212-82 Exam Questions & Answers

Managing and maintaining is the phase of firewall implementation and deployment in which Elliott monitored the firewall logs in the above scenario. A firewall is a system or device that controls and filters the incoming and outgoing traffic between different networks or systems based on predefined rules or policies. A firewall can be used to protect a network or system from unauthorized access, use, disclosure, modification, or destruction . Firewall implementation and deployment is a process that involves planning, installing, configuring, testing, managing, and maintaining firewalls in a network or system . Managing and maintaining is the phase of firewall implementation and deployment that involves monitoring and reviewing the performance and effectiveness of firewalls over time . Managing and maintaining can include tasks such as updating firewall rules or policies, analyzing firewall logs , detecting evolving threats or attacks , ensuring firewall security , addressing network issues , etc. In the scenario, Elliott was tasked with implementing and deploying firewalls in the corporate network of an organization. After planning and deploying firewalls in the network, Elliott monitored the firewall logs to detect evolving threats and attacks; this helped in ensuring firewall security and addressing network issues beforehand. This means that he performed managing and maintaining phase for this purpose. Deploying is the phase of firewall implementation and deployment that involves installing and activating firewalls in the network or system according to the plan. Testing is the phase of firewall implementation and deployment that involves verifying and validating the functionality and security of firewalls before putting them into operation. Configuring is the phase of firewall implementation and deployment that involves setting up and customizing firewalls according to the requirements and specifications.

/var/log/wtmp is the Linux log file accessed by Gideon in this scenario. /var/log/wtmp is a log file that records information related to user login/logout, such as username, terminal, IP address, and login time. /var/log/wtmp can be used to determine the current login state of users in a Linux system. /var/log/wtmp can be viewed using commands such as last, lastb, or utmpdump1.

For comprehensive application security testing, combining Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) provides the best coverage:

Static Application Security Testing (SAST):

Source Code Analysis: Scans the source code to identify vulnerabilities such as code injection, buffer overflows, and insecure APIs.

Early Detection: Allows developers to fix vulnerabilities early in the development lifecycle.

Dynamic Application Security Testing (DAST):

Runtime Analysis: Tests the running application for vulnerabilities, including issues related to configuration, authentication, and authorization.

Real-World Attacks: Simulates real-world attacks to identify how the application behaves under different threat scenarios.

Combined Approach:

Holistic Security: Using both SAST and DAST provides a thorough security assessment, covering both code-level and runtime vulnerabilities.

Comprehensive Coverage: Ensures that both internal code issues and external attack vectors are addressed.

OWASP Guide on SAST and DAST: OWASP

NIST Application Security Guidelines: NIST SP 800-53

Immediate Containment:

Disconnecting the compromised systems from the network is crucial to prevent further exploitation and lateral movement by the attackers. This limits their ability to cause additional harm.

Preservation of Evidence:

Archiving all logs and related data ensures that crucial evidence is preserved for future forensic analysis. This helps in understanding the attack vector and the scope of the breach.

Business Continuity:

Shifting core services to backup systems ensures that the business operations continue with minimal disruption. This maintains client trust and operational stability.

Parallel Investigation:

While the immediate response focuses on containment and continuity, a parallel investigation can be conducted to understand the breach and devise long-term mitigation strategies.

Given the severity and sophistication of the threat, immediate containment, preservation of evidence, and ensuring business continuity are the top priorities.

4 is the UID that is mapped to user john in the database table in the above scenario. SQL injection is a type of web application attack that exploits a vulnerability in a web application that allows an attacker to inject malicious SQL statements into an input field, such as a username or password field, and execute them on the database server. SQL injection can be used to bypass authentication, access or modify sensitive data, execute commands, etc. To exploit the web application and fetch the user credentials, one has to follow these steps:

Open a web browser and type www.movieabc.com

Press Enter key to access the web application.

Enter sam as username and test as password.

Click on Login button.

Observe that a welcome message with username sam is displayed.

Click on Logout button.

Enter sam' or '1'='1 as username and test as password.

Click on Login button.

Observe that a welcome message with username admin is displayed, indicating that SQL injection was successful.

Click on Logout button.

Enter sam'; SELECT * FROM users; -- as username and test as password.

Click on Login button.

Observe that an error message with user credentials from users table is displayed.

The user credentials from users table are:

The UID that is mapped to user john is 4.