an account. Repeated logins for a single user ID with iterations
of various passwords is likely a dictionary account. A rainbow
table is used to match a hashed password with the password
that was hashed to that value. A pass-the-hash attack provides a
captured authentication hash to try to act like an authorized
user. A password spraying attack uses a known password (often
from a breach) for many different sites to try to log in to them.
For more information, see Chapter 4.
10. D. Jump servers are systems that are used to provide a presence
and access path in a different security zone. VDI is a virtual
desktop infrastructure and is used to provide controlled virtual
systems for productivity and application presentation among
other uses. A container is a way to provide a scalable,
predictable application environment without having a full
underlying virtual system, and a screened subnet is a secured
zone exposed to a lower trust level area or population. For more
information, see Chapter 12.
11. C. Derek's organization is worried about insider threats, or
threats that are created by employees and others who are part
of the organization or are otherwise trusted by the organization.
Social engineering involves deceiving people to achieve an
attacker's goals. Phishing attempts to acquire personal
information through social engineering and other techniques,
and shoulder surfing is a technique where malicious actors
watch over someone's shoulder to acquire information like
passwords or credit card numbers. For more information, see
Chapter 2.
12. A. Corrective controls remediate security issues that have
already occurred. Restoring backups after a ransomware attack
is an example of a corrective control. Preventative controls
attempt to stop future issues. Detective controls focus on
detecting issues and events, and deterrent controls attempt to
deter actions. For more information, see Chapter 1.
13. C. This activity is almost certainly a violation of the
organization's acceptable use policy (AUP), which should
contain provisions describing appropriate use of networks and
computing resources belonging to the organization. BPA is not
a common term in this context. Service level agreements
(SLAs) determine an agreed upon level of service, and MOUs,
or memorandums of understanding are used to document
agreements between organizations. See Chapter 16 for more
information.
14. D. The staging environment is a transition environment for
code that has successfully cleared testing and is waiting to be
deployed into production. This is where the code should reside
before it is released for use. The development environment is
where developers work on the code prior to preparing it for
deployment. The test environment is where the software or
systems can be tested without impacting the production
environment. The production environment is the live system.
Software, patches, and other changes that have been tested and
approved move to production. For more information, see
Chapter 6.
15. B. Acceptable use policies define how organizational systems,
devices, and services can and should be used. Change
management policies determine how an organization handles
change and change control. Access control documentation is
typically handled as a standard, and playbooks describe how
perform specific duties or processes.
16. C. Wildcard certificates protect the listed domain as well as all
first-level subdomains. test.mail.acmewidgets.net is a secondlevel subdomain of acmewidgets.net and would not be covered
by this certificate. For more information, see Chapter 7.
17. A. The sender of a message may digitally sign the message by
encrypting a message digest with the sender's own private key.
For more information, see Chapter 7.