CCNA Cyber Ops FAQ: Security Monitoring Operational Challenges

Q1. Which of the following are benefits of encryption?
A. Malware communication
B. Privacy
C. Malware mitigation
D. Malware identification

Answer: B. Privacy is one of the main benefits of encryption. The rest of the answers are either not valid or not a benefit.

Q2. Why can encryption be challenging to security monitoring?
A. Encryption introduces latency.

B. Encryption introduces additional processing requirements by the CPU.

C. Encryption can be used by threat actors as a method of evasion and obfuscation, and security monitoring tools might not be able to inspect encrypted traffic.

D. Encryption can be used by attackers to monitor VPN tunnels.

Answer: C. Encryption can be used by threat actors as a method of evasion and obfuscation, and security monitoring tools might not be able to inspect encrypted traffic.

Q3. Network address translation (NAT) introduces challenges in the identification and attribution of endpoints in a security victim. The identification challenge applies to both the victim and the attack source. What tools are available to be able to correlate security monitoring events in environments where NAT is deployed?
A. NetFlow
B. Cisco Lancope Stealthwatch System
C. Intrusion Prevention Systems (IPS)
D. Encryption protocols

Answer: B. A few security products, such as the Cisco Lancope Stealthwatch system, provide features such as NAT stitching to use NetFlow with other data in the network and be able to correlate and “map” translated IP addresses. This accelerates incident response tasks and eases continuous security monitoring operations.

Q4. If the date and time are not synchronized among network and security devices, logs can become almost impossible to correlate. What protocol is recommended as a best practice to deploy to mitigate this issue?
A. Network address translation
B. Port address translation
C. Network Time Protocol (NTP)
D. Native Time Protocol (NTP)

Answer: C. NTP is recommended as a best practice to synchronize the “clock” (date and time) of all network infrastructure devices, servers, and other endpoints.

Q5. What is a DNS tunnel?
A. A type of VPN tunnel that uses DNS.

B. A type of MPLS deployment that uses DNS.

C. DNS was not created for tunneling, but a few tools have used it to encapsulate data in the payload of DNS packets.

D. An encryption tunneling protocol that uses DNS’s UDP port 53.

Answer: B. DNS was not created for tunneling, but a few tools have used it to encapsulate data in the payload of DNS packets. Threat actors have been using many different untraditional techniques to steal data from corporate networks without being detected. For example, they have been sending stolen credit card data, intellectual property, and confidential documents over DNS using tunneling.

Q6. Which of the following are examples of DNS tunneling tools? (Select all that apply.)
A. DeNiSe
B. dns2tcp
C. DNScapy
D. DNStor

Answer: A, B, C. DeNiSe, dns2tcp, and DNScapy are examples of DNS tunneling tools. They were originally not created for malicious purposes, but they have been used by attackers to steal data from victims for years.

Q7. What is Tor?
A. An encryption protocol.
B. A hashing protocol.
C. A VPN tunnel client.
D. Tor is a free tool that enables its users to surf the Web anonymously.

Answer: D. Tor is a free tool that enables its users to surf the Web anonymously. Tor has been used by nonmalicious users to keep their activity private, but also by malicious threat actors to carry out their attacks and perform other illicit activities.

Q8. What is a Tor exit node?
A. The encrypted Tor network

B. The last Tor node or the “gateways” where the Tor encrypted traffic “exits” to the Internet

C. The Tor node that performs encryption

D. The Tor browser installed in your system in order to “exit” the Internet

Answer: B. A Tor exit node is basically the last Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet. A Tor exit node can be targeted to monitor Tor traffic. Many organizations block Tor exit nodes in their environment. The Tor project has a dynamic list of Tor exit nodes that make this task a bit easier. This Tor exit node list can be downloaded from https://check.torproject.org/exit-addresses.

Q9. What is a SQL injection vulnerability?
A. A type of vulnerability where an attacker can insert or “inject” a SQL query via the input data from the client to the application or database

B. A type of vulnerability where an attacker can “inject” a new password to a SQL server or the client

C. A type of DoS vulnerability that can cause a SQL server to crash

D. A type of privilege escalation vulnerability aimed at SQL servers

Answer: A. Attackers can insert or “inject” a SQL query via the input data from the client to the application or database. Attackers can exploit SQL injector vulnerabilities to read sensitive data from the database, modify or delete database data, execute administration operations on the database, and even issue commands to the operating system.

Q10. What are examples of peer-to-peer (P2P) tools?
A. LionShare
B. P2P NetFlow
C. Napster
D. Peercoin

Answer: A, C, D. LionShare, Napster, and Peercoin are examples ofP2P tools. P2P NetFlow does not exist.

Q11. What is Tor?
A. Tor is The Onion Router and is a free tool that enables its users to surf the Web anonymously.

B. Tor is The Onion Router and is a free tool that enables its users to send email in an encrypted way using PGP.

C. Tor is The Onion Router and is a free tool that enables its users to route packets anonymously by leveraging the EIGRP or OSPF routing protocol.

D. Tor is The Onion Router and is a free tool that enables its users to route packets anonymously by using BGP.

Answer: A. The Onion Router (Tor) is both free and enables its users to surf the Web anonymously.

Q12. Why does NAT present a challenge to security monitoring?
A. NAT can present a challenge when performing security monitoring and analyzing logs because data can be encrypted as a result of the network address translation.

B. NAT can present a challenge when performing security monitoring and analyzing logs because data can be dropped as a result of the network address translation.

C. NAT can present a challenge when performing security monitoring and analyzing logs, NetFlow, and other data because device IP addresses can be seen in the logs as the “translated” IP address versus the “real” IP address.

D. NAT can present a challenge when performing security monitoring and analyzing logs because data can be fragmented as a result of the network address translation.

Answer: C. Answer C correctly states the challenge NAT presents to security monitoring.

Q13. What is a Tor exit node?
A. A Tor exit node is the first Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet.

B. A Tor exit node is the last Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet.

C. A Tor exit node is the Tor node or the “gateway” where the Tor browser connects first.

D. A Tor exit node is an Internet routing entity that can define how the Tor browser exits the common Internet and connects to the darknet

Answer: B. A Tor exit node is the last Tor node or the “gateway” where the Tor encrypted traffic “exits” to the Internet.

Q14. Which of the following is an example of a DNS tunneling tool?
A. dig
B. nslookup
C. DNScapy
D. DNSSEC

Answer: C. DNScapy is an example of a DNS tunneling tool.

Q15. Which of the following is an example of an encoding mechanism used by threat actors?
A. Base24 encoding
B. GRE tunnels
C. Hex tunnels
D. Base64 encoding

Answer: D. Base64 encoding is an example of an encoding mechanism used by threat actors.

Q16. Why should NTP be enabled in infrastructure devices and for security monitoring?
A. Using NTP ensures that the correct time is set and that all devices within the network are synchronized. Also, it helps to reduce the amount of duplicate logs.

B. Using NTP ensures that the network tunneling protocol is implemented with the correct encryption algorithms.

C. Using NTP ensures that the network tunneling protocol is implemented with the correct hashing algorithms.

D.Using NTP ensures that the network tunneling protocol is implemented with the correct DNS names and NetFlow records.

Answer: A. The Network Time Protocol (NTP) ensures that the correct time is set and that all devices within the network are synchronized.

More Resources

CCNA Cyber Ops FAQ: Security Monitoring Operational Challenges

Related

Leave a Reply Cancel reply