1D0-671 Sample Questions & Answers

Essential OS hardening practices aim to reduce the attack surface and enforce the principle of least privilege. Disabling unnecessary services removes potential vulnerabilities. Configuring a host-based firewall provides a critical layer of network defense directly on the server. Implementing mandatory access control (MAC) systems like SELinux provides fine-grained control over process permissions, significantly mitigating the impact of a potential compromise.

This statement is false. The private key and public key are generated as a pair, but it is computationally infeasible to derive the private key from the public key; this is the fundamental principle of asymmetric cryptography. Furthermore, the private key must be kept secret by the owner and should never be shared with or stored by the Certificate Authority. The CA's role is to vouch for the identity of the public key's owner, not to hold their private key.

Hashing algorithms like SHA-256 are designed to provide data integrity. The company can compute the hash of the original file and publish it. A customer can then download the file, compute the hash on their own machine, and compare it to the published value. If the hashes match, the customer can be confident the file is unaltered. Encryption provides confidentiality, not integrity, and asymmetric keys are for authentication and key exchange.

An Application-Level Gateway, also known as a proxy firewall, operates at the Application layer (Layer 7) of the OSI model. This allows it to understand application-specific protocols (like HTTP, FTP, or a proprietary EHR protocol). It can perform deep packet inspection to analyze the content of the traffic and make decisions based on specific commands or data, which is exactly what is required to block non-compliant EHR commands. Packet filters and circuit-level gateways operate at lower layers and lack this application awareness.

The -sS flag in nmap specifies a TCP SYN scan, often called a 'stealth scan' or 'half-open scan'. Instead of completing the full three-way handshake (SYN, SYN/ACK, ACK), it sends a SYN packet and waits for a SYN/ACK. If a SYN/ACK is received, the port is open, and nmap sends a RST (reset) packet to tear down the connection before it is fully established. This method is often less likely to be logged by older or simpler intrusion detection systems, hence the 'stealthy' characteristic.

A honeypot is a decoy computer system set up to attract and trap malicious users or malware. Its primary purpose is to act as a target, diverting attackers from legitimate production systems. By doing this, security teams can safely study the attackers' methods, tools, and intentions without risking actual company assets. Any traffic to the honeypot is inherently suspicious, making it an excellent tool for early threat detection.

This describes a classic Man-in-the-Middle (MitM) attack. The attacker positions themselves between two communicating parties, intercepts all messages, and can read, modify, or inject new messages into the conversation. The diagram clearly shows the attacker intercepting, decrypting, and re-encrypting messages between Alice and Bob, making it a perfect illustration of a MitM attack.

Key stretching algorithms (also known as key derivation functions) like PBKDF2 and bcrypt are designed to be deliberately slow. They repeatedly apply a cryptographic hash function thousands of times. This makes it computationally expensive and time-consuming for an attacker to perform brute-force or dictionary attacks against a stolen password hash database, even with specialized hardware like GPUs. A simple salted hash can be computed very quickly, making it more vulnerable to offline cracking.

A Trusted Platform Module (TPM) is a specialized hardware chip that provides secure, hardware-based cryptographic functions. One of its primary roles is to securely generate and store cryptographic keys used for full disk encryption (like with Microsoft BitLocker). It ensures that the encryption keys are protected and are only released when the system boots in a trusted state, providing a hardware root of trust that is more secure than storing keys in software.

An Acceptable Use Policy (AUP) defines the rules and constraints that users must agree to for access to a corporate network or the Internet. The most critical security-related clauses prohibit actions that introduce significant risk, such as installing unauthorized software (which could be malware) and sharing passwords (which undermines authentication and accountability). These rules directly address common vectors for security breaches originating from internal users.