- Welcome to lesson 14, deep dive quiz.
Now, lesson 14 was all about given a scenario,
apply common security techniques to computing resources.
So we looked at a lot of different scenarios.
In 14 1, we looked at secure baseline and hardening targets,
in 14 2, wireless configurations,
in 14 3, wireless design, in 14 4, mobile connectivity,
in 14 5, mobile device management,
in 14 6, application security and in 14 7, secure coding.
So you ready for 10 questions?
Alright, let's do it.
Oh, do I need to remind you again to make sure
you have a pencil and a pen or a piece of paper?
I really want you to do that
'cause I want you to keep putting me on pause
and answer these questions.
In mobile device management,
what's the primary uses for geofencing technology?
Choose as many as apply.
To enforce DLP policies,
to require biometric authentication,
to segregate high risk applications,
to identify when a device enters a secure area
or to define where devices can be used.
So primary uses for geofencing technology.
What do you like?
Are you ready?
I'm gonna choose to identify when a device
enters a secure area
because we could put a geofence around an area
and maybe that device can't even be used in that area.
Or define where devices can or cannot be used.
So that geofence right, just says, here's a boundary.
So we wanna do things that are boundary driven.
You like it?
Alright, let's check.
And that's correct.
Alright, wireless protocol
that uses simultaneous authentication
of equals or SAE for authentication.
This is WPA, WEP, WPA3
or WPA2.
This one's also called dragonfly.
I know you're gonna get this one right away.
What is it?
It is our newest one.
WPA3.
Agree?
Alright, let's try it.
And that's correct.
A collaborative approach that proactively focuses
on survivability by providing reliable software
with a reduced attack service coupled with automated,
continuous and integrated security testing.
Is this SecDevOps, an integrated product team,
continuous integration or DevOps.
So keywords here, it's a collaborative approach, right?
Focuses on survivability, reliable software.
What do you think?
Well, DevOps would only be developers and operations folks.
That's a nice collaboration.
But that leaves us out of the picture, right?
No security.
Continuous integration.
We said that that's when developers
are all putting their code into a shared mainline.
And if a fault
or a bug or a problem is found, everything stops.
It gets fixed before we go on.
An integrated product team.
It's again a multidisciplinary team.
But what we were really looking for here was SecDevOps,
a collaboration between security, development
and operations.
You like that one?
Alright, let's try it.
And it is correct.
So question four, here we're gonna match the specifications
and the descriptions.
On the left hand side, we have Wi-Fi, Bluetooth,
NFC, RFID, and cellular.
On the right hand side
we have radio frequency distributed network,
short wave network, radio frequency identification,
radio frequency contained network
and a short range wireless communication.
It's a great time to put me on pause.
Right, take your time, match these up and then come on back.
Alright, so starting up here on top with Wi-Fi.
Wi-Fi is a radio frequency contained network.
So what's cellular?
Cellular is a radio frequency distributed network.
NFC is going to be our short range wireless communication.
Remember, it's only very short range,
maybe six eight inches.
Bluetooth is going to be a shortwave network.
And RFID, well that one's easy.
It stands for radio frequency ID.
So RFID, radio frequency ID.
So Wi-Fi, a radio frequency contained network, Bluetooth,
a shortwave network, NFC or nearfield communication,
a short range wireless communication,
RFID, radio frequency identification and cellular
which is a radio frequency distributed network.
You agree?
Alright, let's check it out.
Yay. We're correct, good work.
Let's move on.
Alright, number five.
This is the environment that should mirror PROD.
POST-PROD, DEV, TEST or STAGE.
Remember, this is the environment
where we're gonna do risk assessments,
penetration testing, vulnerability assessments.
It should mirror the PROD environment.
POST-PROD, DEV, TEST or STAGE.
What do you like?
I'm gonna choose stage because staging
is the environment that should mirror the prod environment.
Post-prod, that's just a made up term, right?
Dev is really the first in our four stages.
That's development followed by test, right?
So the staging environment
should mirror the prod environment.
Let's check and that's correct.
Question six, which statement is not true about DAST?
Again, not right.
So three of these statements are true, one is not.
DAST examines running code.
DAST scans pre-compiled code.
DAST tools include fuzzing and API scanning
or DAST simulates automated attacks.
Again, three of those are true statements
but one of those is not.
Take your time, read through them.
Put me on pause if you need to.
I'm gonna choose DAST scans pre-compiled code.
Because DAST, our dynamic security testing
doesn't look at pre-compiled code.
It looks like code after it's been piled.
It looks like it looks at running application code.
So it's true that examines running code.
It's true that DAST tools include fuzzing and API scanning.
And it is true that DAST simulates automated attacks
but it's not true that it scans our pre-compiled code.
Let's double check.
See if you agree and that's correct.
Alright, number seven.
This is an authentication service
that can provide centralized authentication, authorization
and accounting for wireless clients.
So all three AAA, radius, EAP, NTLM, or MS-CHAP.
Now all of them are authentication protocols, but only one
of them is actually an authentication service
that can provide the AAA authentication,
authorization and accounting.
Which one is it?
Take your time.
Put me on pause if you need to.
I'm gonna choose radius.
You agree?
Alright, let's check it out.
And that is correct.
EAP is a protocol.
Matter of fact, there's about 43 versions right now
of EAP, extensible authentication protocol
that's often used in the wireless environment
but it's only an authentication protocol.
NTLM is an authentication protocol as is MS-CHAP.
A component of WPA3 that ensures
that if a private key is compromised,
all previous uses of the key remains secure.
It says SAE, simultaneous authentication of equals,
forward secrecy, the dragonfly key exchange
or Wi-Fi protected setup.
So we're saying here that if a private key is compromised,
all previous uses of the key remains secure.
SAE, simultaneous authentication of equals, forward secrecy,
sometimes referred to as perfect forward secrecy,
the dragonfly key exchange or Wi-Fi protected setup.
Take your time, put me on pause if you need to.
I'm gonna choose forward secrecy.
That's a component of WPA3 that ensures
that if a private key is compromised,
all previous uses of the key remain secure.
SAE, simultaneous authentication
of equals is the authentication method often referred to
as dragonfly because it has what's known
as the dragonfly key exchange.
And WPS, Wi-Fi protected setup is just what allows us
to connect to a wireless network
by being in close proximity to the wireless router.
So let's double check and it is correct.
Number nine, it's the principle that unnecessary services
and applications should be removed or disabled.
Is this hardening, least functionality, least privilege
or zero trust?
Hmm.
So it may look like there's more than one answer
but we're trying to be really specific here.
It's a principle that unnecessary services
and applications should be removed.
So what do you like?
Hardening, least functionality, least privilege
or zero trust?
I'm gonna choose least functionality
because least functionality is our principle
that all unnecessary services
and applications should be removed or disabled
that we wanna have as small a footprint as possible.
Now, least functionality is one
of the things that we do in hardening a system
but hardening is a much more generic term.
It talks about least functionality and you know,
really it also includes things like least privilege
and making sure that we're doing our patches.
So that's a very generic term
where least functionality is a specific principle.
Least privilege refers to our subject
or user saying that we're gonna assign the least amount
of rights and permissions necessary to do a job.
And zero trust means that there is no trust whatsoever.
That reauthentication
and verification is continually required.
So I'm going with least functionality and that is correct.
And we are at our 10th question.
An organization issues company-owned smartphones
that employees can use both professionally and personally.
Which ownership model best describes this scenario?
COPE, CYOD,
COBO, C O B O or BYOD.
So which one of these best describes the scenario?
COPE, CYOD, COBO or BYOD?
I'll help you out.
COPE is company owned, personally enabled.
CYOD is choose your own device
which we didn't even talk about 'cause it's not very common.
COBO is company owned, business only
and BYOD is bring your own device.
So now that you know that, you must have the answer.
The company owned smartphone
that employees can use both professionally and personally.
Well, it must be company owned, personally enabled or COPE.
Agree?
Let's check it if it is right,
we've got a hundred and it is correct.
Great job, congratulations.
Alright, up next we're gonna go into lesson 15
to explain the security implications
of proper hardware, software, and data asset management.
I'll see you there.