John used to work as a Network Administrator for We-are-secure Inc. Now he has resigned from the company for personal reasons. He wants to send out some secret information of the company. To do so, he takes an image file and simply uses a tool image hide and embeds the secret file within an image file of the famous actress, Jennifer Lopez, and sends it to his Yahoo mail id. Since he is using the image file to send the data, the mail server of his company is unable to filter this mail.Which of the following techniques is he performing to accomplish his task?
Answer(s): D
According to the scenario, John is performing the Steganography technique for sending malicious data. Steganography is an art and science of hiding information by embedding harmful messages within other seemingly harmless messages. It works by replacing bits of unused data, such as graphics, sound, text, and HTML, with bits of invisible information in regular computer files.This hidden information can be in the form of plain text, cipher text, or even in the form of images. Answer option C is incorrect. Web ripping is a technique in which the attacker copies the whole structure of a Web site to the local disk and obtains all files of the Web site. Web ripping helps an attacker to trace the loopholes of the Web site. Answer option B is incorrect. Social engineering is the art of convincing people and making them disclose useful information such as account names and passwords. This information is further exploited by hackers to gain access to a user's computer or network. This method involves mental ability of the people to trick someone rather than their technical skills. A user should always distrust people who ask him for his account name or password, computer name, IP address, employee ID, or other information that can be misused.Answer option A is incorrect. John is not performing email spoofing. In email spoofing, an attacker sends emails after writing another person's mailing address in the from field of the email id.
Which of the following intrusion detection systems (IDS) monitors network traffic and compares it against an established baseline?
Answer(s): B
The anomaly-based intrusion detection system (IDS) monitors network traffic and compares it against an established baseline. This type of IDS monitors traffic and system activity for unusual behavior based on statistics. In order to identify a malicious activity, it learns normal behavior from the baseline. The anomaly-based intrusion detection is also known as behavior-based or statistical-based intrusion detection.Answer option D is incorrect. Signature-based IDS uses a database with signatures to identify possible attacks and malicious activity.Answer option A is incorrect. A network-based IDS can be a dedicated hardware appliance, or an application running on a computer, attached to the network. It monitors all traffic in a network or traffic coming through an entry-point such as an Internet connection.Answer option C is incorrect. There is no such intrusion detection system (IDS) that is file-based.
Access controls are divided into three different categories. Place the appropriate security services in their corresponding categories.
Answer(s): A
The various security services with their corresponding categories are as follows:Preventive access control:FenceSecurity policySecurity awareness trainingAntivirus softwareDetective access control:Security guardSupervising userIncident investigationIntrusion detection systemCorrective access control:AlarmMantrapSecurity policy
Which of the following are the initial steps required to perform a risk analysis process? Each correct answer represents a part of the solution. Choose three.
Answer(s): A,B,D
The main steps of performing risk analysis are as follows:Estimate the potential losses to the assets by determining their value.Evaluate the potential threats to the assets.Establish the threats probability and regularity.
Which of the following protocols uses the Internet key Exchange (IKE) protocol to set up security associations (SA)?
ISAKMP (Internet Security Association and Key Management Protocol) is a protocol for establishing Security Associations (SA) and cryptographic keys in an Internet environment. It provides a framework for the negotiation and management of security associations between peers and traverses on UDP/500 port. ISAKMP defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key generation techniques, and threat mitigation (e.g. denial of service and replay attacks).ISAKMP defines procedures and packet formats to establish, negotiate, modify, and delete Security Associations. Security Associations contain all information required for execution of various network security services, such as the IP layer services (such as header authentication and payload encapsulation), transport or application layer services, or self-protection of negotiation traffic. ISAKMP defines payloads for exchanging key generation and authentication data.Answer option A is incorrect. Internet Protocol Security (IPSec) is a standard-based protocol that provides the highest level of VPN security.IPSec can encrypt virtually everything above the networking layer. It is used for VPN connections that use the L2TP protocol. It secures both data and password.IPSec cannot be used with Point-to-Point Tunneling Protocol (PPTP). Answer option B is incorrect. Layer 2 Tunneling Protocol (L2TP) is a more secure version of Point-to- Point Tunneling Protocol (PPTP). It provides tunneling, address assignment, and authentication. L2TP allows transfer of Point-to-Point Protocol (PPP) traffic between different networks.L2TP combines with IPSec to provide both tunneling and security for Internet Protocol (IP), Internetwork Packet Exchange (IPX), and other protocol packets across IP networks.Answer option C is incorrect. LEAP (Lightweight Extensible Authentication Protocol) is a proprietary wireless LAN authentication method developed by Cisco Systems. Important features of LEAP are dynamic WEP keys and mutual authentication between a wireless client and a RADIUS server. LEAP allows clients to re-authenticate frequently. The clients get a new WEP key upon each successful authentication.
Post your Comments and Discuss ISC2 ISSAP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the ISSAP content, but please register or login to continue.