Free 312-38 Practice Test

The "default deny" principle is a foundational security strategy for firewalls and access control systems. It dictates that any traffic or access request that is not explicitly permitted by a rule is automatically denied. This approach, also known as an implicit deny, minimizes the attack surface by ensuring that only known and approved services are accessible, blocking all other potential connections. It is a more secure posture than a "default allow" strategy, which permits all traffic except that which is explicitly forbidden.

A. Default allow is the opposite strategy, where all traffic is permitted unless an explicit rule denies it, which is considered insecure.
C. Default restrict is not a standard industry term for this security principle; "default deny" is the correct terminology.
D. Default access is ambiguous and not a standard term. Access can be either allowed or denied by default.

1. National Institute of Standards and Technology (NIST). (2005). Guidelines on Firewalls and Firewall Policy (Special Publication 800-41 Revision 1). Section 4.3.1, "Firewall Policy Approaches," p. 21. States that the most secure posture is to "deny all traffic, except for that which is explicitly permitted."

2. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 398-402. Principle 8, "Fail-safe defaults," establishes the academic basis for denying access by default. DOI: https://doi.org/10.1145/361011.361062

3. Chapman, D. B., & Zwicky, E. D. (1995). Building Internet Firewalls. O'Reilly & Associates. Chapter 4, "Firewall Design," discusses the principle of "That which is not expressly permitted is prohibited."

The IEEE 802.16 standard, commercially known as WiMAX (Worldwide Interoperability for Microwave Access), is a family of wireless broadband communication standards for Wireless Metropolitan Area Networks (WMANs). It is designed to provide wireless "last mile" broadband connectivity, serving as an alternative to cable and DSL. It can cover a radius of several kilometers, making it suitable for connecting homes and businesses in a metropolitan area to the internet.

A. 802.15 is the IEEE standard for Wireless Personal Area Networks (WPANs), such as Bluetooth, which operate over much shorter distances.
C. 802.15.4 is a specific standard within the 802.15 family for low-rate WPANs (LR-WPANs), used by protocols like Zigbee for low-power, low-data-rate applications.
D. 802.12 was a standard for 100VG-AnyLAN, a now-obsolete wired networking technology, not a wireless standard for MANs.

1. Stallings, W. (2016). Foundations of Modern Networking: SDN, NFV, QoE, IoT, and Cloud. Pearson Education, Inc. Chapter 13, Section 13.2 "IEEE 802.16 and WiMAX," describes the standard's purpose for providing broadband wireless access in a MAN.

2. IEEE Standards Association. (2012). IEEE Standard for Air Interface for Broadband Wireless Access Systems (IEEE Std 802.16-2012). The scope section (Section 1) defines the standard for fixed and mobile broadband wireless access in metropolitan networks.

3. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 6, Section 6.3.3, discusses 802.16 WiMAX as a technology for wireless access over ranges of tens of kilometers.

The attack surface represents the total sum of all possible points or vectors an attacker can use to try to enter or extract data from a system. It is directly proportional to the number of reachable and exploitable vulnerabilities. Therefore, when an organization reduces vulnerabilities through activities like patching, secure configuration, or disabling unnecessary services, it effectively closes off potential entry points for attackers. This action directly reduces the size of the attack surface, thereby enhancing the system's security posture.

B. Increase in vulnerabilities decreases the attack surface: This is false. More vulnerabilities create more attack vectors, thus increasing the attack surface.
C. Decrease in risk exposures increases the attack surface: This is incorrect. Reducing risk exposure is a positive outcome, often achieved by reducing the attack surface.
D. Decrease in vulnerabilities increases the attack surface: This is logically incorrect and the opposite of the true relationship between vulnerabilities and the attack surface.

- Manadhata, P. K., & Wing, J. M. (2011). An attack surface metric. IEEE Transactions on Software Engineering, 37(3), 371-386. https://doi.org/10.1109/TSE.2010.60. The paper's core concept is that the attack surface is composed of methods, channels, and data items that are exploitable (i.e., have vulnerabilities).

- Howard, M., LeBlanc, D., & Viega, J. (2009). 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. McGraw-Hill. Chapter 1 introduces the concept of reducing the attack surface by minimizing code, entry points, and services, which directly correlates to reducing vulnerabilities.

Disaster Recovery (DR) is fundamentally a business-centric strategy. While it involves technical operations (recovering servers, data, networks), its objectives, priorities, and scope are dictated by business needs. The Business Impact Analysis (BIA) process identifies critical business functions and sets the Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for the underlying technology. Therefore, the entire DR strategy is designed to support business continuity and resilience, making it business-centric.

A. Operation-centric strategy: This is too narrow; DR is driven by business requirements, not just the operational mechanics of recovery.
B. Security-centric strategy: DR is a component of a comprehensive security program, but its primary goal is availability and continuity, not security itself.
C. Data-centric strategy: While data recovery is a critical part of DR, the strategy also encompasses systems, applications, personnel, and facilities.

1. National Institute of Standards and Technology (NIST). (2010). Special Publication 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems. Section 3.2, "Business Impact Analysis (BIA)," emphasizes that contingency planning efforts are guided by the BIA, which identifies and prioritizes the organization's critical business processes.

2. Uhlig, R., et al. (2017). Dependable and Secure Computing. Lecture Notes, CS 598, University of Illinois Urbana-Champaign. The courseware discusses how DR objectives are derived from business-level requirements for continuity.

Application whitelisting is a "default-deny" security posture. It works by maintaining a list of approved or trusted applications that are explicitly authorized to be present and active on a system. Any application not on this list is blocked from executing. This contrasts with application blacklisting, which is a "default-allow" approach that only blocks known malicious or undesirable applications, allowing all others to run. Option D accurately describes the fundamental mechanism of whitelisting.

Option A describes application blacklisting, where all applications are allowed except for a specific list of undesirable ones.
Option B is too general; while whitelisting does involve trusted applications, its defining characteristic is the default-deny mechanism.
Option C describes sandboxing or application isolation, a different security technique for running untrusted code in a restricted environment.

1. Souppaya, M., & Scarfone, K. (2015). Guide to Application Whitelisting. National Institute of Standards and Technology (NIST), Special Publication 800-167. https://doi.org/10.6028/NIST.SP.800-167. (See Section 2.1, "Application Whitelisting Technologies").

2. University of California, Berkeley. (n.d.). Application Whitelisting. Information Security Office. Retrieved from https://security.berkeley.edu/education-awareness/application-whitelisting. (See "What is Application Whitelisting?" section).

3. Australian Cyber Security Centre (ACSC). (2022). Implementing Application Control. Australian Government. Retrieved from https://www.cyber.gov.au/acsc/view-all-content/publications/implementing-application-control. (See "What is application control?" section).

The Social-Engineer Toolkit (SET) is an open-source penetration testing framework designed specifically for social engineering. It allows security professionals to simulate various social engineering attacks, such as phishing campaigns, malicious web requests, and credential harvesting. By using SET to test an organization's employees, defenders can identify weaknesses in human processes and awareness. These weaknesses are Indicators of Exposure (IoEs) that constitute the human attack surface, providing insight into how susceptible the organization is to manipulation-based attacks.

A. securiCAD is a tool for automated threat modeling and attack simulation on IT architectures, not focused on the human element.
B. Amass is a network mapping and asset discovery tool used to identify an organization's external infrastructure attack surface.
C. Skybox Security provides a platform for cybersecurity posture management, focusing on network-level vulnerability and threat analysis.

1. TrustedSec. (n.d.). The Social-Engineer Toolkit (SET). Official documentation. Retrieved from https://github.com/trustedsec/social-engineer-toolkit. The tool's purpose is explicitly stated as social engineering testing.

2. Hadnagy, C. (2018). Social Engineering: The Art of Human Hacking (2nd ed.). Wiley. Chapter 11 provides a detailed walkthrough of using the Social-Engineer Toolkit for testing the human element. (Note: While a book, its author is the creator of SET, making it a primary source).

Packet filtering firewalls operate primarily at the Network Layer (Layer 3) of the OSI model. They inspect the headers of incoming and outgoing packets and make decisions to allow or block traffic based on rules that use information such as source and destination IP addresses. They may also use information from the Transport Layer (Layer 4), such as TCP or UDP port numbers, but their fundamental operation is centered on the network-level addressing and routing information found in Layer 3.

B. Application Layer (Layer 7) is where proxy firewalls and Web Application Firewalls (WAFs) operate, inspecting the content of application traffic.
C. Session Layer (Layer 5) is the domain of circuit-level gateways, which monitor TCP handshakes to validate sessions.
D. Physical Layer (Layer 1) deals with the physical transmission of raw bits and has no concept of packets or addresses for a firewall to inspect.

1. National Institute of Standards and Technology (NIST). (2005). SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. In Section 3.1, "Packet Filter," it states, "A packet filter is a firewall that operates at the network layer of the OSI model."

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8, "Security in Computer Networks," describes packet filtering as examining fields in the IP and TCP/UDP headers, corresponding to Layers 3 and 4.

3. Chapman, D. B., & Zwicky, E. D. (1995). Building Internet Firewalls. O'Reilly & Associates. Chapter 6, "Packet Filtering," details how these firewalls work with IP packet headers, which is a Layer 3 function.

The established methodology for a cyberattack, often termed the "Cyber Kill Chain" or "Phases of Hacking," follows a logical progression. An attacker first gathers information (Reconnaissance), then actively probes the target for vulnerabilities (Scanning). Using a discovered vulnerability, the attacker gains entry (Gaining Access). To ensure persistent control, they install tools for future access (Maintaining Access). Finally, to avoid detection and retribution, the attacker removes evidence of their presence (Covering Tracks). This sequence represents the most effective and standard operational flow for an attacker.

B: Scanning before Reconnaissance is illogical; an attacker needs to know what to scan first, which is determined during reconnaissance. C: Gaining Access before Scanning is not possible; scanning is the process of finding the vulnerabilities needed to gain access. D: Covering Tracks before Maintaining Access is counter-intuitive; an attacker would first establish persistence before cleaning up their entry-related evidence.

1. Z. A. K. Khattak, S. H. Ahmed, Z. A. Zardari, and I. A. K. Khattak, "Ethical Hacking, and Penetration Testing," in Cyber Security and Penetration Testing, 2021, pp. 1-18. DOI: https://doi.org/10.1007/978-981-15-9924-21. (This academic book chapter outlines the standard five phases of ethical hacking in the order presented in option A).

2. Kim, P. (2017). The Hacker Playbook 3: Practical Guide To Penetration Testing. "The Process" section outlines the attack lifecycle starting with Reconnaissance and followed by Scanning/Enumeration. (This is a widely cited text in university cybersecurity curricula).

3. National Institute of Standards and Technology (NIST). (2021). NIST SP 800-115, Technical Guide to Information Security Testing and Assessment. Section 3.2 describes the testing methodology which begins with Planning (Reconnaissance) followed by Discovery (Scanning).

On Debian-based Linux distributions like Ubuntu, the update-rc.d command is a utility to manage System V-style init script links. These links, located in /etc/rc.d/, control which services start or stop at different runlevels. Using the remove action with update-rc.d deletes these symbolic links, which effectively prevents the service from starting automatically upon system boot. The service command only affects the current session, and chkconfig is used on Red Hat-based systems.

A. # chkconfig [service name]off: The chkconfig command is the standard tool for managing services on Red Hat-based distributions (e.g., RHEL, CentOS), not Debian-based ones.
B. # chkconfig [service name] –del: This is also a chkconfig command for Red Hat systems, used to remove a service entirely from its management.
C. # service [service name] stop: This command stops a service for the current session only; it does not prevent the service from starting again on the next reboot.

The Debian Administrator's Handbook. (2022). Chapter 9. Unix Services. Retrieved from https://debian-handbook.info/browse/stable/sect.unix-services.html. (Section 9.5.1, "Starting and Stopping Services," describes the use of update-rc.d for enabling and disabling services at boot).

Ubuntu Community Help Wiki. (n.d.). Services. Retrieved from https://help.ubuntu.com/community/Services. (This page explains the use of update-rc.d for managing startup scripts in older versions and its relationship with newer tools like systemctl).

Bring Your Own Device (BYOD) is an IT policy that allows employees to use their personal devices (such as smartphones, laptops, and tablets) for work-related purposes. This approach provides maximum flexibility and user comfort, as employees can use the hardware and software they are most familiar with and have personally selected to fit their preferences.

B. COPE (Corporate-Owned, Personally-Enabled): The organization owns and controls the device, although it allows for personal use. The employee does not choose the device.
C. COBO (Corporate-Owned, Business-Only): The organization owns the device, and it is restricted to business use only, offering no employee choice or personal use.
D. CYOD (Choose Your Own Device): The organization provides a pre-approved list of devices from which employees can choose. This offers limited choice, not full preference.

1. National Institute of Standards and Technology (NIST). (2021). Special Publication 800-124 Revision 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise. Section 2.2, "Mobile Device Deployment Models," defines BYOD as allowing users to access enterprise resources from their personally owned devices.

2. Morrow, B. (2012). BYOD: A Business and Technical Guide. Cisco Press. Chapter 1, "What is BYOD?," defines the model as employees using their own devices for work, emphasizing user preference and comfort.

3. Gass, S., & Harris, J. (2013). Managing the Mobile-First Enterprise. SANS Institute Reading Room. This paper discusses various mobile models, clearly distinguishing BYOD by its use of employee-owned hardware (p. 4).