SANS SEC530 DEFENSIBLE
SECURITY ARCHITECTURE AND
ENGINEERING EXAM
What is a host-based firewall available in the Linux environment?
A) Zeek
B) Snort
C) iptables
D) tcpdump - ANSWERS-C) iptables
Which of the following is one of the basic principles of perimeter
security?
A) Internal access is untrusted
B) External access is trusted
C) Internal access is trusted
D) VPN access is untrusted - ANSWERS-A) Internal access is
untrusted
Which systems can benefit from auditpol.exe's capability to apply a
standardized audit policy?
,A) Network devices
B) Non-Windows systems
C) Domain-joined systems
D) Non-domain-joined systems - ANSWERS-D) Non-domain-joined
systems
Which of the following is the default location for Linux/Unix logs?
A) /etc/log
B) /log
C) /var/log
D) /log/tmp - ANSWERS-C) /var/log
Detecting insider threat activity in a Windows environment can be
accomplished by monitoring audit logs for which type of activity?
A) Scanning in AV firewall logs
B) ICMP echo requests
C) Vulnerability scanning internally
D) Attempts to enumerate group membership - ANSWERS-D)
Attempts to enumerate group membership
Which of the following default settings on a host-based firewall
breaks the law of zero trust architecture?
,A) Outbound allow
B) Inbound allow
D) Inbound deny
C) Outbound deny - ANSWERS-A) Outbound allow
Which of the following is a mandate in zero trust?
A) Only sensitive data flows must be known and controlled.
B) Only critical assets must be scanned, hardened, and rotated.
C) All traffic must be secured.
D) Principle of least privilege must be enforced in critical systems. -
ANSWERS-C) All traffic must be secured.
Under which audit policy is the Audit File System located?
A) Account management
B) DS Access
C) Object access
D) Policy change - ANSWERS-???
Which of the following is the centralized control of zero trust?
A) Control plane
B) Data plane
, C) Device plane
D) Security plane - ANSWERS-A) Control plane
What is the built-in centralized log collection capability present in
Windows Vista/2008 and above called?
A) WMI Scripts
B) Windows Event Viewer
C) Windows Event Forwarding
D) Windows Remote Management - ANSWERS-C) Windows Event
Forwarding
Which of the following is a recommended USB keyboard mitigation
for sites requiring high security?
A) Disable USB ports in the system.
B) Restrict USB devices with approved PIDs and VIDs.
C) Block the USB devices physically.
D) Restrict USB devices with approved user accounts. - ANSWERS-
C) Block the USB devices physically.
Which of the following Cisco IOS commands is used to shut the port
down automatically when the maximum number of MAC addresses is
exceeded?
SECURITY ARCHITECTURE AND
ENGINEERING EXAM
What is a host-based firewall available in the Linux environment?
A) Zeek
B) Snort
C) iptables
D) tcpdump - ANSWERS-C) iptables
Which of the following is one of the basic principles of perimeter
security?
A) Internal access is untrusted
B) External access is trusted
C) Internal access is trusted
D) VPN access is untrusted - ANSWERS-A) Internal access is
untrusted
Which systems can benefit from auditpol.exe's capability to apply a
standardized audit policy?
,A) Network devices
B) Non-Windows systems
C) Domain-joined systems
D) Non-domain-joined systems - ANSWERS-D) Non-domain-joined
systems
Which of the following is the default location for Linux/Unix logs?
A) /etc/log
B) /log
C) /var/log
D) /log/tmp - ANSWERS-C) /var/log
Detecting insider threat activity in a Windows environment can be
accomplished by monitoring audit logs for which type of activity?
A) Scanning in AV firewall logs
B) ICMP echo requests
C) Vulnerability scanning internally
D) Attempts to enumerate group membership - ANSWERS-D)
Attempts to enumerate group membership
Which of the following default settings on a host-based firewall
breaks the law of zero trust architecture?
,A) Outbound allow
B) Inbound allow
D) Inbound deny
C) Outbound deny - ANSWERS-A) Outbound allow
Which of the following is a mandate in zero trust?
A) Only sensitive data flows must be known and controlled.
B) Only critical assets must be scanned, hardened, and rotated.
C) All traffic must be secured.
D) Principle of least privilege must be enforced in critical systems. -
ANSWERS-C) All traffic must be secured.
Under which audit policy is the Audit File System located?
A) Account management
B) DS Access
C) Object access
D) Policy change - ANSWERS-???
Which of the following is the centralized control of zero trust?
A) Control plane
B) Data plane
, C) Device plane
D) Security plane - ANSWERS-A) Control plane
What is the built-in centralized log collection capability present in
Windows Vista/2008 and above called?
A) WMI Scripts
B) Windows Event Viewer
C) Windows Event Forwarding
D) Windows Remote Management - ANSWERS-C) Windows Event
Forwarding
Which of the following is a recommended USB keyboard mitigation
for sites requiring high security?
A) Disable USB ports in the system.
B) Restrict USB devices with approved PIDs and VIDs.
C) Block the USB devices physically.
D) Restrict USB devices with approved user accounts. - ANSWERS-
C) Block the USB devices physically.
Which of the following Cisco IOS commands is used to shut the port
down automatically when the maximum number of MAC addresses is
exceeded?
