Client-Side and Transitive Access Attacks

Do you understand client side and transitive access attacks? Can you answer this sample Security+ question?

 Q. Your organization hosts a web site within a DMZ and the web site accesses a database server in the internal network. ACLs on firewalls prevent any connections to the database server except from the web server. Database fields holding customer data are encrypted and all data in transit between the web site server and the database server are encrypted. Which of the following represents the GREATEST risk to the data on the server?

    A. Theft of the database server
    B. XML injection
    C. SQL injection
    D. Sniffing

More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available here.

Security+ and Cookie Attacks

Are you familiar with cookie attacks? It doesn't refer to cookies actually attacking, but it does refer to how attackers can exploit vulnerabilities and access cookies.

As an example, can you answer this sample Security+ practice test question recently added to the gcgapremium.com online test banks?

Q. A penetration tester has successfully exploited a vulnerability against your organization giving him access to the following data:

User, password, login-date, cookie-id
Homer, canipass, 2016-09-01 11:12, 286755fad04869ca523320acce0dc6a4
Bart, passican, 2016-09-01 11:15, 8edd7261c353c87a113269cd37635c68
Marge, icanpass, 2016-09-01 11:19, 26887fbd90ac0340e29ad62470270401

What type of attack does this represent?

A. SQL injection

B. XML injection

C. XSS

D. Session hijacking

More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available here.

Security+ and Port Security

If you're planning on taking the Security+ exam, you should have a basic understanding of port security and how it can be implemented.

For example, can you answer this sample Security+ practice test question?

Q. Your organization frequently has guests visiting in various conference rooms throughout the building. These guests need access to the Internet via wall jacks, but should not be able to access internal network resources. Employees need access to both the internal network and the Internet. What would BEST meet this need?

A. PAT and NAT

B. DMZ and VPN

C. VLANs and 802.1x

D. Routers and Layer 3 switches

More, do you know why the correct answer is correct and the incorrect answers are incorrect? You can check your answer here. 

Symmetric Block Ciphers

Are you planning on taking the Security+ exam? Do you have a good understanding of symmetric algorithms and block ciphers.

As an example, can you answer this sample Security+ question?

Q. Which of the following algorithms encrypts data in 64-bit blocks?
 A. AES
 B. DES
 C. Twofish
 D. RC4

Check your answer here.

Security+ and Linux

Are you prepping for the Security+ exam? Do you know how to interpret basic Linux commands? 

See if you can answer this sample question.

Q. After entering the following command on a Linux system, what are you likely to see?

    cat /etc/shadow | grep root

A. The contents of the Linux password file
B. The password for the root account
C. The encrypted password of the root account
D. The encrypted password of the grep account

Check your answer here. 

Are you prepping for (or considering) the Security+ exam? See if you can you answer this Security+ practice test question?

Q. Administrators ensure server operating systems are updated at least once a month with relevant patches, but they do not track other software updates. Of the following choices, what is the BEST choice to mitigate risks on these servers?

A. Application change management

B. Application patch management

C. Whole disk encryption

D. Application hardening

See if you're correct by checking your answer here.

Security+ and PGP

Can you answer this sample Security+ question related to PGP?

Q. Consider the text in the graphic.

Which of the following most closely identifies the purpose of the text in the graphic.

A. Insert a public key within a document

B. Authenticate a document

C. Encrypt a document

D. Hash a document

You can check the answer (along with a full explanation) here.