Fichas
1.4 Security Controls for Hosts
Fichas del conjunto (42)
- 1What is a Trusted OS?- An OS that provides sufficient support for multilevel security.
- Meets Government requirements. - 2What is TCSEC?Trusted Computer System Evaluation Criteria
- Issued series of books called "Rainbow Series" - 3What was the TCSEC replaced by?Common Criteria (CC)
- 4What is EAL and how many levels are there?- Evaluation Assurance Levels
- 7 Levels - 5Which policies should be part of anti-malware training for users?- Keeping anti-malware apps current
- Performing daily or weekly scans
- Disabling auto-run/auto-play
- Disabling image previews in Outlook
- Surfing smart
- Hardening the browser with zones / filters - 6What are two locations that DLP could be implemented?- Network DLP
- Endpoint DLP - 7What is Network DLP?- Put at network egress points near perimeter.
- Analyzes network traffic - 8What is Endpoint DLP?Runs on end user workstations.
- 9What two methods does DLP use to determine sensitive data?- Precise method
- Imprecise method - 10What are some auditing guidelines?- Develop a log management plan
- Ensure deleting logs reqs TPI
- Monitor high-privilege accounts
- Ensure you cannot delete logs - 11If you see an audit event showing a lot of failure audits for logon/logoff, what could be the threat?- Random password hack
- Brute force attack. - 12If you see an audit event showing successful audits for user rights, user and group management along with security changes, what could be the threat?Misuse of privileges
- 13What are some aspects of host hardening?- Remove unnecessary applications
- Disable unnecessary services and ports
- Control connection to external media
- Disable unnecessary accounts
- Change default account names and passwords - 14While using Intel Active Management Technology (AMT) with Intel vPro chip set, what are some tasks you can accomplish with SCCM on Microsoft Server 2012R2?- Power on or off multiple computers
- Restart a non-functioning computer from known good boot image.
- Re-image computer via PXE
- Config scheduled software deployments - 15Which device is used to protect keys on a disk that's fully encrypted?Trusted Platform Module (TPM)
- 16What are two common uses of TPM chips?- Binding
- Sealing - 17In reference to TPM, what is binding?When the HDD is encrypted and the TPM is stored on the physical box. The HDD can only be decrypted by that box.
- 18In reference to TPM, what is sealing?Confines the encryption to the HDD, allowing the HDD to be moved to another box.
- 19What are the memory types used in a TPM chip?- Endorsement Key (EK)
- Storage Root Key (SRK)
- Attestation Identity Key (AIK)
- Platform Configuration Register (PCR) hash
- Storage Keys - 20In reference to TPM memory, what is an EK?- Endorsement Key
- Persistent memory that contains private/public key pair. - 21In reference to TPM memory, what is an SRK?- Storage Root Key
- Secures the keys stored inside of the TPM. - 22In reference to TPM memory, what is an AIK?- Attestation Identity Key
- Memory that ensures the integrity of the EK. - 23In reference to TPM memory, what is a PCR hash?- Platform Configuration Register
- Stores data hashing for the sealing function. - 24In reference to TPM memory, what is a Storage Key?- Stores the data hashes for the sealing function.
- 25What is a Type I hypervisor?- Native (Bare Metal)
- Runs directory on the host hardware to provide virtualization. - 26What is a Type II hypervisor?- Runs within a conventional OS.
- 27What is container-based virtualization?- Multiple user-space instances.
- Also known as operating system virtualization. - 28What is sandboxing and what is it used for?- Segregation of the virtual environment.
- Used to test suspicious files. - 29How many steps are part of the secure boot procedure?- 3
- 30In reference to secure boot procedure, what is the first step?Firmware verifies all UEFI executable files and the OS loader to verify they are trusted.
- 31In reference to secure boot procedure, what is the second step?Windows Boot Components verifies the signature on each component to be loaded.
- Any non-trusted componentes will not be loaded and require remediation. - 32In reference to secure boot procedure, what is the third step?Signatures on all boot critical drivers are checked as part of secure boot verification in WinLoad and by the Early Launch Antimalware driver.
- 33What is UEFI and what are some advantages?Unified Extensible Firmware Interface
- Can boot from disk over 2TB with GPT
-CPU independent architecture and drivers
- Modular - 34What is a VM escape?Where the attacker breaks out of the VM and interacts with the hypervisor.
- 35What are 3 models for implementing VDI?- Centralized model
- Hosted model
- Remote virtual desktops model - 36In reference to VDI, what is the centralized model?- All desktop instances are stored in a single server.
- Requires significant processing power on the server. - 37In reference to VDI, what is the hosted model?- Desktops are maintained by a service provider.
- Eliminates capital cost but introduces operation costs. - 38In reference to VDI, what is the remote virtual desktop model?- An image is copies to the local machine.
- Constant network connection is unnecessary. - 39What are two models to host applications from a central location?- Server-based application virtualization
- Client-based application virtualization - 40In reference to application virtualization, what is server-based?- Terminal services
- Apps run on servers and users receive app environment through remote client protocol.
- Microsoft RDP or Citrix ICA.
- Microsoft TS or Citrix Presentation Server - 41In reference to application virtualization, what is client-based?- Application streaming
- Target app is packaged and streamed to client PC. Own computing environment.
- Microsoft App-V - 42What is a Virtual TPM (VTPM)Enables trusted computed for an unlimited number of virtual machines on a single hardware platform.
Información
- Descripción
- Given a scenario, select and troubleshoot security controls for hosts.
- Creado por
- DJ Perrone
- Visitas
- 48
- Etiquetas
- Valoración