalls.
Apply URLScan and IISLockdown utilities.
Remove the IPP printing capability.

Answer: B is incorrect. The following are the DNS zone transfer countermeasures:
Do not allow DNS zone transfer using the DNS property sheet: a. Open DNS. b. Right-click a DNS zone and click Properties. c. On the Zone Transfer tab, clear the Allow zone transfers check box.

Configure the master DNS server to allow zone transfers only from secondary DNS servers: a. Open DNS. b. Right-click a DNS zone and click Properties. c. On the zone transfer tab, select the Allow zone transfers check box, and then do one of the following: To allow zone transfers only to the DNS servers listed on the name servers tab, click on the Only to the servers listed on the Name Server tab.
To allow zone transfers only to specific DNS servers, click Only to the following servers, and add the IP address of one or more servers.
Deny all unauthorized inbound connections to TCP port 53.
Implement DNS keys and encrypted DNS payloads.

Answer: D is incorrect. The following are the countermeasures against SNMP enumeration:
1. Removing the SNMP agent or disabling the SNMP service 2. Changing the default PUBLIC community name when 'shutting off SNMP' is not an option
3. Implementing the Group Policy security option called Additional restrictions for anonymous connections 4. Restricting access to NULL session pipes and NULL session shares

5. Upgrading SNMP Version 1 with the latest version 6. Implementing Access control list filtering to allow only access to the read-write community from approved stations or subnets

Answer: A is incorrect.
NetBIOS NULL session vulnerabilities are hard to prevent, especially if NetBIOS is needed as part of the infrastructure. One or more of the following steps can be taken to limit NetBIOS NULL session vulnerabilities:
1. Removing the SNMP agent or disabling the SNMP service 2. Changing the default PUBLIC community name when 'shutting off SNMP' is not an option
3. Implementing the Group Policy security option called Additional restrictions for anonymous connections 4. Restricting access to NULL session pipes and NULL session shares
5. UpgradingSNMP Version 1 with the latest version 6. Implementing Access control list filtering to allow only access to the read-write community from approved stations or subnets answer option A is incorrect. NetBIOS NULL session vulnerabilities are hard to prevent, especially if NetBIOS is needed as part of the infrastructure. One or more of the following steps can be taken to limit NetBIOS NULL session vulnerabilities:
1. Null sessions require access to the TCP 139 or TCP 445 port, which can be disabled by a Network
Administrator.
2. A Network Administrator can also disable SMB services entirely on individual hosts by unbinding WINS
Client TCP/IP from the interface.
3. A Network Administrator can also restrict the anonymous user by editing the registry values:
a.Open regedit32, and go to HKLM\SYSTEM\CurrentControlSet\LSA.
b. Choose edit > add value. Value name: RestrictAnonymous Data Type: REG_WORD Value: 2

Explanation:
The Common Gateway Interface (CGI) specification is used for creating executable programs that run on a Web server. CGI defines the communication link between a Web server and Web applications. It gives a network or Internet resource access to specific programs. For example, when users submit an HTML form on a Web site, CGI is used to pass this information to a remote application for processing, and retrieve the results from the application. It then returns these results to the user by means of an HTML page.
Answer: A is incorrect. CGI programs do not execute on routers.

Explanation:
The yy key combination in the vi editor is used to copy the current line. The vi editor is an interactive, cryptic, and screen-based text editor used to create and edit a file. It operates in either Input mode or Command mode. In Input mode, the vi editor accepts a keystroke as text and displays it on the screen, whereas in Command mode, it interprets keystrokes as commands. As the vi editor is case sensitive, it interprets the same character or characters as different commands, depending upon whether the user enters a lowercase or uppercase character. When a user starts a new session with vi, he must put the editor in Input mode by pressing the "I" key. If he is not able to see the entered text on the vi editor's screen, it means that he has not put the editor in Insert mode. The user must change the editor to Input mode before entering any text so that he can see the text he has entered.
Answer: D is incorrect. It deletes next char on the right.
Answer: A is incorrect. It deletes the current line and one line above.
Answer: C is incorrect. It deletes from the cursor till the end of the line.

Explanation:
The following types of software are safety critical software:
1. Software that is used to apply a critical decision-making process 2. Software that is used to manage or monitor safety critical functions
3. Software that intervenes when an unsafe condition is present or is about to happen 4. Software that executes on the same target system as safety critical software
5. Software that impacts the systems on which safety critical software runs 6. Software that manages safety critical data including display of safety critical information
Software that is used to validate and verify safety critical software Answer: D is incorrect. Software that is used to manage or monitor safety critical functions is known as safety critical software.
Answer: C is incorrect. Software that intervenes when an unsafe condition is present or is about to happen is known as safety critical software.

Explanation:
WPA2 is an updated version of WPA. This standard is also known as IEEE 802.11i. WPA2 offers enhanced protection to wireless networks than WPA and WEP standards. It is also available as WPA2- PSK and WPA2-EAP for home and enterprise environment respectively. Answer: B is incorrect. than WEP (Wired Equivalent Protection). Windows Vista supports both WPA-PSK and WPA-EAP. Each of these is described as follows:
1. WPA-PSK: PSK stands for Preshared key. This standard is meant for home environment. WPA-PSK requires a user to enter an 8- character to 63-character passphrase into a wireless client. The WPA converts the passphrase into a 256-bit key.
2. WPA-EAP: EAP stands for Extensible Authentication Protocol. This standard relies on a back-end server that runs Remote Authentication Dial-In UserService for user authentication. Note: Windows Vista supports a user to use a smart card to connect to a WPA-EAP protected network.

Explanation:

The basic features of Unix are as follows:
1. Multi-user: It supports more than one user to access the system simultaneously through a set of terminals attached to a system.
2. Multi-tasking: A user can execute multiple programs at the same time from a single terminal.
3. Time sharing: The operating system shares CPU time among tasks.
4. Portability: It is highly portable across hardware.
5. Modularity: It allows only needed modules to be loaded into the memory.
6. File structure: It has an inverted tree like file structure, with files and directories created within the file structure.
7. Security: All files can be individually protected using read, write, and execute permissions for the user, group, and others.
8. Network support: It uses the TCP/IP protocol.
9. Advanced graphics: CAD-CAM applications perform the best in a Unix System with its varied support for graphics card.

Explanation:
A port scanner is often used on the periphery of a network by either administrators or hackers. It will tell you what ports are open. By determining what ports are open, you know what services are exposed to the outside world. For example, if port 80 is open, then HTTP traffic is allowed, meaning there should be a Web server on the network.
Answer: A is incorrect. Network mappers give a topography of the network, letting you know what is on your network and where it is connected.
Answer: B is incorrect. A protocol analyzer does detect if a given protocol is moving over a particular network segment, thus would detect services working on that segment. However, a port scanner is a better tool for detecting all the ports that are open.
Answer: D is incorrect. Packet sniffers are used to intercept traffic and to detect the contents of that traffic.

Explanation:
The above configuration fragment will disable the following services from the router: The BootP service The DNS function
The Network Time Protocol
The Simple Network Management Protocol Hyper Text Transfer Protocol

Explanation:
Magic Lantern works both as an encryption-cracking tool and as a keylogger.
Answer: C is incorrect. Alchemy Remote Executor is a system management tool that allows Network Administrators to execute programs on remote network computers without leaving their workplace. From the hacker's point of view, it can be useful for installing keyloggers, spyware, Trojans, Windows rootkits and such. One necessary condition for using the Alchemy Remote Executor is that the user/attacker must have the administrative passwords of the remote computers on which the malware is to be installed.
Answer: B is incorrect. The KeyGhost keylogger is a hardware keylogger that is used to log all keystrokes on a computer. It is a tiny device that clips onto the keyboard cable. Once the KeyGhost keylogger is attached to the computer, it quietly logs every key pressed on the keyboard into its own internal Flash memory (just as with smart cards). When the log becomes full, it overwrites the oldest keystrokes with the newest ones.
Answer: D is incorrect. SocketShield provides a protection shield to a computer system against malware, viruses, spyware, and various types of keyloggers. SocketShield provides protection at the following two levels:
1. Blocking: In this level, SocketShield uses a list of IP addresses that are known as purveyor of exploits.
All http requests for any page in these domains are simply blocked.
2. Shielding: In this level, SocketShield blocks all the current and past IP addresses that are the cause of unauthorized access.

Explanation:
Wired Equivalent Privacy (WEP) is a security protocol for wireless local area networks (WLANs). It has two components, authentication and encryption. It provides security equivalent to wired networks for wireless networks. WEP encrypts data on a wireless network by using a fixed secret key. WEP uses the RC4 encryption algorithm. The main drawback of WEP is that its Initialization Vector (IV) field is only 24 bits long. Many automated tools such as AirSnort are available for discovering WEP keys.
Answer: C is incorrect. WPA stands for Wi-Fi Protected Access. It is a wireless security standard. It provides better security than WEP (Wired Equivalent Protection). Windows Vista supports both WPA-PSK and WPA-EAP.
Each of these is described as follows:
1. WPA-PSK: PSK stands for Preshared key. This standard is meant for home environment. WPA-PSK requires a user to enter an 8- character to 63-character passphrase into a wireless client. The WPA converts the passphrase into a 256-bit key.
2. WPA-EAP: EAP stands for Extensible Authentication Protocol. This standard relies on a back-end server that runs Remote Authentication Dial-In User Service for user authentication. Note: Windows Vista supports a user to use a smart card to connect to a WPA-EAP protected network.

Explanation:
According to the scenario, John is performing the Steganography technique for sending malicious data.
Steganography is an art and science of hiding information by embedding harmful messages within other seemingly harmless messages. It works by replacing bits of unused data, such as graphics, sound, text, and HTML, with bits of invisible information in regular computer files. This hidden information can be in the form of plain text, cipher text, or even in the form of images.
Answer: A is incorrect. Web ripping is a technique in which the attacker copies the whole structure of a Web site to the local disk and obtains all files of the Web site. Web ripping helps an attacker to trace the loopholes of the Web site.
Answer: D is incorrect. Social engineering is the art of convincing people and making them disclose useful information such as account names and passwords. This information is further exploited by hackers to gain access to a user's computer or network. This method involves mental ability of the people to trick someone rather than their technical skills. A user should always distrust people who ask him for his account name or password, computer name, IP address, employee ID, or other information that can be misused.
Answer: C is incorrect. John is not performing email spoofing. In email spoofing, an attacker sends emails after writing another person's mailing address in the from field of the emailed.

Explanation:
The following methods can be helpful to eliminate social engineering threat: Password policies Vulnerability assessments Data classification Password policy should specify that how the password can be shared. Company should implement periodic penetration and vulnerability assessments. These assessments usually consist of using known hacker tools and common hacker techniques to breach a network security. Social engineering should also be used for an accurate assessment. Since social engineers use the knowledge of others to attain information, it is essential to have a data classification model in place that all employees know and follow.
Data classification assigns level of sensitivity of company information. Each classification level specifies that who can view and edit data, and how it can be shared.

Explanation:
There are three goals of risk management as follows:
1. Identifying the risk 2. Assessing the impact of potential threats
3. Finding an economic balance between the impact of the risk and the cost of the countermeasure

Answer: D is incorrect. Identifying the accused does not come under the scope of risk management.

Explanation:
The Unix utility sed (stream editor) is a text editing tool that can be used to edit text files without having to open them. This utility parses text files and implements a programming language which can apply textual transformations to such files. It reads input files line by line (sequentially), applying the operation which has been specified via the command line (or a sed script), and then outputs the line.
Answer: D is incorrect. The more command is used to view (but not modify) the contents of a text file on the terminal screen at a time. The syntax of the more command is as follows: more [options] file_name
Where,

Answer: A is incorrect. The less command is used to view (but not change) the contents of a text file, one screen at a time. It is similar to the more command. However, it has the extended capability of allowing both forward and backward navigation through the file. Unlike most Unix text editors/viewers, less does not need to read the entire file before starting; therefore, it has faster load times with large files. The command
syntax of the less command is as follows: less [options] file_name Where, Answer C is incorrect. The vi editor is an interactive, cryptic, and screen-based text editor used to create and edit a file. It operates in either Input mode or Command mode. In Input mode, the vi editor accepts a keystroke as text and displays it on the screen, whereas in Command mode, it interprets keystrokes as commands. As the vi editor is case sensitive, it interprets the same character or characters as different commands, depending upon whether the user enters a lowercase or uppercase character. When a user starts a new session with vi, he must put the editor in Input mode by pressing the "I" key. If he is not able to see the entered text on the vi editor's screen, it means that he has not put the editor in Insert mode. The user must change the editor to Input mode before entering any text so that he can see the text he has entered.

Explanation:

A cookie is a small bit of text that accompanies requests and pages as they move between Web servers and browsers. It contains information that is read by a Web application, whenever a user visits a site.
Cookies are stored in the memory or hard disk of client computers. A Web site stores information, such as user preferences and settings in a cookie. This information helps in providing customized services to users. There is absolutely no way a Web server can access any private information about a user or his computer through cookies, unless a user provides the information. A Web server cannot access cookies created by other Web servers.
Answer A is incorrect. A protocol is a set of predefined rules that govern how two or more processes communicate and interact to exchange data. Protocols are considered as the building blocks of network communication. Computer protocols are used by communicating devices and software services to format data in a way that all participants understand. It provides a context in which to interpret communicated information.
Answer: B is incorrect. ActiveX controls are software components that can be integrated into Web pages and applications, within a computer or among computers in a network, to reuse the functionality.
Reusability of controls reduces development time of applications and improves program interfaces. They enhance the Web pages with formatting features and animation. ActiveX controls can be used in applications written in different programming languages that recognize Microsoft's Component Object Model (COM). These controls always run in a container. ActiveX controls simplify and automate the authoring tasks, display data, and add functionality to Web pages.
Answer: D is incorrect. Keywords are important terms used to search Web pages on a particular topic. For example, if a user enters a keyword "Networking" in a search engine form, all Web pages containing the term "Networking" will be displayed.

Explanation:
The application level firewall inspects the contents of packets, rather than the source/destination or connection between the two. An Application level firewall operates at the application layer of the OSI model.
Answer: A is incorrect. The circuit-level firewall regulates traffic based on whether or not a trusted connection has been established. It operates at the session layer of the OSI model.
Answer: C is incorrect. The packet filtering firewall filters traffic based on the headers. It operates at the network layer of the OSI model.
Answer: B is incorrect. The stateful inspection firewall assures the connection between the two parties is valid and inspects packets from this connection to assure the packets are not malicious.

Explanation:
Peter will use frames in the Web page. Frames are extensions of the HTML 3.2 standard introduced by Netscape. Elements such as navigation links and title graphic, can be placed in static individual frames.
The <frame> tag defines the contents that will appear in each frame. It is used within the <frameset> tag.
Frames allow users to display multiple HTML files at a time.
Answer: A is incorrect. A table is used to handle data in tabular form.
Answer: B is incorrect. Navigation links are used with the navigation bar to display a page. These hyperlinks are relative to the navigational structure of a Web site.
Answer: C is incorrect. Data elements are used to access data in XML format from a Web server.

Explanation:
According to the question, the output displays that the interface is administratively down. Administratively down means that the interface is shut down. In order to up the interface, you will have to open the interface with the no shutdown command.
Answer: A is incorrect. Had there been a physical problem with the interface, the output would not have displayed "administratively down". Instead, the output would be as follows: serial0 is down, line protocol is down Answer: B is incorrect. You cannot run this command on a router that is powered off.

Answer: C is incorrect. Encapsulation has nothing to do with the output displayed in the question.

Explanation:
The less command is most useful for viewing large files. The less command displays the output of a file one page at a time. Viewing large files through cat may take more time to scroll pages, so it is better to use the less command to see the content of large files.
Answer: A is incorrect. The cat command is also used to view the content of a file, but it is most useful for viewing short files.
Answer: D is incorrect. The cp command is used to copy files and directories from one location to another.
Answer: C is incorrect. The touch command is not used to view the content of a file. It is used to create empty files or to update file timestamps.

Explanation:
CAATs (Computer Assisted Auditing Techniques) are used to test application controls as well as perform substantive tests on sample items. Following are the types of CAATs: Generalized Audit Software (GAS): It allows the auditor to perform tests on computer files and databases.
Custom Audit Software (CAS): It is generally written by auditors for specific audit tasks. CAS is necessary when the organization's computer system is not compatible with the auditor's GAS or when the auditor wants to conduct some testing that may not be possible with the GAS.
Test Data: The auditor uses test data for testing the application controls in the client's computer programs.
The auditor includes simulated valid and invalid test data, used to test the accuracy of the computer system's operations. This technique can be used to check data validation controls and error detection routines, processing logic controls, and arithmetic calculations, to name a few.
Parallel Simulation: The auditor must construct a computer simulation that mimics the client's production programs.
Integrated TestFacility: The auditor enters test data along with actual data in a normal application run.

Explanation:
The basic Unix printing commands are as follows: banner: It is used to print a large banner on a printer. lpr: It is used to submit a job to the printer. lpc: It enables one to check the status of the printer and set its state. lpq: It shows the contents of a spool directory for a given printer. lprm: It is used to remove a job from the printer queue. gs: It works as a PostScript interpreter. pr: It is used to print a file. tunelp: It is used to set various parameters for the lp device.

Explanation:
In Hypertext Markup Language (HTML), a table is created using the <TABLE>, <TR>, and <TD> tags. The <TABLE> tag designs the table layout, the <TR> tag is used to create a row, and the <TD> tag is used to
create a column. For example, the following code generates a table with two rows and two columns:

<TABLE BORDER=1>
<TR> <TD>Cell 1</TD>
<TD>Cell 2</TD> </TR>
<TR> <TD>Cell 3</TD>
<TD>Cell 4</TD> </TR>
</TABLE>

Answer: C, E, and D are incorrect. There are no HTML tags suchas <TABLE SET>, <TT>, and <SET
TABLE>.

Explanation:
Zorp is a proxy firewall suite developed by Balabit IT Security. Its core framework allows the administrator to fine-tune proxy decisions (with its built-in script language), and fully analyze embedded protocols (such as SSL with an embedded POP3 or HTTP protocol). The FTP, HTTP, FINGER, WHOIS, TELNET, and
SSL protocols are fully supported with an application-level gateway. Zorp aims for compliance with the Common Criteria/Application Level Firewall Protection Profile for Medium Robustness. Zorp is released under GNU/GPL and commercial license too. The GPL version is completely usable and functional;

however, it lacks some of the more advanced functions available in the commercially available version only. Some of the Zorp supported protocols are Finger, Ftp, Http, Pop3, NNTP, IMAP4, RDP, RPC, SIP, SSL, SSH, Telnet, Whois, LDAP, RADIUS, TFtp, SQLNet NET8, Rsh, etc.
Answer: D is incorrect. The GPL version of Zorp is completely usable and functional; however, it lacks some of the more advanced functions available in the commercially available version only.

Explanation:

In 1947, the American Institute of Certified Public Accountants (AICPA) adopted Generally Accepted Auditing Standards (GAAS) to establish standards for audits. The standards cover the following three categories: General Standards: They relate to professional and technical competence, independence, and professional due care.
Field Work Standards: They relate to the planning of an audit, evaluation of internal control, and obtaining sufficient evidential matter upon which an opinion is based.
Reporting Standards: They relate to the compliance of all auditing standards and adequacy of disclosure of opinion in the audit reports. If an opinion cannot be reached, the auditor is required to explicitly state their assertions.
Answer: B is incorrect. There was no such category of standard established by GAAS.

Explanation:
NSLOOKUP is a tool for diagnosing and troubleshooting Domain Name System (DNS) problems. It performs its function by sending queries to the DNS server and obtaining detailed responses at the command prompt. This information can be useful for diagnosing and resolving name resolution issues, verifying whether or not the resource records are added or updated correctly in a zone, and debugging other server-related problems. This tool is installed along with the TCP/IP protocol through the Control Panel.
Answer: A is incorrect. The ping command-line utility is used to test connectivity with a host on a TCP/IP-based network. This is achieved by sending out a series of packets to a specified destination host. On receiving the packets, the destination host responds with a series of replies. These replies can be used to determine whether or not the network is working properly.
Answer: B is incorrect. IPCONFIG is a command-line utility used to display current TCP/IP network configuration values and update or release the Dynamic Host Configuration Protocol (DHCP) allocated leases. It is also used to display, register, or flush Domain Name System (DNS) names.
Answer: C is incorrect. TRACERT is a route-tracing Windows utility that displays the path an IP packet takes to reach the destination. It shows the Fully Qualified Domain Name (FQDN) and the IP address of each gateway along the route to the remote host.