Latest 1D0-671 Dumps (V8.02) – The Most Effective Study Materials for CIW Web Security Associate Exam Preparation

1. Which of the following causes problems with firewalls

2. In relation to security, which of the following is the primary benefit of classifying systems?

3. Irina has contracted with a company to provide Web design consulting services. The company has asked her to use several large files available via an HTTP server.

The IT department has provided Irina with user name and password, as well as the DNS name of the HTTP server. She then used this information to obtain the files she needs to complete her task using Mozilla Firefox.

Which of the following is a primary risk factor when authenticating with a standard HTTP server?

4. You have been assigned to provide security measures for your office's reception area. Although the company needs to provide security measures, costs must be kept to a minimum.

Which of the following tools is the most appropriate choice?

5. Which symmetric algorithm created by the RSA Security Corporation is a stream cipher that encrypts messages as a whole, in real time?

6. Your firewall is configured to forbid all internal traffic from going out to the Internet. You want to allow internal clients to access all Web traffic.

At a minimum, what ports must you open in regards to the internal systems?

7. The vast majority of hackers are which type of attacker?

8. The best way to thwart a dictionary attack is by enforcing a:

9. Which of the following will best help you ensure a database server can withstand a recently discovered vulnerability?

10. A new video conferencing device has been installed on the network. You have been assigned to troubleshoot a connectivity problem between remote workers and the central company. Specifically, remote workers are having problems making any connection at all.

Which technique will most likely help you solve this problem while retaining the existing level of security at the firewall?

11. Which protocol uses cleartext communication by default?

12. Which of the following is the primary weakness of symmetric-key encryption?

13. Which component works with an operating system to increase its security ability?

14. Which task should you perform first when considering where to place equipment?

15. Danielle was informed by her network administrator that an audit may be conducted during the night to determine the hosts that exist on the network and document any open ports. The next day, Danielle was unable to access any network services.

What may have occurred instead of the anticipated audit?

16. How do activity logs help to implement and maintain a security plan?

17. Which of the following errors most commonly occurs when responding to a security breach?

18. What is the term for a self-replicating program or algorithm that consumes system resources?

19. Which of the following describes the practice of stateful multi-layer inspection?

20. Which term describes a dedicated system meant only to house firewall software?

21. At the beginning of an IPsec session, which activity occurs during the Internet Key Exchange (IKE)?

22. A distributed denial-of-service (DDOS) attack has occurred where both ICMP and TCP packets have crashed the company's Web server.

Which of the following techniques will best help reduce the severity of this attack?

23. Consider the following image of a packet capture:

Which of the following best describes the protocol used, along with its primary benefit?

24. What is the primary advantage of using a circuit-level proxy?

25. A flaw is discovered in an application. Before a patch is available, this vulnerability is used to gain access to sensitive data.

What type of attack is being described?

26. Which of the following is the simplest, most common firewall design?

27. Which security management concept is the ability for a department to accurately determine the costs of using various networking security services?

28. A CGI application on the company's Web server has a bug written into it. This particular bug allows the application to write data into an area of memory that has not been properly allocated to the application. An attacker has created an application that takes advantage of this bug to obtain credit card information.

Which of the following security threats is the attacker exploiting, and what can be done to solve the problem?

29. You have been assigned to configure a DMZ that uses multiple firewall components. Specifically, you must configure a router that will authoritatively monitor and, if necessary, block traffic. This device will be the last one that inspects traffic before it passes to the internal network.

Which term best describes this device?

30. Which of the following is a common problem with proxy servers?

31. Consider the following diagram:

Which type of attack is occurring?

32. Which of the following is most likely to address a problem with an operating system's ability to withstand an attack that attempts to exploit a buffer overflow?

33. Your organization has made a particularly unpopular policy decision. Your supervisor fears that a series of attacks may occur as a result. You have been assigned to increase automated auditing on a server.

When fulfilling this request, which of the following resources should you audit the most aggressively?

34. You purchased a network scanner six months ago. In spite of regularly conducting scans using this software, you have noticed that attackers have been able to compromise your servers over the last month.

Which of the following is the most likely explanation for this problem?

35. Considering physical security, which of the following should you look for when identifying a room that will act as a server room?

36. Which two protocols can be found at the transport layer of the TCP/IP stack?

37. You are creating an information security policy for your company.

Which of the following activities will help you focus on creating policies for the most important resources?

38. You have determined that the company Web server has several vulnerabilities, including a buffer overflow that has resulted in an attack. The Web server uses PHP and has direct connections to an Oracle database server. It also uses many CGI scripts.

Which of the following is the most effective way to respond to this attack?

39. Which of the following security services, as defined by the ISO 7498-2 Security Architecture document, protects against active threats by verifying or maintaining the consistency of information?

40. What is the primary strength of symmetric-key encryption?

41. Why can instant messaging (IM) and peer-to-peer (P2P) applications be considered a threat to network security?

42. You have discovered that the ls, su and ps commands no longer function as expected. They do not return information in a manner similar to any other Linux system. Also, the implementation of Tripwire you have installed on this server is returning new hash values.

Which of the following has most likely occurred?

43. At what layer of the OSI/RM does a packet filter operate?

44. What would be the result if you were the recipient of a SYN flood or malformed packet?

45. You want to create a quick solution that allows you to obtain real-time login information for the administrative account on an LDAP server that you feel may become a target.

Which of the following will accomplish this goal?

46. Which of the following details should be included in documentation of an attack?

47. What is the most common attack method against TCP?

48. What is the first tool needed to create a secure networking environment?

49. Jason is attempting to gain unauthorized access to a corporate server by running a program that enters passwords from a long list of possible passwords.

Which type of attack is this?

50. What distinguishes hash encryption from other forms of encryption?