Redundancy and Patching

Can you identify the differences between redundancy and patching when discussing core security goals? You should if you plan to take the Security+ exam. As an example, see if you can answer this sample Security+ question?

Your organization recently implemented two servers that act as failover devices for each other. Which security goal is your organization pursuing?

A. Safety

B. Integrity

C. Confidentiality

D. Availability

You can see the answer and full explanation here.

System Hardening for Security

Can you answer this sample Security+ question on hardening? Q. Your organization wants to improve the security posture of internal database servers and protect against zero-day vulnerabilities. Of the following choices, what provides the BEST solution? A. Opening ports on a server’s firewall B. Disabling unnecessary services C. Keeping systems up to date with current patches D. Keeping systems up to date with current service packs

You can view the answer and explanation here.

How to Interpret Performance-Based Questions

Can you answer this sample performance-based question?

Your organization has the following security requirements:

• Homer is the night-time nuclear power plant manager and should only be allowed to access classified documents during his working hours. 
• Personnel within the IT department should be able to access materials they need, but should not be able to access materials used by personnel in the nuclear engineer department. 
• Only nuclear engineers with the label of Meltdown should be able to access highly classified material with the same label. 

 Fill in the table with the following available answers:

• Departments
• Meltdown
• Time-based Restriction
• Nuclear engineers
• Homer

Component	Your Answer
Role-Based Access Control	___
Mandatory Access Control	___
Nuclear Power Plant Manager	___

Note that all of the available answers will not be used. However, you must meet all of the requirements.

Do you know the answer? More, do you know why the correct answers are correct, and why the incorrect answers are incorrect?

You can view the answer and explanation here.

IDS Versus IPS

If you're planning on taking the Security+ exam, you should have a basic understanding of an IDS and an IPS.

For example, can you answer this question?

Q. Which of the following network tools includes sniffing capabilities?

A. IDS

B. WAP

C. VPN

D. NAC

More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available here.

Configuring DNS Servers

If you're planning on taking the Security+ exam or Network+ exam, you should have a basic understanding of DNS servers. 

For example, can you answer this question?

Q. You need to reboot your DNS server. Of the following choices, which type of server are you MOST likely to reboot?

A. Unix server

B. Apache server

C. BIND server

D. Web server

More, do you know why the correct answer is correct and the incorrect answers are incorrect?

The answer and explanation is available here.

Can You Identify This Attack

Many attacks target server applications such as those hosted on web servers. Web servers are highly susceptible to several types of attacks. If you’re planning on taking the Security+ exam, you should have a basic understanding of common server attacks.

For example, can you answer this sample Security+ practice test question?

Q. Checking the logs of a web server, you see the following entry:

198.252.69.129 –[1/Sep/2013:05:20]”GET /index.php?username=ZZZZZZZZZZZZZZZZZZZZBBBBBBBBCCCCCCCHTTP/1.1″ “http://gcgapremium.com/security/” “Chrome31”

Which of the following is the BEST choice to explain this entry?

A. A SQL injection attack

B. A pharming attack

C. A phishing attack

D. A buffer overflow attack

More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.

Using Security Labels

Are you familiar with how Security labels can be used to control access to data? If you're planning on taking the Security+ exam, it's something you might like to review. For example, can you answer this sample practice test question?

Q. A security administrator needs to implement an access control system that will protect data based on the following matrix.

Document Type	Security Level	Security Label
Employment documents	Confidential	Employee
Salary and Compensation Documents	Confidential	Payroll
Internal phone listing documents	Confidential	Employee

(Note that this matrix only represents a subset of the overall requirements).

Which of the following choices would be the BEST solution to meet this requirement?

A. DAC

B. Trusted OS

C. Role-BAC

D. SCADA

The answer and explanation is available here.

Protecting SCADA Systems

Protecting SCADA (supervisory control and data acquisition) systems has become an important topic within the context of Security over the years. If you're planning on taking the Security+ exam, it's important topic to understand.

For example, can you answer this sample Security+ practice test question?

Q. Lisa oversees and monitors processes at a water treatment plant using SCADA systems. Administrators recently discovered malware on her system that was connecting to the SCADA systems. Although they removed the malware, management is still concerned. Lisa needs to continue using her system and it’s not possible to update the SCADA systems. What can mitigate this risk?

A. Install HIPS on the SCADA systems.

B. Install a firewall on the border of the SCADA network.

C. Install a NIPS on the border of the SCADA network.

D. Install a honeypot on the SCADA network.

More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available here.

http://blogs.getcertifiedgetahead.com/protecting-scada-systems/

HVAC Systems and Security+

If you're planning on taking the Security+ exam, you should have a good understanding of HVAC systems. 

For example, can you answer this question?

Q. Your organization is evaluating replacement HVAC systems and is considering increasing current capacities. Which of the following is a potential security benefit of increasing the HVAC capabilities?

A. Lower MTBF times of hardware components due to lower temperatures

B. Higher MTBF times of hardware components due to lower temperatures

C. Lower MTTR times of hardware components due to lower temperatures

D. Higher MTTR times of hardware components due to lower temperatures

Check out the answer and explanation here.