CIW Web Security Associate Free Sample Questions

Defense in Depth is a strategy that employs a series of redundant protective measures in case a single security control fails. This option correctly lists multiple, distinct layers of security controls: network (VLANs), host (host-based firewalls), data (encryption), and application (RBAC). The failure of one layer (e.g., the perimeter firewall) would not immediately compromise the entire system because other layers are still in place.

A UDP port scan works by sending UDP packets to a range of ports on a target. If a port is open, there is typically no response. If a port is closed, the target system should respond with an ICMP 'Port Unreachable' message. The observed traffic pattern—many UDP packets to various ports—is a classic indicator of a UDP scan, which is a form of reconnaissance used by attackers to map out vulnerable services.

Symmetric encryption algorithms like AES are significantly faster and more computationally efficient than asymmetric algorithms like RSA, especially for large amounts of data. Given the 2GB file size and the performance requirement, AES is the ideal choice for encrypting the file content itself. The symmetric key used for AES would then typically be encrypted using an asymmetric algorithm (like RSA) for secure key exchange with the partner.

To allow inbound HTTPS traffic to the Web server, a rule must be created that specifies the conditions for allowed packets. The correct rule allows traffic from any source IP, destined for the specific IP of the Web server, using the TCP protocol on destination port 443. This is a specific 'allow' rule that overrides the general 'deny all' policy for this particular traffic type.

The primary mistake in pulling the power cable is the immediate loss of all volatile data stored in Random Access Memory (RAM). This data is critical for a forensic investigation as it contains information about currently running processes (which could be malware), active network connections (showing communication with an attacker), cached data, and potentially even decryption keys for encrypted volumes. The correct first step is to perform a live data acquisition to capture the contents of RAM before powering down the system.

Essential OS hardening practices aim to reduce the attack surface and enforce the principle of least privilege. Disabling unnecessary services removes potential vulnerabilities. Configuring a host-based firewall provides a critical layer of network defense directly on the server. Implementing mandatory access control (MAC) systems like SELinux provides fine-grained control over process permissions, significantly mitigating the impact of a potential compromise.

This statement is false. The private key and public key are generated as a pair, but it is computationally infeasible to derive the private key from the public key; this is the fundamental principle of asymmetric cryptography. Furthermore, the private key must be kept secret by the owner and should never be shared with or stored by the Certificate Authority. The CA's role is to vouch for the identity of the public key's owner, not to hold their private key.

Hashing algorithms like SHA-256 are designed to provide data integrity. The company can compute the hash of the original file and publish it. A customer can then download the file, compute the hash on their own machine, and compare it to the published value. If the hashes match, the customer can be confident the file is unaltered. Encryption provides confidentiality, not integrity, and asymmetric keys are for authentication and key exchange.

An Application-Level Gateway, also known as a proxy firewall, operates at the Application layer (Layer 7) of the OSI model. This allows it to understand application-specific protocols (like HTTP, FTP, or a proprietary EHR protocol). It can perform deep packet inspection to analyze the content of the traffic and make decisions based on specific commands or data, which is exactly what is required to block non-compliant EHR commands. Packet filters and circuit-level gateways operate at lower layers and lack this application awareness.

The -sS flag in nmap specifies a TCP SYN scan, often called a 'stealth scan' or 'half-open scan'. Instead of completing the full three-way handshake (SYN, SYN/ACK, ACK), it sends a SYN packet and waits for a SYN/ACK. If a SYN/ACK is received, the port is open, and nmap sends a RST (reset) packet to tear down the connection before it is fully established. This method is often less likely to be logged by older or simpler intrusion detection systems, hence the 'stealthy' characteristic.