Which item below is the standard security checklist against which systems are evaluated for a security posture?

What type of penetration testing technique is used if the tester has no prior knowledge of the network infrastructure that is being tested?black boxgray boxwhite box

sealed box

Select the vulnerability scan type that will use only the available information to hypothesize the status of the vulnerability.activeintrusivepassive

non-intrusive

Which tester has an in-depth knowledge of the network and systems being tested, including network diagrams, IP addresses, and even the source code of custom applications?white boxreplaysystem

black box

What type of reconnaissance is a penetration tester performing if they are using tools that do not raise any alarms?activeinvasivepassive

evasive

What process addresses how long data must be kept and how it is to be secured?legal and compliancedata methodologylegal retention

data retention

The goal of what type of threat evaluation is to better understand who the attackers are, why they attack, and what types of attacks might occur?threat mitigationthreat profilingthreat modeling

risk modeling

Which data erasing method will permanently destroy a magnetic-based hard disk by reducing or eliminating the magnetic field?wipingdegaussingpurging

data sanitation

What term is defined as the state or condition of being free from public attention to the degree that you determine?privacysecurecontentment

freedom

An administrator needs to view packets and decode and analyze their contents. What type of application should the administrator use?protocol analyzersystem analyzerapplication analyzer

threat profiler

Which is the term for a computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, yet they are imitations of real data files?honeypothoneynethoneycomb

port scanner

Vulnerability scanning should be conducted on existing systems and particularly as new technology equipment is deployed.True

False

Nslookup displays detailed information about how a device is communicating with other network devices.True

False

Which scan examines the current security, using a passive method?threat scanvulnerability scansystem scan

application scan

Realistically, risks can never be entirely eliminated.True

False

Which of the following groups categorize the risks associated with the use of private data? (Choose all that apply.)Private and consumer data.Individual inconveniences and identity theft.Associations with groups.

Statistical inferences.

Individual inconveniences and identity theft.Associations with groups.

Statistical inferences.

What security goal do the following common controls address: hashing, digital signatures, certificates, nonrepudiation tools?confidentialitysafetyintegrity

availability

What is another term used for a security weakness?vulnerabilityriskopportunity

threat

A port in what state below implies that an application or service assigned to that port is listening for any instructions?empty portinterruptible systemclosed port

open port

A risk management assessment is a systematic and methodical evaluation of the security posture of the enterprise.True

False

Which item below is the standard security checklist against which systems are evaluated for a security posture?baselinecontrolprofile

threat

What is the name of the process that basically takes a snapshot of the current security of an organization?threat assessmentthreat analysisrisk assessment

vulnerability appraisal

An administrator running a port scan wants to ensure that no processes are listening on port 23. What state should the port be in?secure portclosed portopen port

hardened port

What security goal do the following common controls address: Redundancy, fault tolerance, and patching?integrityavailabilityconfidentiality

safety

What is the end result of a penetration test?penetration test profilepenetration test viewpenetration test system

penetration test report

Netstat displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and DNS settings.True

False

What type of scanner sends "probes" to network devices and examines the responses received back to evaluate whether a specific device needs remediation?non-intrusivepassiveactive

intrusive

Which of the following is used to replicate attacks during a vulnerability assessment by providing a structure of exploits and monitoring tools?assessment imagereplication imageexploitation framework

penetration framework

TCP/IP uses a numeric value as an identifier to the applications and services on these systems.True

False

Which of the following are the goals of a vulnerability scan? (Choose all that apply.)identify a lack of security controlsidentify vulnerabilitiesidentify common misconfigurations

identify threat actors

identify a lack of security controlsidentify vulnerabilities

identify common misconfigurations

In white box and gray box testing, the first task of the tester is to perform preliminary information gathering on their own from outside the organization, sometimes called open source intelligence (OSINT).True

False

If a penetration tester has gained access to a network and then tries to move around inside the network to other resources, what procedure is the tester performing?persistencesecondary exploitationpivot

spinning

What is the term for a network set up with intentional vulnerabilities?honeycombhoneypothoney hole

honeynet

The second step in a vulnerability assessment is to determine the assets that need to be protected.True

False

If a user uses the operating system's "delete" command to erase data, what type of data removal procedure was used?degaussingdata sanitationwiping

purging

Each packet/datagram contains a source port and destination port.True

False

During a vulnerability assessment, what type of software can be used to search a system for port vulnerabilities?application profilerport scannervulnerability profiler

threat scanner

Determining vulnerabilities often depends on the background and experience of the assessor.True

False

What process does a penetration tester rely on to access an ever-higher level of resources?continuous exploitationpersistencepivot

spinning

Which security procedure is being demonstrated if an administrator is using Wireshark to watch for specific inbound and outbound traffic?virus controlfirewall monitoringapplication control

application search

Which of the following is a valid data sensitivity labeling and handling category? (Choose all that apply.)proprietaryconfidentialpersonal health information

high-risk