A database administrator contacts a security administrator to request firewall changes for a connection to
a new internal application. The security administrator notices that the new application uses a port
typically monopolized by a virus. The security administrator denies the request and suggests a new port
or service be used to complete the application’s task. Which of the following is the security administrator
practicing in this example?
A.
Explicit deny
B.
Port security
C.
Access control lists
D.
Implicit deny
Explanation:
Traffic that comes into the router is compared to ACL entries based on the order that the entries occur in
the router. New statements are added to the end of the list. The router continues to look until it has a
match. If no matches are found when the router reaches the end of the list, the traffic is denied. For this
reason, you should have the frequently hit entries at the top of the list. There is an implied deny for traffic
that is not permitted.
Incorrect Answers:
A: An explicit deny would block the application until it is added to the ACL.
B: Port security in IT can mean several things:
The physical control of all connection points, such as RJ-45 wall jacks or device ports, so that no
unauthorized users or unauthorized devices can attempt to connect into an open port.The management of TCP and User Datagram Protocol (UDP) ports. If a service is active and assigned to a
port, then that port is open. All the other 65,535 ports (of TCP or UDP) are closed if a service isn’t actively
using them.
Port knocking is a security system in which all ports on a system appear closed. However, if the client
sends packets to a specific set of ports in a certain order, a bit like a secret knock, then the desired service
port becomes open and allows the client software to connect to the service.
C: Implicit deny is the default security stance that says if you aren’t specifically granted access or
privileges for a resource, you’re denied access by default.http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html
Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 24, 26
The answer is A.
The point of the question isn’t about a new application, but moreover, the potential of the virus to propagate through the port the security administrator has previously blocked. If the requested port is opened for the database application, then the port could also be used by the virus. The security administrator doesn’t want that to happen so a different port for the database application has been suggested. The virus port remains EXPLICITLY denied.
ATTENTION PLEASE!!!
The SY0-401 Exam Will Retire On July 31, 2018, and then the New Exam is SY0-501!
New SY0-501 Exam Questions and Answers Updated Recently (7/Nov/2017):
NEW QUESTION 82
A security technician would like to obscure sensitive data within a file so that it can be transferred without causing suspicion. Which of the following technologies would BEST be suited to accomplish this?
A. Transport Encryption
B. Stream Encryption
C. Digital Signature
D. Steganography
Answer: D
Explanation:
Steganography is the process of hiding a message in another message so as to obfuscate its importance. It is also the process of hiding a message in a medium such as a digital image, audio file, or other file. In theory, doing this prevents analysts from detecting the real message. You could encode your message in another file or message and use that file to hide your message.
NEW QUESTION 83
A supervisor in your organization was demoted on Friday afternoon. The supervisor had the ability to modify the contents of a confidential database, as well as other managerial permissions. On Monday morning, the database administrator reported that log files indicated that several records were missing from the database Which of the following risk mitigation strategies should have been implemented when the supervisor was demoted?
A. Incident management
B. Routine auditing
C. IT governance
D. Monthly user rights reviews
Answer: D
NEW QUESTION 84
Which of the following attack types is being carried out where a target is being sent unsolicited messages via Bluetooth?
A. War chalking
B. Bluejacking
C. Bluesnarfing
D. Rogue tethering
Answer: B
Explanation:
Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers, sending a vCard which typically contains a message in the name field (i.e., for bluedating or bluechat) to another Bluetooth-enabled device via the OBEX protocol.
NEW QUESTION 85
Joe is exchanging encrypted email with another party. Joe encrypts the initial email with a key. When Joe receives a response, he is unable to decrypt the response with the same key he used initially. Which of the following would explain the situation?
A. An ephemeral key was used for one of the messages.
B. A stream cipher was used for the initial email; a block cipher was used for the reply.
C. Out-of-band key exchange has taken place.
D. Asymmetric encryption is being used.
Answer: D
Explanation:
Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes.
NEW QUESTION 86
Recently several employees were victims of a phishing email that appeared to originate from the company president. The email claimed the employees would be disciplined if they did not click on a malicious link in the message. Which of the following principles of social engineering made this attack successful?
A. Authority
B. Spamming
C. Social proof
D. Scarcity
Answer: A
NEW QUESTION 87
Which of the following is the LEAST secure hashing algorithm?
A. SHA1
B. RIPEMD
C. MD5
D. DES
Answer: C
NEW QUESTION 88
An employee uses RDP to connect back to the office network. If RDP is misconfigured, which of the following security exposures would this lead to?
A. A virus on the administrator’s desktop would be able to sniff the administrator’s username and password.
B. Result in an attacker being able to phish the employee’s username and password.
C. A social engineering attack could occur, resulting in the employee’s password being extracted.
D. A man in the middle attack could occur, resulting the employee’s username and password being captured.
Answer: D
NEW QUESTION 89
Joe, the security administrator, sees this in a vulnerability scan report:
“The server 10.1.2.232 is running Apache 2.2.20 which may be vulnerable to a mod_cgi exploit.”
Joe verifies that the mod_cgi module is not enabled on 10.1.2.232. This message is an example of what?
A. a threat.
B. a risk.
C. a false negative.
D. a false positive.
Answer: D
NEW QUESTION 90
A security analyst wishes to increase the security of an FTP server. Currently, all trails to the FTP server is unencrypted. Users connecting to the FTP server use a variety of modem FTP client software. The security analyst wants to keep the same port and protocol, while also still allowing unencrypted connections. Which of the following would BEST accomplish these goals?
A. Require the SFTP protocol to connect to the file server.
B. Use implicit TLS on the FTP server.
C. Use explicit FTPS for the connections.
D. Use SSH tunneling to encrypt the FTP traffic.
Answer: B
NEW QUESTION 91
A company has three divisions, each with its own networks and services. The company decides to make its secure web portal accessible to all employees utilizing their existing usernames and passwords, The security administrator has elected to use SAML to support authentication. In this scenario, which of the following will occur when users try to authenticate to the portal? (Select TWO.)
A. The portal will function as an identity provider and issue an authentication assertion.
B. The portal will request an authentication ticket from each network that is transitively trusted.
C. The back-end networks will function as an identity provider and issue an authentication assertion.
D. The back-end networks will request authentication tickets from the portal, which will act as the third-party service provider authentication store.
E. The back-end networks will verify the assertion token issued by the portal functioning as the identity provider.
Answer: BC
NEW QUESTION 92
Which of the following would a security specialist be able to determine upon examination of a server’s certificate?
A. CA public key
B. Server private key
C. CSR
D. OID
Answer: B
NEW QUESTION 93
……
P.S. These New SY0-501 Exam Questions Were Just Updated From The Real SY0-501 Exam, You Can Get The Newest SY0-501 Dumps In PDF And VCE From — https://www.passleader.com/sy0-501.html (166q VCE and PDF)
Good Luck!
Besides, a lot of that new 166Q Security+ SY0-501 dumps FYI here:
https://drive.google.com/open?id=1Ei1CtZKTLawI_2jpkecHaVbM_kXPMZAu
Good Luck, ALL!