1D0-671 CIW Web Security Associate Practice Questions

Let's Encrypt is a non-profit Certificate Authority that provides free, automated, and open TLS certificates. These certificates are trusted by virtually all modern browsers and are an ideal solution for small businesses and individuals who need to secure their websites with HTTPS without incurring the cost of commercial certificates. EV certificates are expensive, and self-signed certificates will generate trust warnings in user browsers.

The key distinction lies in their response capabilities. An IDS is a passive monitoring system; it analyzes traffic or system logs for suspicious activity and generates an alert for an administrator to review. An IPS is an active, in-line system; it not only detects malicious activity but can also take immediate, automated action to block or prevent the threat, such as dropping malicious packets or terminating a connection.

By design, devices on different VLANs cannot communicate directly; they require a Layer 3 device (like a router or a Layer 3 switch) to route traffic between them. Placing a firewall as the inter-VLAN router allows an organization to enforce security policies on all traffic that crosses VLAN boundaries. This enables granular control, such as allowing workstations to access a web server but blocking them from accessing the server's remote administration port.

A vulnerability assessment (or vulnerability scan) is an automated process of proactively identifying security weaknesses in systems and networks. It uses tools to scan for known vulnerabilities (like CVEs), missing security patches, and insecure configurations. Unlike a penetration test, it does not attempt to actively exploit the vulnerabilities it finds. Its output is a report of potential risks, which aligns perfectly with the consultant's goal.

Defense in Depth is a strategy that employs a series of redundant protective measures in case a single security control fails. This option correctly lists multiple, distinct layers of security controls: network (VLANs), host (host-based firewalls), data (encryption), and application (RBAC). The failure of one layer (e.g., the perimeter firewall) would not immediately compromise the entire system because other layers are still in place.

A UDP port scan works by sending UDP packets to a range of ports on a target. If a port is open, there is typically no response. If a port is closed, the target system should respond with an ICMP 'Port Unreachable' message. The observed traffic pattern—many UDP packets to various ports—is a classic indicator of a UDP scan, which is a form of reconnaissance used by attackers to map out vulnerable services.

Symmetric encryption algorithms like AES are significantly faster and more computationally efficient than asymmetric algorithms like RSA, especially for large amounts of data. Given the 2GB file size and the performance requirement, AES is the ideal choice for encrypting the file content itself. The symmetric key used for AES would then typically be encrypted using an asymmetric algorithm (like RSA) for secure key exchange with the partner.

To allow inbound HTTPS traffic to the Web server, a rule must be created that specifies the conditions for allowed packets. The correct rule allows traffic from any source IP, destined for the specific IP of the Web server, using the TCP protocol on destination port 443. This is a specific 'allow' rule that overrides the general 'deny all' policy for this particular traffic type.

The primary mistake in pulling the power cable is the immediate loss of all volatile data stored in Random Access Memory (RAM). This data is critical for a forensic investigation as it contains information about currently running processes (which could be malware), active network connections (showing communication with an attacker), cached data, and potentially even decryption keys for encrypted volumes. The correct first step is to perform a live data acquisition to capture the contents of RAM before powering down the system.