Free 1D0-571 sample questions

Correct answer: Authentication databases, including directory servers

Authentication databases and directory servers should be the primary focus for increased automated auditing when expecting potential insider attacks, as these systems track all user login attempts, failed authentications, privilege escalations, and account modifications. When employees are disgruntled due to unpopular policies, monitoring authentication events helps detect unauthorized access attempts, credential abuse, and suspicious login patterns. While IDS systems, firewall logs, and desktop firewall settings provide valuable security data, authentication databases offer the most direct visibility into user behavior and potential insider threats during periods of organizational tension.

Correct answer: A root kit has been installed on the system.

A rootkit has been installed on the system, as evidenced by the modification of fundamental system commands (ls, su, ps) and the Tripwire file integrity monitoring system detecting new hash values. Rootkits specifically target and replace core system binaries and commands to hide malicious activity while maintaining persistent access. The altered behavior of these essential commands indicates kernel-level compromise typical of rootkit infections. Trojans typically focus on specific malicious payloads, SQL injection attacks target database applications, and spyware primarily monitors user activity - none of these would systematically alter core system commands or trigger widespread file integrity violations detected by Tripwire.

Correct answer: Zero-day attack

This represents a zero-day attack because the employee discovered and exploited a previously unknown buffer overflow vulnerability that the security team and vendors were unaware of, creating a custom application to exploit this unpatched weakness. Zero-day attacks leverage vulnerabilities that have not been publicly disclosed or patched, giving defenders zero days to prepare. Man-in-the-middle attacks intercept communications between parties, trojans are malicious programs disguised as legitimate software, and denial of service attacks aim to make resources unavailable - none of these accurately describe exploiting an undisclosed buffer overflow vulnerability with custom exploit code.

Correct answer: The time and date of the attack, and the names of employees who were contacted during the response

Attack documentation must include the time and date of the attack and names of employees contacted during response to establish a clear timeline and chain of custody for incident response procedures. This factual information is essential for forensic analysis, legal proceedings, and post-incident reviews. Security policy overviews belong in separate policy documents, cost estimates require extensive financial analysis that may not be immediately available, and while network resources and recommendations are valuable, they are typically documented in separate technical and lessons-learned reports rather than the primary incident documentation which focuses on factual chronology and response coordination.

Correct answer: Negotiating the authentication method

During the Internet Key Exchange (IKE) phase of IPsec session establishment, negotiating the authentication method is a fundamental activity that determines how the communicating parties will verify each other's identities before establishing the secure tunnel. IKE Phase 1 specifically handles authentication method selection (pre-shared keys, digital certificates, or other methods) along with encryption and hashing algorithms. Determining security associations comes after authentication is established, network identification numbers are not part of IKE negotiation, and IP version selection occurs at the network layer before IPsec processing begins.

Correct answer: CGI scripts

CGI scripts pose the most significant security threat to Web servers because they execute code on the server with elevated privileges and often lack proper input validation, making them vulnerable to injection attacks, buffer overflows, and arbitrary code execution. CGI scripts run in the server's security context and can access system resources, making any vulnerability in CGI code a direct pathway to server compromise. Database connections are typically secured through connection pooling and authentication, Flash/Silverlight files are client-side technologies with limited server access, and LDAP servers are external authentication services that don't directly threaten the Web server itself.