Test Bank For Network Defense and Countermeasures Principles and Practices, 4th Edition by William E

Test Bank For Network Defense and Countermeasures Principles and Practices, 4th Edition by William Easttom 2024 Chapter 1-17 Chapter 1 Introduction to Network Security 1) Which of the following is the unique address of the network interface card (NIC)?

A) IP address B) NIC address C) MAC address D) URL address Answer: C 2) Which of the following commands can you use to find your computer‟s IP address and network information about your system?

A) Ipconfig B) Ping C) Tracert D) None of the above Answer: A 3) Which of the following commands can be used to determine if a system is reachable and how long a packet takes to reach that system?

A) Ipconfig B) Ping C) Tracert D) None of the above Answer: B 4) Which of the following protocols operates at the transport layer of the OSI model?

A) FTP B) TCP C) DNS D) IP Answer: B 5) Which of the following layers of the OSI model is responsible for routing the information in the network?

A) Transport layer B) Network layer C) Session layer D) Physical layer Answer: B 6) The OSI model is divided into how many layers?

1 Copyright © 2024 Pearson Education, Inc.

A) Four B) Five C) Six D) Seven Answer: D 7) Most attacks can be classified as one of three broad classes. Which of the following is not one of these classes?

A) Viruses B) Malware C) Blocking D) Intrusion Answer: A 8) Denial of service (DoS) attacks fall under which of the following categories of attacks?

A) Viruses B) Malware C) Blocking D) Intrusion Answer: C 9) Which of the following is a small text file that web pages can place on your computer to keep track of your browsing activity?

A) Spyware B) Cookie C) Key logger D) Trojan Answer: B 10) In which of the following attacks does a hacker use a computer to call phone numbers in sequence until another computer answers?

A) War-driving B) War-calling C) War-dialing D) War-flying Answer: C 11) Which of the following types of hackers will report a vulnerability when they find it?

A) White hat B) Gray hat C) Green hat D) Black hat Answer: A 12) Which of the following types of hackers hacks into systems to cause harm or steal data?

A) White hat B) Gray hat 2 Copyright © 2024 Pearson Education, Inc.

C) Green hat D) Black hat Answer: D 13) Which of the following is another term for a black hat hacker?

A) Cracker B) White hat C) Sneaker D) Creeker Answer: A 14) Which of the following is another term for ethical hacker?

A) Cracker B) Black hat C) Sneaker D) Creeker Answer: C 15) Which of the following can be used to protect the confidentiality of information?

A) Encryption B) Auditing C) Backups D) Network server redundancy Answer: A 16) Which of the following is used to ensure information integrity?

A) Auditing B) Digital signatures C) Backups D) Passwords Answer: B 17) Which of the following is not part of the CIA triangle?

A) Integrity B) Confidentiality C) Discretion D) Availability Answer: C 18) Which of the following statements about the layered security approach is true?

A) The perimeter is secured, but the systems within the perimeter are vulnerable.

B) The systems within the perimeter are secured, but the perimeter is vulnerable.

C) Both the perimeter and the individual systems within the perimeter are secured.

D) Both the perimeter and the individual systems within the perimeter are vulnerable.

Answer: C

3 Copyright © 2024 Pearson Education, Inc.

19) Which of the following requires government agencies to identify sensitive systems, conduct computer security training, and develop computer security plans?

A) Center for Information Technology B) Computer Crimes Act of Oklahoma C) Sarbanes-Oxley (SOX) D) Computer Security Act of 1987 Answer: D 20) Which of the following security resources offers a repository for detailed information on virus outbreaks?

A) SANS Institute B) F-Secure Corporation C) CERT D) Microsoft Security TechCenter Answer: B 21) The term/concept URL is: A) synonymous with URI B) synonymous with URN C) a scheme followed by authority, path, and possibly query and fragment D) a subset of URI Answer: D 22) Which statement about the IMAP protocol is true?

A) It is used for chat rooms.

B) It is a successor to POP3.

C) It is used by Microsoft Active Directory.

D) It is used to transfer files between computers.

Answer: B 23) Which of the following is NOT a TCP/IP model layer?

A) Application layer B) Transport layer C) Digital layer D) Data-link layer Answer: C 24) What is the name of the virus that caused 29% of malicious attacks on macOS devices in 2019?

A) Schlayer B) Slayer C) BadApple D) Malicious 2.0 Answer: A 4 Copyright © 2024 Pearson Education, Inc.

Network Defense and Countermeasures, 4e (Easttom) Chapter 2 Types of Attacks 1) Denial of service attacks target which of the following?

A) Availability B) Integrity C) Security D) Confidentiality Answer: A 2) Which of the following can be used to defend against SYN flood attacks?

A) Micro blocks B) SYN cookies C) Stateful packet inspection firewalls D) All of the above Answer: D 3) Which of the following is a type of DoS attack?

A) Smurf attack B) SYN flood attack C) UDP flood attack D) All of the above Answer: D 4) ICMP flood attacks and Ping of Death attacks are an example of which of the following?

A) Viruses B) DoS attacks C) IP spoofing attacks D) Trojans Answer: B 5) Which of the following DoS protection techniques alters the TCP stack on the server to decrease the connection timeout time?

A) Micro blocks B) Stack tweaking C) SYN cookies D) Stateful packet inspection firewalls Answer: B 6) Which of the following DoS attacks sends an ICMP packet with a modified return address to the broadcast network address?

A) SYN flood B) Ping of Death C) Smurf attack D) UDP flood Answer: C 5 Copyright © 2024 Pearson Education, Inc.

7) Which of the following DoS attacks sends a UDP packet to a random port on the victim‟s system?

A) SYN flood B) Ping of Death C) Smurf attack D) UDP flood Answer: D 8) Which of the following types of attacks tricks Internet routers into attacking a target?

A) Denial of service attack B) Distributed denial of service attack C) Distributed reflection denial of service attack D) Smurf attack Answer: C 9) Which of the following statements about Flame is true?

A) It is an antivirus software.

B) It is a malware that acts as an antivirus software.

C) It is a DoS tool.

D) It is a virus designed for espionage.

Answer: D 10) Which of the following malware can monitor network traffic and take a snapshot of the target system?

A) Flame B) Smurf C) Ping of Death D) MyDoom Answer: A 11) Which of the following statements about buffer overflow attacks is true?

A) Buffer overflow attacks are easy to execute.

B) Perfectly written programs are not susceptible to buffer overflow attacks.

C) Buffer overflow attacks target systems‟ availability.

D) Buffer overflow attacks target computer hardware.

Answer: B 12) Which of the following describes the best defense against buffer overflow attacks?

A) Stop all ICMP traffic.

B) Routinely patch and update software.

C) Block TCP packets at the router.

D) Use a robust firewall.

Answer: B

6 Copyright © 2024 Pearson Education, Inc.

13) Which of the following is an example of a session hacking attack?

A) Man-in-the-middle attack B) Smurf attack C) Ping of Death attack D) IP spoofing attack Answer: A 14) Which of the following is the only way to truly defend against session hacking?

A) Stateful packet inspection B) Encrypted transmissions C) IP spoofing D) Filtering routers Answer: B 15) Which of the following rules can drastically reduce the odds of a machine becoming infected with a virus?

A) If you are unsure about an attachment, do not open it.

B) Always use a virus scanner.

C) Don‟t believe “security alerts” that are sent to you.

D) All of the above Answer: D 16) Which of the following types of viruses target office documents such as files created in Microsoft Office?

A) Boot sector viruses B) Ransomware C) Macro viruses D) Stealth viruses Answer: C 17) Which of the following types of viruses operate outside of the operating system, making them harder to detect and remove?

A) Boot sector viruses B) Ransomware C) Macro viruses D) Stealth viruses Answer: A 18) Which of the following virus categories include any virus that uses one or more techniques to hide itself?

A) Boot sector viruses B) Ransomware C) Macro viruses D) Stealth viruses Answer: D

7 Copyright © 2024 Pearson Education, Inc.

19) Which of the following virus types works as a worm, then either disables system services or encrypts user files and demands a monetary payment to release those files or services?

A) Boot sector viruses B) Ransomware C) Macro viruses D) Stealth viruses Answer: B 20) A Trojan can do which of the following?

A) Delete files B) Open a backdoor on the infected system C) Install a key logger or other spyware on the infected system D) All of the above Answer: D 21) What type of attack attacks XML document parsers, often using the string „lol‟?

A) Million Laughs attack B) Hilarious attack C) Billion Laughs attack D) Giggles attack Answer: C 22) APDoS attacks are usually characterized by all EXCEPT: A) reconnaissance in advance of the attack B) tactical execution (attacking primary and secondary targets) C) asynchronous multi-threaded OSI attacks D) large computing capacity Answer: C Network Defense and Countermeasures, 4e (Easttom) Chapter 3 Fundamentals of Firewalls 1) Which of the following is used to filter incoming and outgoing traffic?

A) IDS B) IPS C) Firewall D) DMZ Answer: C 2) Which of the following is the simplest type of a firewall?

A) Packet filtering B) Application level gateway C) Circuit level gateway D) Stateful packet inspection Answer: A 3) Which of the following statements best describes a packet filtering firewall?

8 Copyright © 2024 Pearson Education, Inc.

A) It examines each packet against a set of criteria.

B) It can keep track of the status of the connection.

C) It works by examining the client application to determine if traffic is permitted.

D) It authenticates the client before examining the application.

Answer: A 4) Packet filtering firewalls can examine which of the following?

A) Protocol type B) Source address C) Destination address D) All of the above Answer: D 5) Which of the following statements best describes a stateful packet inspection firewall?

A) It examines each packet against a set of criteria.

B) It examines each packet, denying or permitting access based not only on the examination of the current packet, but also on data derived from previous packets in the conversation.

C) It works by examining the client application to determine if traffic is permitted.

D) It authenticates the client before examining the application.

Answer: B 6) Which of the following allows an administrator to specify what applications are allowed access?

A) Packet filtering B) Router C) Stateful inspection D) Application gateway Answer: D

9 Copyright © 2024 Pearson Education, Inc.

7) Which of the following is a disadvantage of an application gateway?

A) It can filter only based on an IP address.

B) It cannot perform individual user authentication.

C) It consumes a lot of system resources.

D) It does not know what application sent the packets.

Answer: C 8) Which of the following firewalls is similar to application gateways, but is more secure and often implemented on high-end equipment?

A) Circuit level gateway firewalls B) Stateful inspection firewalls C) Packet filtering firewalls D) Router firewalls Answer: A 9) Which of the following is a security approach that blocks users from visiting any website or Internet resource except those on an approved list?

A) Blacklisting B) Whitelisting C) Graylisting D) None of the above Answer: B 10) Which of the following can be done to harden an operating system?

A) Uninstall unneeded applications or utilities B) Close unused ports C) Apply the latest security patches and fixes D) All of the above Answer: D 11) Which of the following are typically found within the DMZ? A) FTP servers B) Email servers C) Web servers D) All of the above Answer: D 12) Which of the following statements about a dual-homed host firewall is true?

A) The automatic routing function has to be enabled so that the firewall can work.

B) Systems inside and outside the firewall cannot communicate with each other directly.

C) A dual-homed firewall runs on a server with one network interface.

D) IP packets from the Internet are routed directly to the internal network.

Answer: B

10 Copyright © 2024 Pearson Education, Inc.

13) Which of the following companies offer home-based routers with built-in firewalls?

A) Netgear B) Belkin C) Linksys D) All of the above Answer: D 14) Which of the following firewall setups is a combination of a bastion host and a screening router?

A) Network host-based B) Dual-homed host C) Screened host D) Router-based Answer: C 15) A bastion host is a single point of contact between the Internet and which of the following?

A) A public network B) A proxy server C) A private network D) A packet filter Answer: C 16) Packet filters work at which of the following layers of the OSI model?

A) Application B) Network C) Session D) Transport Answer: B 17) Which of the following is used to help define a baseline for normal activity on a firewall so that administrators will more likely notice any abnormal activity?

A) Firewall logs B) Proxy servers C) Bastion hosts D) Screened hosts Answer: A 18) Which of the following can be used to hide a company‟s internal IP address?

A) Packet filter B) Firewall C) Proxy server D) Bastion host Answer: C

11 Copyright © 2024 Pearson Education, Inc.

19) Which of the following is an advantage of using the WinGate proxy server?

A) Inexpensive B) Available as a free download C) Easy to use D) All of the above Answer: D 20) For many organizations, proxy servers have been superseded by a newer technology known as which of the following?

A) TCP B) NAT C) FTP D) DMZ Answer: B 21) A firewall example that consists of a design using both a circuit level gateway and stateful packet filtering is known as a(n): A) router-based firefall B) cloud-native firewall C) hybrid firewall D) stateful firewall Answer: C 22) In the context of firewall deployment, where would it be most appropriate to consider using circuit level gateways?

A) On individual computers/servers B) On a specific-function server, like a web server or a database server C) Between the DMZ and routers D) On the firewall included with most modern operating systems Answer: C Network Defense and Countermeasures, 4e (Easttom) Chapter 4 Firewall Practical Applications 1) Which of the following is a characteristic of a single machine firewall?

A) It is software-based.

B) It is usually difficult to set up and configure.

C) It is always a packet filtering firewall.

D) All of the above Answer: A 2) The Windows 10 Firewall is which of the following types?

A) Packet filtering firewall B) Application gateway firewall C) Stateful packet inspection firewall D) Circuit gateway firewall Answer: C 12 Copyright © 2024 Pearson Education, Inc.

3) The Windows 10 Firewall allows you to set rules for which of the following areas?

A) Domain B) Public C) Private D) All of the above Answer: D 4) With a Windows 10 Firewall, in which of the following areas should you configure rules for computers from outside your network?

A) Domain B) Public C) Private D) None of the above Answer: B 5) By default, the logging feature in Windows 10 Firewall is __________.

A) enabled B) disabled C) available for purchase D) None of the above Answer: B 6) Which of the following Windows versions introduced User Account Control (UAC), a security feature that prompts the user for administrative credentials for certain tasks?

A) Windows Vista B) Windows 7 C) Windows 8/8.1 D) Windows 10 Answer: A 7) Which of the following is currently the primary firewall for Linux?

A) Ipchains B) Ipfwadm C) Iptables D) Ipfirewall Answer: C 8) Which of the following is an advantage of the Norton Firewall?

A) It is easy to set up and use.

B) It can block outgoing traffic.

C) It allows you to scan your system for vulnerabilities.

D) All of the above Answer: D 9) Which of the following is true when comparing Norton Firewall with McAfee Personal Firewall?

A) Norton Firewall is easy to use whereas McAfee Personal Firewall is not easy to use.

13 Copyright © 2024 Pearson Education, Inc.

B) Norton Firewall can block outbound traffic whereas McAfee Personal Firewall cannot block outbound traffic.

C) Norton Firewall allows you to scan your system for vulnerabilities whereas McAfee Personal Firewall does not have this option.

D) Norton Firewall is free whereas McAfee Personal Firewall is a commercial product.

Answer: C 10) Which of the following firewalls allows you to see a map of where an attack is coming from?

A) Windows 10 Firewall B) Norton Firewall C) McAfee Personal Firewall D) Iptables firewall Answer: C 11) Which of the following is an advantage of a SonicWALL firewall?

A) It is free.

B) It is software-based.

C) It is easy to configure.

D) It provides stateful packet inspection.

Answer: D 12) Which of the following is a disadvantage of a SonicWALL firewall?

A) It does not provide built-in NAT. B) It may be cost prohibitive for small offices on a tight budget.

C) It does not provide built-in encryption.

D) It is difficult for Windows administrators to manage and configure.

Answer: B

14 Copyright © 2024 Pearson Education, Inc.

13) Which of the following is an advantage of the D-Link DFL-2560 Office Firewall?

A) It supports whitelisting and blacklisting.

B) It has built-in intrusion detection systems.

C) It combines multiple firewall types.

D) All of the above Answer: D 14) Which of the following firewalls would you select if you have a small to midsized company and want intrusion prevention systems, protection against zero-day threats, and VPN connections?

A) SonicWALL B) Norton Firewall C) Check Point 5000 Firewall D) Windows 10 Firewall Answer: C 15) Which of the following firewalls would you select if you have a medium-sized company and want to install a firewall that includes VPNs, intrusion prevention systems, and content filtering?

A) Cisco ASA 5500 series B) D-Link DFL-2560 C) SonicWALL D) Norton Firewall Answer: A 16) Which of the following is an example of an enterprise level firewall?

A) SonicWALL B) Check Point 15000 series C) D-Link DFL-2560 D) Norton Firewall Answer: B 17) Which of the following is a disadvantage of the Cisco ASA 5500 series firewall?

A) It does not include an advanced firewall.

B) It does not include IDS/IPS. C) It does not include unified communications security.

D) It requires at least moderate skill to configure and administer.

Answer: D 18) An enterprise network is often made up of several local networks connected over which of the following?

A) LAN B) WAN C) MAN D) PAN Answer: B

15 Copyright © 2024 Pearson Education, Inc.

19) Which of the following network types provides the greatest security challenge, due to the diversity of end users, applications, and operating systems?

A) Medium-sized network B) SOHO network C) Enterprise network D) Linux network Answer: C 20) Enterprise network solutions typically offer which of the following in comparison with smaller network solutions?

A) More features B) Additional throughput C) Advanced capabilities D) All of the above Answer: D 21) What is one important function of a database firewall (DBF) in terms of compliance?

A) To monitor for compliance with specific standards, such as Payment Card Industry Data Security Standards (PCI-DSS) B) To support Web Application Firewalls via cloud services for web apps hosted in Azure C) To provide a rule configuration language known as SecRuls for HTTP communication D) To mitigate or prevent specific web attacks like SQL Injection Answer: A 22) What is a key feature of SonicWALL firewalls that contributes to network security, particularly against data theft?

A) Built-in antivirus B) Built-in encryption for all transmissions C) The ability to change the password frequently D) Support for whitelisting and blacklisting Answer: B Network Defense and Countermeasures, 4e (Easttom) Chapter 5 Intrusion-Detection Systems 1) Which of the following can be used to detect system breaches and alert a system administrator?

A) IDS B) Firewall C) NAT D) Proxy Answer: A 2) Which of the following is an IDS technique that seeks to prevent intrusions before they occur?

A) Infiltration B) Preemptive blocking C) Resource profiling D) Threshold monitoring 16 Copyright © 2024 Pearson Education, Inc.

Answer: B 3) Which of the following is an example of threshold monitoring?

A) Detecting a threat and blocking the IP address of the intruder B) Infiltrating hacker online groups C) Monitoring failed login attempts D) Monitoring how programs use system resources Answer: C 4) Executable profiling and threshold monitoring are examples of which of the following?

A) Preemptive blocking B) Infiltration C) Anomaly detection D) Sniffing Answer: C 5) Snort works in one of three modes. Which of the following is not one of these modes?

A) Sniffer B) Analyzer C) Packet logger D) Network intrusion-detection Answer: B 6) Which of the following Snort modes displays packet information to the console?

A) Sniffer B) Analyzer C) Packet logger D) Network intrusion-detection Answer: A

17 Copyright © 2024 Pearson Education, Inc.

7) Which of the following Snort modes writes the packet contents to a text file log?

A) Sniffer B) Analyzer C) Packet logger D) Network intrusion-detection Answer: C 8) Which of the following is a software honeypot solution?

A) Snort B) Specter C) Cisco Firepower 4100 series D) Cisco Firepower 9000 series Answer: B 9) Specter is which of the following?

A) IDS B) Firewall C) Honeypot D) Router Answer: C 10) Which of the following is a type of anomaly detection that measures the system-wide use of resources to develop a profile of that usage?

A) Infiltration B) Preemptive blocking C) Resource profiling D) Threshold monitoring Answer: C 11) Which of the following is a method of anomaly detection used by IDS? A) User/group work profiling B) Resource profiling C) Threshold monitoring D) All of the above Answer: D 12) Which of the following is a combination of IDS and a honeypot?

A) Snort B) Specter C) Cisco IDS 4200 Series D) Decoy Server Answer: D

18 Copyright © 2024 Pearson Education, Inc.

13) Which of the following are the five modes available for users to set up in Specter?

A) Open, secure, insecure, failing, aggressive B) Open, secure, failing, strange, aggressive C) Open, secure, insecure, half secure, aggressive D) Secure, insecure, failing, aggressive, progressive Answer: B 14) Specter can be used to emulate which of the following services?

A) POP3 B) FTP C) HTTP D) All of the above Answer: D 15) Which of the following refers to the process of attempting to attract intruders to a subsystem that is set up to monitor them?

A) Threshold monitoring B) Intrusion deterrence C) Resource profiling D) Intrusion deflection Answer: D 16) Banishment vigilance is also known as which of the following?

A) Threshold monitoring B) Preemptive blocking C) Resource profiling D) Executable profiling Answer: B 17) Which of the following IDS terms refers to an occurrence that indicates a suspicious activity may have taken place?

A) Sensor B) Activity C) Event D) Alert Answer: C 18) Which of the following terms refers to the raw information that an IDS uses to detect suspicious activity?

A) Notification B) Data source C) Sensor D) Activity Answer: B

19 Copyright © 2024 Pearson Education, Inc.

19) Which of the following refers to a single machine set up to simulate a valuable server or even an entire subnetwork?

A) Honeypot B) Analyzer C) Sensor D) None of the above Answer: A 20) Which of the following involves trying to make a network system seem like a less appealing target?

A) Executable profiling B) Intrusion deflection C) Intrusion deterrence D) Preemptive blocking Answer: C 21) Which of the following benefits does a System Information and Event Monitoring Management (SIEM) system provide?

A) It enables the management of firewalls.

B) It facilitates digital forensics by aggregating and analyzing logs from various systems.

C) It serves as a replacement for intrusion detection systems.

D) It increases the mean time to detect (MTTD) and mean time to respond (MTTR) to cyber threats.

Answer: B 22) Which of the following is NOT a commonly used technique to evade IDS/IPS systems?

A) Address Spoofing B) Obfuscation C) Session Splicing D) Decryption Answer: D Network Defense and Countermeasures, 4e (Easttom) Chapter 6 Encryption Fundamentals 1) Which of the following ciphers substitutes the first letter of the alphabet with the last letter of the alphabet?

A) Caesar cipher B) ROT 13 C) Atbash cipher D) Vigenère Answer: C 2) Which of the following is a multi-alphabet cipher?

A) Caesar cipher B) ROT 13 C) Atbash cipher D) Vigenère 20 Copyright © 2024 Pearson Education, Inc.

Answer: D 3) Which of the following is not a symmetric encryption algorithm?

A) DES B) RSA C) Blowfish D) AES Answer: B 4) Which of the following is a public key encryption algorithm?

A) IDEA B) DES C) Diffie-Hellman D) AES Answer: C 5) Modern ciphers use binary operations. Which of the following is an example of a binary operator?

A) Caesar cipher B) AND C) ROT 13 D) Atbash cipher Answer: B 6) Which binary operator returns 0 if both numbers it compares are the same and returns 1 if the numbers it compares are different?

A) XOR B) OR C) AND D) ROT 13 Answer: A 7) Which of the following uses the same key to encrypt and decrypt the message?

A) Public key encryption B) Asymmetric encryption C) Symmetric encryption D) RSA encryption Answer: C 8) DES uses which of the following encryption key lengths?

A) 56 bit B) 128 bit C) 192 bit D) 256 bit Answer: A 9) What is the size of AES encryption key?

21 Copyright © 2024 Pearson Education, Inc.

A) 128 bits B) 192 bits C) 256 bits D) All of the above Answer: D 10) Which of the following is a block cipher?

A) Blowfish B) AES C) IDEA D) All of the above Answer: D 11) Which of the following is an example of a hash algorithm?

A) SHA B) AES C) RSA D) DES Answer: A 12) Digital signatures are used for which of the following?

A) To encrypt a message B) To ensure message confidentiality C) To prove the identity of the sender of the message D) To ensure the message cannot be opened by anyone but the sender Answer: C

22 Copyright © 2024 Pearson Education, Inc.

13) Which of the following is used to issue digital certificates?

A) Certificate authority B) Registration authority C) PKI D) Certificate revocation list Answer: A 14) Which of the following is the art and science of hiding a message inside a file?

A) Encryption B) Steganography C) Digital signatures D) Digital certificates Answer: B 15) Which of the following is a steganography tool?

A) John the Ripper B) Invisible Secrets C) Diffie-Hellman D) Ophcrack Answer: B 16) Which of the following is used for steganalysis, to detect the use of steganography?

A) Chi-square analysis B) RQP method C) Noise distortion D) All of the above Answer: D 17) Which of the following promises to increase computing power but also present a challenge for cryptography?

A) Public key encryption B) Key stretching C) Quantum computing D) DES encryption Answer: C 18) Which of the following is a password cracker that is particularly useful when trying to crack hashes?

A) Rainbow tables B) Ophcrack C) John the Ripper D) Brute force Answer: A

23 Copyright © 2024 Pearson Education, Inc.

19) Which of the following cryptanalysis methods involves looking at blocks of an encrypted message to determine if any common patterns exist?

A) Birthday attack B) Frequency analysis C) Brute force D) Differential cryptanalysis Answer: B 20) Which type of X.509 digital certificate is the most common and is used to secure communication with a specific domain?

A) Wildcard certificates B) Code-signing certificates C) Domain validation certificates D) User certificates Answer: C 21) Which of the following statements about the Twofish cipher is NOT true?

A) Twofish is a symmetric cipher that was one of the five finalists of the AES contest.

B) Twofish uses a 128-bit block size and key sizes of 128, 192, and 256 bits.

C) Twofish uses key-dependent S-boxes and has a very simple key schedule.

D) Twofish uses a process called whitening both before and after the application of the algorithm.

Answer: C 22) Which of the following statements regarding the modes of symmetric encryption is incorrect?

A) In Electronic Codebook (ECB) mode, the message is divided into blocks, and each block is encrypted separately.

B) Cipher-block chaining (CBC) mode adds significantly more randomness to the final ciphertext, making it more secure than ECB mode.

C) The Propagating Cipher-block chaining (PCBC) mode is a variation on the CBC mode of operation and has been formally published as a federal standard.

D) The Galois Counter Mode (GCM) uses counter mode with Galois authentication, turning a block cipher into a stream cipher.

Answer: C Network Defense and Countermeasures, 4e (Easttom) Chapter 7 Virtual Private Networks 1) Virtual private networks (VPNs) establish a secure private connection over which of the following communication mediums?

A) Intranet B) Internet C) Secure network D) Internal network Answer: B 24 Copyright © 2024 Pearson Education, Inc.

2) Which of the following is an older VPN protocol based on Point-to-Point Protocol?

A) PPTP B) SSL C) L2TP D) IPSec Answer: A 3) PPTP operates at which of the following layers of the OSI model?

A) Physical B) Data link C) Network D) Session Answer: B 4) PPTP supports which of the following two generic types of tunneling?

A) Standard and remote access B) Voluntary and restricted C) Voluntary and compulsory D) Standard and restricted Answer: C 5) Which of the following protocols does PPTP use for authentication?

A) EAP and L2TP B) EAP and PPP C) EAP and IPSec D) EAP and CHAP Answer: D 6) Which of the following authentication protocols always encrypts both the username and password when they are sent?

A) PAP B) CHAP C) SPAP D) MS-CHAP Answer: C

25 Copyright © 2024 Pearson Education, Inc.

7) Which of the following is a difference between PPTP and L2TP? A) LT2P supports encryption whereas PPTP does not.

B) PPTP supports encryption whereas L2TP does not.

C) L2TP can work over X.25 and ATM networks whereas PPTP can work only over IP networks.

D) PPTP can work over X.25 and ATM networks whereas L2TP can work only over IP networks.

Answer: C 8) Which of the following statements about L2TP is true?

A) L2TP uses IPSec for encryption.

B) L2TP supports multiple protocols.

C) L2TP supports privately administered IP addresses.

D) All of the above Answer: D 9) Which of the following are the two encryption modes used by IPSec? A) Transport and tunnel B) Network and tunnel C) Internet and tunnel D) Private and tunnel Answer: A 10) Which of the following is an advantage of Cisco VPNs? A) It uses 3DES. B) It can handle packets larger than 500 bytes.

C) It can create up to 60 virtual tunnels per second.

D) All of the above Answer: D 11) Which of the following authentication protocols sends the password in clear text?

A) PAP B) SPAP C) CHAP D) EAP Answer: A 12) Which of the following IPSec modes encrypts the data in each packet but leaves the header unencrypted?

A) Transport B) Tunnel C) Network D) All of the above Answer: A

26 Copyright © 2024 Pearson Education, Inc.

13) Which of the following IPSec modes encrypts both the header and the data in each packet?

A) Transport B) Tunnel C) Network D) All of the above Answer: B 14) Which of the following IPSec protocols manages the exchange of encryption keys?

A) AH B) ESP C) IKE D) None of the above Answer: C 15) What does SSL stand for?

A) Sockets Secure Layer B) Session Sockets Layer C) Secure Sockets Layer D) Sockets Session Layer Answer: C 16) TLS is an acronym for which of the following?

A) Transport Layer Security B) Tunnel Layer Solution C) Tunnel Layer Security D) Transport Layer Solution Answer: A 17) Which of the following is an open source VPN solution available for Linux operating systems?

A) Cisco solutions B) Openswan C) Service solutions D) None of the above Answer: B 18) The OSI model is divided into how many layers?

A) 5 B) 6 C) 7 D) 8 Answer: C

27 Copyright © 2024 Pearson Education, Inc.

19) Which layer of the OSI model provides end-to-end communication control?

A) Session B) Network C) Application D) Transport Answer: D 20) Which of the following refers to a server or client that Kerberos can assign tickets to?

A) Realm B) Principal C) Authenticator D) Session key Answer: B 21) Which one of the following is NOT a VPN category?

A) Remote Access B) Site-to-Site C) Internet based D) Internal Answer: C

Network Defense and Countermeasures, 4e (Easttom) Chapter 8 Operating System Hardening 1) Which of the following should you do to ensure hackers can‟t easily compromise the default administrator account?

A) Delete the account.

B) Rename the account.

C) Disable the account and create a new account with administrative privileges.

D) Do nothing; the administrator account is secure and cannot be compromised.

Answer: C 2) Which of the following is the best practice to follow when creating new user accounts?

A) Give users the maximum amount of privileges and permissions so they can do their job.

B) Give users the least amount of permissions and privileges they need to do their job.

C) Make users members of the administrator group so that they can do their job.

D) Give users the default permissions and privileges.

Answer: B 3) Which of the following password policy settings forces users to use a combination of numbers, letters, and other characters in their passwords?

A) Enforce password history B) Password complexity requirements C) Minimum password age D) Maximum password age Answer: B 28 Copyright © 2024 Pearson Education, Inc.

4) Which of the following password policy settings can be used to prevent users from changing their password before a predefined period of time has passed?

A) Enforce password history B) Password complexity requirements C) Minimum password age D) Maximum password age Answer: C 5) Which of the following password policy settings can be used to force users to change their password after a predefined period of time has passed?

A) Enforce password history B) Password complexity requirements C) Minimum password age D) Maximum password age Answer: D

29 Copyright © 2024 Pearson Education, Inc.

6) Which of the following password policy settings can be used to prevent users from reusing their old passwords?

A) Enforce password history B) Password complexity requirements C) Minimum password age D) Maximum password age Answer: A 7) What is the minimum recommended password length by Microsoft?

A) 5 characters B) 8 characters C) 9 characters D) 12 characters Answer: B 8) What is the default minimum password length in Windows password policy?

A) 0 characters B) 5 characters C) 8 characters D) 12 characters Answer: A 9) Which of the following Account lockout policy setting specifies how many times a user can type in a password incorrectly before being locked out?

A) Account lockout duration B) Account lockout threshold C) Account lockout attempts D) Account lockout counter Answer: B 10) The Windows Registry stores which of the following?

A) Hardware settings B) Information about user accounts C) Information about installed software D) All of the above Answer: D 11) Which of the following Registry folders contains file association types, OLE information, and shortcut data?

A) HKEY_LOCAL_MACHINE B) HKEY_CLASSES_ROOT C) HKEY_USERS D) HKEY_CURRENT_CONFIG Answer: B

30 Copyright © 2024 Pearson Education, Inc.

12) Which of the following Registry folders links to the section of HKEY_LOCAL_ MACHINE appropriate for the current hardware configuration?

A) HKEY_LOCAL_MACHINE B) HKEY_CLASSES_ROOT C) HKEY_USERS D) HKEY_CURRENT_CONFIG Answer: D 13) Which of the following should be done to harden a system?

A) Turn off unused services.

B) Turn on the Windows port filters.

C) Apply the latest security patches and fixes.

D) All of the above Answer: D 14) What are the recommended privacy settings regarding cookies?

A) Block third-party cookies.

B) Prompt for first-party cookies.

C) Always allow session cookies.

D) All of the above Answer: D 15) Which of the following security templates is used to reapply default security settings if a system is misconfigured?

A) Hisecws.inf B) Securedc.inf C) Setup security.inf D) Securews.inf Answer: C 16) Where can you locate user accounts in Windows 10?

A) Start, Settings, Accounts B) Start, Accounts, Settings C) Start, Settings, System D) Start, Accounts, Personalization Answer: A 17) Which of the following refers to Windows‟ way of designating anonymous connections?

A) Stack tweaking B) Null session C) Default shares D) Remote access Answer: B

31 Copyright © 2024 Pearson Education, Inc.

18) Which of the following is an area of the Windows Registry that should be made more secure?

A) SynAttackProtect B) NTLMv2 Security C) KeepAlive D) All of the above Answer: D 19) Which of the following security templates is designed to increase the security and communications with domain controllers?

A) Hisecdc.inf B) Hisecws.inf C) Setup security.inf D) Securews.inf Answer: A 20) When should you apply patches to the operating system?

A) Only when recommended by the software vendor B) Any time a critical patch is released C) On a yearly basis D) Every day Answer: B Network Defense and Countermeasures, 3e (Easttom) Chapter 9 Defending Against Virus Attacks 1) Which of the following statements best describes the difference between a virus and a worm?

A) A virus requires human interaction to spread, whereas a worm can spread without human interaction.

B) A worm requires human interaction to spread, whereas a virus can spread without human interaction.

C) Both viruses and worms require human interaction to spread, but worms spread faster.

D) Both viruses and worms require human interaction to spread, but viruses spread faster.

Answer: A 2) Which of the following methods can viruses use to spread themselves?

A) By e-mailing itself to every e-mail address in the victim‟s address book B) By scanning the victim‟s machine for network connections and copying itself to other machines the victim‟s machine has access to C) By using its own internal e-mail engine to spread itself D) All of the above Answer: D 3) Which of the following viruses was designed to target computers running Windows in the energy sector?

A) Titanium B) Shamoon 32 Copyright © 2024 Pearson Education, Inc.

C) Mirai D) Gameover ZeuS Answer: B 4) Which of the following viruses creates a peer-to-peer botnet?

A) Zafi.d B) Shamoon C) Black Basta D) Gameover ZeuS Answer: D 5) Which of the following is a virus hoax?

A) Kedi RAT B) Rombertik C) Jdbgmgr D) Linux.Encoder.1 Answer: C

33 Copyright © 2024 Pearson Education, Inc.

6) What did the Jdbgmgr hoax ask users to do?

A) Install the jdbgmgr file on their systems.

B) Delete the jdbgmgr file from their systems.

C) Warned users not to send their taxes online because it wasn‟t safe.

D) Warned users that the virus will damage their hardware.

Answer: B 7) Which virus hoax claimed that a new virus could damage people‟s hardware?

A) W32.Torch B) Tax Return C) Jdbgmgr D) None of the above Answer: A 8) Which of the following techniques do virus scanners use to find viruses?

A) Monitors if any program is trying to modify system files B) Monitors the system for certain type of behaviors typical for viruses C) Compares the files on the system against a database of known virus files D) All of the above Answer: D 9) Which of the following virus scanners runs in the background constantly checking the computer for any sign of a virus?

A) On-demand virus scanner B) Ongoing virus scanner C) Constant virus scanner D) None of the above Answer: B 10) Which of the following virus scanners runs only when the user launches it?

A) On-demand virus scanner B) Ongoing virus scanner C) Constant virus scanner D) None of the above Answer: A 11) Which virus scanning technique uses rules to determine if a file or program is behaving like a virus?

A) Heuristic scanning B) Active code scanning C) Instant messaging scanning D) Email and attachment scanning Answer: A

34 Copyright © 2024 Pearson Education, Inc.

12) Which of the following is a side effect of heuristic scanning?

A) It identifies false negatives.

B) It identifies false positives.

C) It identifies true negatives.

D) It identifies true positives.

Answer: B 13) Which of the following should you consider when purchasing antivirus software?

A) Price B) The skills required to configure and run the scanner C) The scanning methods the virus scanner supports D) All of the above Answer: D 14) Which of the following is an advantage of using McAfee‟s antivirus software?

A) It‟s affordable.

B) It‟s easy to use and configure.

C) It offers different versions for different types of vulnerabilities.

D) All of the above Answer: D 15) Norton AntiVirus can perform which of the following scans?

A) Instant messages B) E-mail attachments C) Anti-spyware D) All of the above Answer: D 16) Which of the following antivirus software vendors offers a free antivirus product?

A) Norton B) Avast C) McAfee D) Kaspersky Answer: B 17) Which of the following is an appropriate antivirus policy?

A) E-mail attachments are always safe to open.

B) It is safe to download files from the Internet.

C) Always use a virus scanner.

D) Believe all “security alerts” that you receive.

Answer: C

35 Copyright © 2024 Pearson Education, Inc.

18) What should you do if your system is infected by a virus?

A) Remove the virus.

B) Find out how the infection started.

C) Stop the spread of the virus.

D) All of the above Answer: D 19) Which of the following is a method you can use to stop the spread of a virus?

A) If there are backup devices connected to the infected machine, disconnect them.

B) If the infection is on a subnetwork, immediately disconnect that subnetwork.

C) If there are servers with sensitive data that are connected to the infected machine, disconnect those servers.

D) All of the above Answer: D 20) Which virus scanning technique checks files on your system to see whether they match any known virus?

A) File scanning B) Active code scanning C) Instant messaging scanning D) E-mail and attachment scanning Answer: A 21) Which malware was written in C and could be compiled to a range of architectures and operating systems?

A) Mirai B) BASHLITE C) WannaCry D) LockBit Answer: B 22) Which of the following techniques targets an existing process, as opposed to creating a new one, to deliver malware?

A) Process hollowing B) Thread execution hijacking C) Process doppelgänging D) DLL injection Answer: B Network Defense and Countermeasures, 4e (Easttom) Chapter 10 Defending Against Trojan Horses and Phishing 1) Which of the following is an application that appears to be benign but actually performs a malicious activity?

A) Virus B) Spyware C) Trojan horse D) Worm 36 Copyright © 2024 Pearson Education, Inc.

Answer: C 2) A Trojan horse can perform which of the following actions?

A) Erase files on a computer.

B) Launch a DDoS attack.

C) Install a back door on a computer.

D) All of the above Answer: D 3) Which of the following Trojan horse actions would allow an attacker to gain access to the victim‟s system?

A) Erase files on a computer.

B) Launch a DDoS attack.

C) Spread other malware.

D) Install a back door on a computer.

Answer: D 4) Which of the following is a remote administration system that allows a user to control a computer across a TCP/IP connection using a simple console or GUI application?

A) Back Orifice B) FlashBack C) SheDun D) FinFisher Answer: A 5) Which of the following is the best way to remove Back Orifice from an infected machine?

A) Finding the Back Orifice file and deleting it.

B) Removing it from the Registry.

C) Removing it from the Startup folder.

D) You cannot manually remove Back Orifice from a system.

Answer: B 6) Which of the following is true about Back Orifice?

A) It can be attached to any executable file.

B) It does not show up in the task list.

C) It is small and self-installing.

D) All of the above Answer: D 7) Which of the following is a Trojan horse that pretends to be an anti-spyware program?

A) FlashBack B) Anti-Spyware 2011 C) Brain Test D) NetBus Answer: B 8) NetBus and FlashBack are examples of which of the following?

37 Copyright © 2024 Pearson Education, Inc.

A) Anti-spyware programs B) Trojan horses C) Viruses D) Antivirus programs Answer: B 9) Which of the following is a remote administration Trojan horse?

A) NetBus B) Portal of Doom C) Back Orifice D) All of the above Answer: D 10) Which of the following is a symptom that your system might be infected by a Trojan horse?

A) Home page for your browser changing B) Any change to passwords, usernames, or accounts C) Any device (such as a CD door) seeming to work on its own D) All of the above Answer: D 11) What should you do to protect a system against Trojan horses?

A) Block all unused ports.

B) Keep antivirus software updated and properly configured.

C) Prevent active code running in the browser.

D) All of the above Answer: D

38 Copyright © 2024 Pearson Education, Inc.

12) Which of the following is a type of malware that targets Android systems by including adware with popular applications?

A) FinFisher B) NetBus C) GameOver Zeus D) Shedun Answer: D 13) Which of the following is true about defending against phishing and Trojan horse attacks?

A) Different defense methods are required for phishing attacks and Trojan horses.

B) Phishing attacks cannot be used to launch other types of attacks.

C) The same defense methods used for virus attacks can also be helpful in combating Trojan horses.

D) Defense against malware requires entirely different approaches based on the type of malware.

Answer: C 14) Which of the following best describes the function of different types of Trojan horses?

A) A Backdoor Trojan provides remote access to the target device.

B) A Banking Trojan specifically seeks to compromise online banking.

C) A Proxy Trojan turns the infected machine into a proxy, aiding a hacker to hide and perform activities from the victim's computer.

D) All of the above.

Answer: D 15) Which of the following best describes the type of Trojan horse based on their functionality?

A) Backdoor Trojan: This Trojan is designed to provide the attacker with administrative access on the target machine.

B) Spyware Trojan: This Trojan is used to deliver ransomware to the target machine.

C) Botnet Trojan: This Trojan turns the infected machine into a proxy, helping the attacker hide and perform activities from the victim's computer.

D) Banking Trojan: This Trojan horse specifically targets online gamers by stealing their account information.

Answer: A 16) Which Trojan horse is designed to turn the infected machine into a proxy, helping a hacker hide and perform activities from the victim‟s computer?

A) Spyware B) Banking C) Botnet D) Downloader Answer: C 39 Copyright © 2024 Pearson Education, Inc.

17) Which of the following statements about QakBot is correct?

A) QakBot is a Trojan that targets online gaming platforms and steals account information.

B) QakBot is a type of malware that has the ability to identify if it‟s in a virtual environment and can inject itself into legitimate processes, making it polymorphic.

C) QakBot was created by a collaboration of law enforcement agencies to intercept criminal activities.

D) QakBot specifically targets Android devices and was distributed in the Google Play store.

Answer: B 18) What is the key characteristic of „Whaling‟ in the context of phishing?

A) It involves a mass email campaign that entices recipients to click on a malicious link disguised as a financial institution.

B) It uses SMS or text messages to induce the victim to click a link or call a phone number.

C) It specifically targets a highly valuable employee and uses highly customized techniques to increase the chances of fooling the individual.

D) It involves redirection of a victim from a valid website or resource to a malicious one to extract confidential information.

Answer: C 19) What is a common characteristic of Tax Return Phishing scams in the United States?

A) The victim is informed of a tax return error through a phone call.

B) The scams typically start before April 15, the federal tax due date.

C) The scams are initiated by stating there is some error in the electronically submitted tax return.

D) The IRS communicates with victims through email regarding potential issues with their tax returns.

Answer: C 20) What does the Business Email Compromise (BEC) scam commonly involve?

A) Receiving an email from a known source making a legitimate request that diverts funds to an attacker.

B) Receiving an email from an unknown source making an illegitimate request for funds.

C) A company CEO sending out gift cards to employees as rewards.

D) A homebuyer receiving correct wire instructions from his title company for a down payment.

Answer: A Network Defense and Countermeasures, 4e (Easttom) Chapter 11 Security Policies 1) Which of the following demonstrates that technology alone is not the answer to network 40 Copyright © 2024 Pearson Education, Inc.

security issues?

A) A user manually opens an e-mail attachment and releases a virus.

B) A user keeps passwords on a Post-it note attached to their computer monitor.

C) The network server is located in a room to which most employees have access.

D) All of the above Answer: D 2) Issues relating to minimum password length, password complexity, and password history are defined in which of the following?

A) Administrative policies B) User policies C) Computer policies D) Technical policies Answer: A 3) Which of the following makes a good password?

A) Includes your birthday B) Uses a combination of letters, numbers, and special characters C) Is relevant to the user D) All of the above Answer: B 4) Configuring passwords to meet the complexity requirements prevents which of the following?

A) Brute force attacks B) Dictionary attacks C) Hybrid attacks D) Any password attack Answer: B 5) Which of the following should be included in the administrative policies regarding passwords?

A) Passwords should not be written down and left in an accessible place.

B) Passwords should not be shared with other people for any reason.

C) A password should be immediately changed if compromised.

D) All of the above Answer: D 6) The SAM file stores passwords in what format?

A) Plain text B) The hash of the password C) The encrypted password D) The decrypted password Answer: B 7) Which of the following is an example of a legitimate use of the Internet at the workplace?

A) Checking competitors‟ websites to see what products they offer B) Using the web to search for a new job 41 Copyright © 2024 Pearson Education, Inc.

C) Using the web to conduct your own business D) Using the web for any use which violates laws Answer: A 8) Which of the following is an example of an inappropriate use of the company network?

A) Checking competitors‟ websites to see what products they offer B) Using the web to search for a new job C) Booking a business trip D) Doing research for a business-related project Answer: B 9) Which of the following Internet browsing activities might be acceptable to some organizations but not to others?

A) Shopping online during lunch and breaks B) Viewing humorous websites C) Reading news articles during lunch and breaks D) All of the above Answer: D 10) In which of the following situations should users open an e-mail attachment?

A) If the attachment was expected B) If the attachment is from a known source C) If the attachment appears to be a legitimate business document D) All of the above Answer: D 11) No one should open an e-mail attachment that meets which of the following criteria?

A) It comes from a known source.

B) It is an executable file.

C) It is a picture sent from a friend.

D) It is expected.

Answer: B 12) Why should you not open an e-mail attachment that contains an animation or a movie?

A) Because it‟s against company policy to watch movies at work B) Because the attachment might contain a virus or malware C) Because you know the person who sent the e-mail D) None of the above Answer: B

42 Copyright © 2024 Pearson Education, Inc.

13) What should you do if you receive an e-mail you suspect might contain a virus?

A) Open the e-mail to see if it indeed contains a virus.

B) Forward the e-mail to a friend and ask them to check if it contains a virus.

C) Contact the IT department and ask someone to check if the e-mail is legitimate.

D) Delete the e-mail.

Answer: C 14) Which of the following should be done when an employee leaves the company?

A) All logon accounts to servers, VPNs, and network resources should be disabled.

B) All keys to the facilities should be returned.

C) All accounts for e-mails, Internet access, and cell phones should be shut off.

D) All of the above Answer: D 15) Which of the following is the first step to take in case of a virus infection?

A) Quarantine the infected machine and unplug it from the network.

B) Scan and clean the infected machine.

C) Log the incident.

D) Bring the cleaned systems online in stages.

Answer: A 16) The best approach to software installation allows end users to install which of the following on their work computers?

A) Apps B) Screen savers C) Utilities D) None of the above Answer: D 17) Which of the following is a policy where a company allows an employee to bring their own device to work, but only if that device is from a list of pre-approved devices?

A) BYOD B) CYOD C) DYOD D) None of the above Answer: B 18) Which of the following is a step that should be followed in the event of a change control request?

A) An appropriate manager within the business unit signs the request, signifying approval.

B) The IT security unit verifies that this change will not cause any security problems.

C) The date and time for the change is scheduled, and all relevant parties are notified.

D) All of the above Answer: D

43 Copyright © 2024 Pearson Education, Inc.

19) After you have completed essential steps following a security breach and have notified the appropriate people, what should be the final step?

A) Copy the logs of all affected systems for use as evidence.

B) Perform an emergency audit to determine what damage has been done.

C) Meet with IT staff to discuss what can be learned and how to prevent it from happening again.

D) Change all affected passwords and repair any damage that has been done.

Answer: C 20) Which of the following developmental policies can help an IT department address secure programming issues?

A) All code must be checked for back doors and Trojan horses.

B) All buffers must have error handling to prevent buffer overruns.

C) All communication must adhere to an organization‟s secure communications guidelines.

D) All of the above Answer: D Network Defense and Countermeasures, 4e (Easttom) Chapter 12 Assessing System Security 1) Which of the following security risk ratings would you assign to a system that has no confidential or sensitive data on it?

A) 1 B) 3 C) 5 D) 10 Answer: A 2) Which of the following threat scores represents the most secure system?

A) -4 B) 0 C) 7 D) 12 Answer: A 3) ZENWorks and Trelix Orchestrator are examples of which of the following?

A) Antivirus software B) IDS C) Patch management systems D) Viruses Answer: C 4) Which of the following is not one of the “Six Ps” representing the stages of assessing a system‟s security?

A) Protect B) Personnel C) Patch D) Physical 44 Copyright © 2024 Pearson Education, Inc.

Answer: B 5) Which of the following physical security measures should be applied if the company is dealing with sensitive information?

A) Biometric locks on all server rooms and equipment storage rooms B) Security badges for all employees C) Logging in all visitors D) All of the above Answer: D

45 Copyright © 2024 Pearson Education, Inc.

6) Which of the following refers to the process of scanning the well-known ports and seeing which ports are open?

A) Port scanning B) Port blocking C) Port assessment D) Vulnerability assessment Answer: A 7) Which of the following refers to the process of finding information about users, shared folders, and printers on a system?

A) Port scanning B) Port blocking C) Enumeration D) Vulnerability assessment Answer: C 8) Which of the following involves using various tools to find vulnerabilities in a system?

A) Port scanning B) Vulnerability scanning C) Enumeration D) Vulnerability assessment Answer: D 9) You use a port scanner to scan a system and find port 80 open. What type of service is most likely running on that system?

A) FTP server B) Web server C) DNS server D) Telnet server Answer: B 10) Which of the following ports is associated with NetBIOS? A) 21 B) 80 C) 139 D) 443 Answer: C 11) Which of the following tools, from RawLogic, can be used to identify shared drives and folders on a Windows system?

A) NetCop B) NetBrute C) Nessus D) SAINT Answer: B

46 Copyright © 2024 Pearson Education, Inc.

12) Which of the following tools should you use to scan Unix systems?

A) NetStat Live B) Active Ports C) SATAN D) Cerberus Answer: C 13) Which of the following classes of attacks can be used to find the Remote Procedure Call service on a system when using SATAN? A) Light B) Normal C) Medium D) Heavy Answer: A 14) Which of the following is a protocol monitor that ships with Microsoft Windows?

A) Active Ports B) NetBrute C) SAINT D) NetStat Answer: D 15) Which of the following should be included in an audit report?

A) Any security vulnerabilities found B) The machines affected by these vulnerabilities C) Recommended steps to correct the vulnerabilities D) All of the above Answer: D 16) Which of the following free tools is the most popular port scanner in the hacking and security community?

A) SuperScan B) Nmap C) Microsoft Baseline Security Analyzer D) TCPView Answer: B 17) Which of the following provides the most common and comprehensive list of vulnerabilities?

A) CVE B) NIST C) OWASP D) None of the above Answer: A

47 Copyright © 2024 Pearson Education, Inc.

18) Which of the following is one of the dimensions of the McCumber Cube?

A) Safeguards B) Goals C) Information states D) All of the above Answer: D 19) Which of the following is not one of the information states of the McCumber Cube?

A) Transmission B) Storage C) Technology D) Processing Answer: C 20) Which of the following is considered essential security documentation?

A) Network protection documents B) Physical security documentation C) Policy and personnel documentation D) All of the above Answer: D 21) Which tool provides a graphical user interface for vulnerability scanning in Kali Linux?

A) Lynsis B) Nikto C) Sparta D) Vega E) OpenVAS Answer: C 22) Which tool provides a search engine for vulnerabilities and offers search options such as finding default passwords, webcams, and devices in specific cities or countries?

A) Nikto B) OWASP ZAP C) Sparta D) Shodan Answer: D Network Defense and Countermeasures, 4e (Easttom) Chapter 13 Security Standards 1) The Orange Book is used to evaluate the security levels of which of the following?

A) Entire networks B) VPNs C) Operating systems D) Backups Answer: C 48 Copyright © 2024 Pearson Education, Inc.

2) The Common Criteria defines a common set of security requirements. These requirements are divided into which of the following?

A) Functional requirements and assurance requirements B) Security requirements and physical requirements C) Functional requirements and technical requirements D) Technical requirements and logical requirements Answer: A 3) Which of the following security models is a subject-object model that introduces a new element, programs?

A) Biba Integrity Model B) Clark-Wilson Model C) Chinese Wall Model D) Bell-LaPadula Model Answer: B 4) The Bell-LaPadula Model defines which of the following four security levels?

A) Unclassified, confidential, secret, top secret B) Classified, confidential, secret, top secret C) Unrestricted, classified, secret, top secret D) Unclassified, classified, secret, top secret Answer: A 5) Under which of the following security models are users allowed access only to information that is not considered to be in conflict with other information that they already possess?

A) Biba Integrity Model B) Clark-Wilson Model C) Chinese Wall Model D) Bell-LaPadula Model Answer: C 6) Which of the following regulates the use and disclosure of individuals‟ personal health information?

A) Sarbanes-Oxley B) HIPAA C) PCI DDS D) GDPR Answer: B 7) COBIT is an acronym for which of the following?

A) Component Objectives for Information and Related Technologies B) Control Objectives for Information and Recovery Technologies C) Control Objectives for Information and Related Technologies D) Component Objectives for Information and Recovery Technologies Answer: C 8) Which of the following is the name for a collection of books published by the U.S. 49 Copyright © 2024 Pearson Education, Inc.

Department of Defense (DoD)?

A) The Rainbow Series B) The Colorful Series C) The Spectrum Series D) None of the above Answer: A 9) Which of the following network security standards provides an overview of information security and defines six phases of the IT security life cycle?

A) NIST SP 800-14 B) NIST SP 800-35 C) ISO 27036 D) NIST SP 800-30 Rev. 1 Answer: B 10) Which of the following regulates financial practices and corporate governance?

A) HITECH B) CFAA C) Sarbanes-Oxley D) HIPAA Answer: C 11) Which of the following is a proprietary information security standard for organizations that handle cardholder information for the major credit and debit cards?

A) GDPR B) Sarbanes-Oxley C) HITECH D) PCI DSS Answer: D 12) What ISO standard provides guidance for cloud security and includes specific controls related to the responsibilities of both the customer and cloud provider?

A) ISO 27002 B) ISO 27017 C) ISO 27018 D) ISO 27001 Answer: B 13) Which ISO standard provides guidance on establishing and maintaining relationships with suppliers, including selection, monitoring, and termination processes?

A) ISO 27002 B) ISO 27017 C) ISO 27018 D) ISO 27001 Answer: A 50 Copyright © 2024 Pearson Education, Inc.

14) Which standard defines Zero Trust as a security framework requiring all users, whether in or outside the organization‟s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data?

A) NIST SP 800-207 B) NIST SP 800-205 C) NIST SP 1800-35B D) NIST SP 800-205 Network Requirements for Zero Trust Answer: A 15) Which organization provides the Tenets of Zero Trust in their NIST 800-207 standard?

A) CrowdStrike B) Oracle C) NIST D) Zero Trust Organization Answer: C 16) Which U.S. Department of Defense (DoD) standard has replaced the Defense Information Assurance Certification and Accreditation Process (DIACAP) for identifying, implementing, validating, and managing IA capabilities and services?

A) DoD 8500.2 B) DoD 8140.01 Cyberspace Workforce Management C) Risk Management Framework (RMF) D) DoDI 8500.2 Answer: C 17) What standard is replacing the Defense Information Assurance Certification and Accreditation Process (DIACAP) within the Department of Defense (DoD) and the federal government?

A) DoD 8500.2 B) Risk Management Framework (RMF) C) DoD 8140.01 D) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39 Answer: B 18) Which organization provides a description of Zero Trust as “…a security framework requiring all users, whether in or outside the organization's network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data”?

A) CrowdStrike B) Oracle C) NIST D) Zero Day Security Answer: A 19) Which step in the DoD Risk Management Framework (RMF) involves the ongoing monitoring of a system's security and environmental changes?

51 Copyright © 2024 Pearson Education, Inc.

A) Prepare B) Categorize C) Implement D) Monitor Answer: D 20) According to NIST 800-207, what is the key principle in granting access to individual enterprise resources within the Zero Trust Architecture?

A) Access is granted based on the requester's role within the organization.

B) Access is granted on a per-session basis after evaluating the requester's trustworthiness.

C) Access is granted only to devices that are owned by the enterprise.

D) Access is granted based on the physical location of the requester within the enterprise network.

Answer: B Network Defense and Countermeasures, 4e (Easttom) Chapter 14 Physical Security and Disaster Recovery 1) Physical security includes which of the following?

A) Securing the servers and workstations B) Controlling access to the company facilities C) Knowing how to respond to fires D) All of the above Answer: D 2) Which of the following backups is the fastest to restore?

A) Full backup B) Incremental backup C) Differential backup D) All backups above take the same time to restore Answer: B 3) Which of the following physical security measures should be applied to a server room?

A) The room should be locked at all times.

B) The room should be fireproof.

C) The room should have no windows.

D) All of the above Answer: D 4) Which of the following can be used to help prevent tailgating?

A) Smart cards B) Man trap C) Turnstile D) Fence Answer: B 5) Which of the following are the three categories of fire suppression systems?

A) Wet pipe, dry pipe, and pre-action 52 Copyright © 2024 Pearson Education, Inc.

B) Wet fire, dry fire, and pre-action C) Flammable fire, electrical fire, and wood fire D) Wet fire, dry fire, and electrical fire Answer: A 6) Which of the following fire extinguisher types is used for electrical equipment fires?

A) Class A B) Class B C) Class C D) Class D Answer: C

53 Copyright © 2024 Pearson Education, Inc.

7) Which of the following fire extinguisher types is used for wood and paper fires?

A) Class A B) Class B C) Class C D) Class D Answer: A 8) Which of the following is an example of a disaster?

A) A hard drive crash on a critical server B) A fire that causes you to close your offices for a week C) A hacker taking over your web server and deleting critical files D) All of the above Answer: D 9) Which of the following RAID configurations offers no fault tolerance?

A) RAID 0 B) RAID 1 C) RAID 3 D) RAID 5 Answer: A 10) Which of the following RAID configurations combines disk striping with disk mirroring?

A) RAID 1 B) RAID 10 C) RAID 3 D) RAID 5 Answer: B 11) Which of the following is designed to get an organization back to full functionality as soon as possible after a disaster?

A) Business continuity plan B) Disaster recovery plan C) Backup plan D) Fault tolerance plan Answer: B 12) Which of the following is designed to get minimal business functions up and running as soon as possible?

A) Business continuity plan B) Disaster recovery plan C) Backup plan D) Fault tolerance plan Answer: A

54 Copyright © 2024 Pearson Education, Inc.

13) Which of the following RAID configurations combines four or more disks and can recover from failure even if two of the disks fail?

A) RAID 1 B) RAID 3 C) RAID 5 D) RAID 6 Answer: D 14) Which of the following is a characteristic of wet pipe fire suppressions systems?

A) Water held back by a clapper B) Always contains water C) Air blows out of a pipe; the water flows D) Preferred for computer installations Answer: B 15) Which of the following is a characteristic of dry pipe fire suppression systems?

A) Water held back by a clapper B) Always contains water C) Can freeze in winter D) Most popular and reliable Answer: A 16) Which of the following physical security measures should be applied when using a video monitoring system?

A) Installing cameras at all entrances and exits of a building B) Using night vision-capable cameras if external lighting isn‟t adequate C) Placing cameras at a height that is difficult for someone to reach D) All of the above Answer: D 17) Which of the following fire extinguisher types is used for flammable liquids?

A) Class A B) Class B C) Class C D) Class D Answer: B 18) Which fire suppression system is usually recommended for computer rooms?

A) Wet pipe B) Dry pipe C) Pre-action D) None of the above Answer: C

55 Copyright © 2024 Pearson Education, Inc.

19) CPTED, a security concept used by organizations, is an acronym for which of the following?

A) Continuity Plan Through Environmental Design B) Crime Prevention Through Environmental Design C) Continuity Plan Through Equipment Design D) Crime Prevention Through Equipment Design Answer: B 20) Which of the following testing disaster recovery plans is the most difficult to conduct, but also the most informative type of test?

A) Cut-off/full interruption B) Simulation C) Document review/checklist D) Walkthrough/tabletop Answer: A 21) Which of the following biometric signals is typically used in most mobile devices today for authentication?

A) Retina B) Iris C) Finger vein D) Fingerprint Answer: D 22) Which of the following is NOT a desired trait for a biometric signal when implementing biometric security?

A) Uniqueness B) Permanence C) Measurability D) Flexibility Answer: D Network Defense and Countermeasures, 4e (Easttom) Chapter 15 Techniques Used by Attackers 1) Which of the following best describes a black hat hacker?

A) A person that usually follows the law but, in some cases, performs illegal activities B) Someone who hacks into systems with the permission of the owner of the systems C) Someone who hacks into systems to cause some type of harm D) Someone who is hired by a company to hack into systems Answer: C 2) Which of the following best describes a white hat hacker?

A) A person that usually follows the law but, in some cases, performs illegal activities B) Someone who hacks into systems with the permission of the owner of the systems C) Someone who hacks into systems to cause some type of harm D) Someone who hacks into computer systems for fun Answer: B 56 Copyright © 2024 Pearson Education, Inc.

3) Which of the following best describes a gray hat hacker?

A) A person that usually follows the law but, in some cases, performs illegal activities B) Someone who hacks into systems with the permission of the owner of the systems C) Someone who hacks into systems to cause some type of harm D) Someone who is hired by a company to hack into systems Answer: A 4) Which of the following is the first step in any computer attack?

A) Performing a DoS attack B) Actively collecting information about the system C) Passive collection of information about the system D) Port scanning Answer: C 5) Which of the following is done during passive information gathering?

A) Run a port scan against the target system to find open ports B) Search the web for any useful information about the company C) Perform a ping scan against the target system D) Attempt to connect to shared folders on the target system Answer: B 6) Using websites such as Netcraft.com and Archive.org is done during what part of an attack?

A) Passive information gathering B) Active information gathering C) Active scanning D) Manual scanning Answer: A

57 Copyright © 2024 Pearson Education, Inc.

7) Which of the following port scans attempts to make a full connection to the target IP address?

A) Ping scan B) Connect scan C) SYN scan D) FIN scan Answer: B 8) Which of the following port scans is most likely to be detected by the target network?

A) Ping scan B) Connect scan C) SYN scan D) FIN scan Answer: B 9) Which of the following is the major issue with a ping scan?

A) It is easy to detect.

B) It will not identify open ports.

C) Many firewalls block ICMP packets so the scan might not be successful.

D) The scan produces many false negatives and false positives.

Answer: C 10) Which of the following automated tools can be used to perform port scanning?

A) Netcraft.com B) Archive.org C) Ping D) NSAuditor Answer: D 11) Which of the following enumeration tools finds only shared folders on a network?

A) ShareEnum B) NSAuditor C) FreeNetEnumerator D) Ping Answer: A 12) Which of the following tools can be used to manually scan a system for vulnerabilities?

A) Ping B) Telnet C) ShareEnum D) OphCrack Answer: B

58 Copyright © 2024 Pearson Education, Inc.

13) Which of the following is an example of a remote access attack?

A) Using a Linux live CD to bypass the password B) Using OphCrack to crack the password C) Using an SQL injection D) Using OphCrack Answer: C 14) Which of the following is an example of a physical access attack?

A) Using a Linux live CD to bypass the password B) Using cross-site scripting C) Using an SQL injection D) Using NSAuditor Answer: A 15) Which of the following best describes a rainbow table?

A) A table that contains passwords B) A table that contains usernames C) A table that contains all possible hashes for all possible character combinations D) A table that contains all possible usernames and passwords Answer: C 16) Which of the following refers to an attacker injecting a client-side script into web pages viewed by other users?

A) Jamming B) Cross-site scripting C) WPS attack D) SQL injection Answer: B 17) Which of the following Wi-Fi attacks is essentially a denial of service attack on a wireless access point?

A) WPS attack B) Cracking the password C) Jamming D) De-authentication Answer: C 18) Which of the following tools boots a Windows system in Linux in order to access and then crack the entries in the SAM file?

A) De-authentication B) SQL injection C) Cross-site scripting D) OphCrack Answer: D

59 Copyright © 2024 Pearson Education, Inc.

19) Which of the following is the most widely used port scanning tool?

A) NSAuditor B) FreeNet Enumerator C) Nmap D) ShareEnum Answer: C 20) Which of the following is a search engine for vulnerabilities?

A) Shodan.io B) Archive.org C) NSAuditor.com D) Nmap.org Answer: A 21) Which session hijacking tool is specifically designed for intercepting and replaying insecure HTTP GET requests into a browser?

A) Ettercap B) Hunt C) SSLstrip D) Cookie Cadger Answer: D 22) Which of the following Bluetooth attacks involves an attacker sending unsolicited messages to the victim over Bluetooth that include a contact card (VCard) containing a message in the name field A) Bluesnarfing B) Super Bluetooth Hack C) Bluejacking D) BlueBug Answer: C Network Defense and Countermeasures, 4e (Easttom) Chapter 16 Introduction to Forensics 1) Which of the following can be used to make a forensic copy of a drive?

A) AccessData FTK B) Guidance Software EnCase C) Linux dd command D) All of the above Answer: D 2) Which of the following is the first step when using Linux to create a forensic copy?

A) Use the delete command on the suspect machine to start the copy.

B) Completely wipe the target drive.

C) Obtain a hash of the suspect drive.

D) Use netcat to set up the target forensic server.

Answer: B 60 Copyright © 2024 Pearson Education, Inc.

3) Which of the following commands can be used to obtain a hash of the original drive and the forensic copy?

A) dd B) netcat C) md5sum D) nc Answer: C 4) Which of the following best describes what you should document during a forensic investigation?

A) Imaging process B) Analysis process C) Everything D) Where the evidence was found Answer: C 5) Computer evidence can include which of the following?

A) USB drives B) Cell phones C) Firewall and IDS logs D) All of the above Answer: D 6) What type of information is stored in the index.dat file?

A) Aiding events about who logs in the system B) Events logged by applications and programs C) List of IP addresses of computers that have connected to the system D) Web addresses, search queries, and recently opened files Answer: D 7) Where would you find the system and security log files on a Windows 10 machine?

A) Under My Computer B) In the Task Manager C) In Event Viewer D) In Internet Explorer Answer: C 8) You want to check if anyone has attempted to log in to a Windows 10 system with an incorrect password. Which of the following event logs should you check?

A) Application B) Security C) System D) Service Answer: B 9) Which of the following event logs in the most important from a forensics point of view?

61 Copyright © 2024 Pearson Education, Inc.

A) Application B) Security C) System D) Service Answer: B 10) Which of the following log files contains failed user logins on a Linux system?

A) /var/log/faillog B) /var/log/user.log C) /var/log/kern.log D) /var/log/lpr.log Answer: A 11) Which of the following can be used to view any active connections to a Windows computer?

A) fc B) openfiles C) net sessions D) netstat Answer: C

62 Copyright © 2024 Pearson Education, Inc.

12) Which of the following can be used to view shared files that are currently open?

A) fc B) openfiles C) net sessions D) netstat Answer: B 13) Which of the following is used to display all incoming and outgoing network connections?

A) fc B) openfiles C) netstat D) netcat Answer: C 14) Which of the following forensic tools can be used to analyze the Windows Registry and crack passwords?

A) OSForensics B) AccessData FTK C) EnCase D) The Sleuth Kit Answer: B 15) What is the first of five principles established by the EU as a basis for all dealings with electronic evidence?

A) Appropriate training B) Audit trail C) Specialist support D) Data integrity Answer: D 16) Which of the following is a certification from the EC-Council that tests general forensic knowledge?

A) CHFI B) CFCE C) IASIS D) GCFA Answer: A 17) Which of the following refers to a legal principle which declares that any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community?

A) EnCase B) SANS certification C) Daubert standard D) OSForensics Answer: C

63 Copyright © 2024 Pearson Education, Inc.

18) Which of the following forensics rules should you follow when gathering evidence from a cell phone?

A) Examine the SIM card, which will contain most of the information you need.

B) Document the cell phone make, model, and any details regarding its condition.

C) Photograph the initial screen of the phone.

D) All of the above Answer: D 19) What is the first step to follow in obtaining a logical image of a cell phone, regardless of the software or tool being used?

A) Connect the device.

B) Run the forensic software of your choice.

C) Begin acquiring an image.

D) Export the information into a report.

Answer: B 20) Which of the following Windows registry keys is of particular interest in child pornography investigations and can confirm or refute the claim that a defendant was not aware of certain files on their computer?

A) HKCU\Software\Microsoft\Windows\TimeStamps B) HKCU\Software\Microsoft\Shell\Bags C) HKCU\Software\Microsoft\Scientific\Method D) HKCU\Software\Microsoft\DigitalForensics\Standards Answer: B Network Defense and Countermeasures, 4e (Easttom) Chapter 17 Cyber Warfare & Terrorism 1) Which of the following can be used to limit the chance of employees conducting computerbased espionage?

A) Limit the use of storage devices, such as CDs and USBs, and control access to these devices.

B) Shred documents and destroy old disks, tape backups, and CDs. C) Give employees only the minimum amount of access they need to perform their job.

D) All of the above Answer: D 2) Which of the following is not a feature displayed by all packet sniffers?

A) Source IP address of the packet B) Destination IP address of the packet C) Statistical analysis of the packet D) Protocol of the packet Answer: C 3) Which of the following is not one of the reasons hackers might use a packet sniffer?

A) To see if traffic is encrypted B) To establish a baseline of normal activity on the network C) To capture the IP addresses of servers, routers, or workstations 64 Copyright © 2024 Pearson Education, Inc.

D) To plan a DoS attack Answer: B 4) Which of the following is a reason security professionals might use a packet sniffer?

A) To plan a DoS attack B) To capture usernames and passwords C) To check if the encryption used is strong enough D) To capture sensitive documents Answer: C 5) Which of the following is an example of information warfare?

A) Gathering information on an opponent B) Creating a virus C) Using a packet sniffer to create a network baseline D) Using a packet sniffer to check if the encryption is strong enough Answer: A 6) Using propaganda to influence opinions in a conflict is an example of which of the following?

A) Corporate espionage B) Information warfare C) Cyber terrorism D) Hacktivism Answer: B

65 Copyright © 2024 Pearson Education, Inc.

7) Using computer systems to obtain confidential information is an example of which of the following?

A) Computer-based espionage B) Information warfare C) Cyber terrorism D) Hacktivism Answer: A 8) Using computer systems to launch a terrorist attack is an example of which of the following?

A) Computer-based espionage B) Information warfare C) Cyber terrorism D) Hacktivism Answer: C 9) Which of the following is used to describe hacking activities that are motivated by purposes the perpetrator feels are ethically valid?

A) Computer-based espionage B) Information warfare C) Cyber terrorism D) Hacktivism Answer: D 10) CommView is an example of which of the following?

A) Key logger B) Packet sniffer C) Virus D) Tool for industrial espionage Answer: B 11) Which of the following is not one of the features available in EtherDetect?

A) Capability to focus on specific packets B) Displays the contents of the packet C) Displays statistical analysis information D) Displays the packet protocol Answer: C 12) Which of the following is an example of propaganda?

A) Hacking into computer systems B) Using a packet sniffer to capture usernames and passwords C) Spreading misinformation to advance one‟s cause D) Creating viruses to steal banking information Answer: C

66 Copyright © 2024 Pearson Education, Inc.

13) Which of the following best describes the purpose of Sinn Fein?

A) Create viruses B) Help security professionals fight viruses C) Spread propaganda D) Infiltrate western computer systems Answer: C 14) Which of the following steps should be taken by companies to protect against cyber terrorist and computer espionage attacks?

A) Ensure that network systems are as secured as possible B) Conduct background checks on all network administrators and security personnel C) Report any intrusions to the appropriate law enforcement agency D) All of the above Answer: D 15) Which of the following products can be used to encrypt hard drives for an organization that uses portable computers?

A) BitLocker B) Check Point Software C) VeraCrypt D) All of the above Answer: D 16) Which of the following is a free packet sniffer that is available for both Windows and Macintosh systems?

A) Wireshark B) EtherDetect C) CommView D) TamoSoft Answer: A 17) Which of the following may cause an employee within an organization to purposely leak sensitive or confidential data?

A) The employee believes he has been wronged in some way and wishes to exact retribution.

B) The employee feels ideologically opposed to some course of action the organization is taking.

C) The employee will be compensated by some other party who is interested in the data.

D) All of the above Answer: D 18) Which of the following statements about cyber terrorism and cyber crime is true?

A) Cyber terrorism and cyber crime are clearly distinguishable, and there is no overlap between them.

B) The line between cyber terrorism and cyber crime is always clear, and there is no confusion about their definitions.

C) It is often difficult to differentiate between cyber terrorism and cyber crime, and some attacks may fall into both categories.

67 Copyright © 2024 Pearson Education, Inc.

D) Cyber terrorism and cyber crime are the same thing and can be used interchangeably in all situations.

Answer: C

68 Copyright © 2024 Pearson Education, Inc.

19) Which of the following is malware that can theoretically manipulate water and power systems, including causing blackouts and water supply disruptions?

A) BlackEnergy B) Wireshark C) CommView D) FinFisher Answer: A 20) Which of the following refers to an application that intercepts packets traveling on a network or the Internet and copies their contents?

A) Virus B) Key logger C) Packet sniffer D) Spyware Answer: C

69 Copyright © 2024 Pearson Education, Inc.