Project - Paradigm of Building Cyber-ops team from Square one

Foundation of Cyber Security:

Case Study:

1). Windows XP was installed. Then needs to be done in the first place to wipe the contents of the disk in the first place:

In this Scenario the system had old window XP operating system (OS). Then here need to change the OS to the system. But in that system contain some data content. Then we need to wipe data in one file or drive in system after we change OS for the system.

Backup the important data content and restore the content in External Hard Drive or Most computers have a system restore disc or built-in restore process on the hard drive to reset the computer to the original or default settings (factory reset).

After Restore is completed now Wipe the Disk Storage using install software:

EaseUS BitWiper enables you to wipe a hard drive in Windows XP without CD in two ways: one is directly wiping the hard drive on Windows XP, and the other is wiping the whole computer, including OS with a bootable disk in WinPE.

Now, download this simple data wiping tool to wipe a hard drive in Windows XP without installation disc.

How to Wipe a Hard Drive in Windows XP

Step 1. Run EaseUS BitWiper. Click the "Wipe Disk" tab.

Step 2. Select the targeted HDD or SSD to wipe.

Notice: Please make sure you have chosen the correct HDD or SSD. Once the wiping starts, your data is irrecoverable.

Step 3. Choose Wiping Method and click "Next".

Choose a suitable wiping method. Recommend EaseUS Secure Erase!

Step 4. Check the warning message and click "Wipe" to confirm.

Step 5. Wait for wiping finish and click "Done".

2). The disk has 1 TB of data. The disk needs to be split into two logical drives. What must be done to accomplish this task:

In this task first we need to check the data content as in backup storage in CD or External HDD. Then now we partition the 1 TB Disk into two logical Drive.

1. Boot into Windows XP
2. Click Start
3. Click Run
4. Type compmgmt.msc to open Computer Management
5. Click OK or press Enter
6. Go to Disk Management (Computer Management (Local) > Storage > Disk Management)
7. Right-click on a unallocated space available on your hard disk and click New Partition
8. In the New Partition wizard, follow the instructions to complete the process

Here can also create a partition with the diskpart utility using Command Prompt:

1. Open Command Prompt
2. Type diskpart and press Enter
3. Type list disk and press Enter. You will now see a list of available disks. Note the number of the disk that you want to use as a new partition.
4. Type select disk x, where x is the number of the disk that you want to use
5. Press Enter
6. Type the following commands, depending on which type of partition you want to create:
• create partition primary 300000_IN_MB to create a primary partition (C Drive)
• create partition Extended 300000_IN_MB to create a Extended partition (D Drive)
• create partition logical 200000_IN_MB to create a logical partition 1 (E Drive)
• create partition logical 200000_IN_MB to create a logical partition 2 (F Drive)

where SIZE_IN_MB should be the size of the partition you want to create, in MB.

3). Before the above step Alex noticed that this hard disk was split up into 3 logical drives. What kind of file system may have been used to execute this:

In this task we need to Execute the NTFS File system were executed to merge the logical dives into one drive as 1 TB. While in first task in case study we reset factory is enable to wipe the data content in the pc. At the time the PC is clean the disk volume into one Drive. And here the file system is executed in drive is NTFS Fle system.

NTFS File system:

NTFS, which stands for NT file system and the New Technology File System, is the file system that the Windows NT operating system (OS) uses for storing and retrieving files on hard disk drives (HDDs) and solid-state drives (SSDs).

4). In new systems Alex needs to configure and install Windows 10 and have them configured as a single logical drive. What kind of file system needs to be selected:

In this task the file is NTFS is selected because the logical drive in window need READ, WRITE and OPEN performance where need to increase the ability of the PC. NFTS has the advance feature compare to all file system present in the pc to partition the disk space and install window 10 in PC by configure best performance access involved in system.

5). The organization need to be connected via wired and wireless too. What kind of hardware need to be installed to have this feature enabled:

In this task organization need to connected both wired and wireless network by using the Router is best choice. The Router is hardware device used to connected the network through wired (Ethernet cable) or either wireless (WIFI).

Router: Routers also connect directly to the internet and share the connection via cable or Wi-Fi with devices on the network. When investing in a router, check the security standard it uses, the number of wired connections it can support and how fast it is. We can check out user-reviews or speak to a professional who can help you select a suitable router.

Routers also include Wi-Fi capability, enabling people to connect laptops, smartphones, tablets and other devices to your network wirelessly.

Wi-Fi is ideal for providing network access to staff with mobile devices and in meeting rooms or common areas.

6). The organization that require faster file transfer process and improve the booting performance too. This will be utilizing the SATA port. Which hardware will be required to fulfill this need:

In this task here need here the organization that need to require faster file transfer process and improve booting performance too with attached to response the SATA port. So here the M.2 SATA SSD device is used as hardware to improve this type performance in the task.

SSD: An SSD, or solid-state drive, is a type of storage device used in computers. This non-volatile storage media stores persistent data on solid-state flash memory. SSDs replace traditional hard disk drives (HDDs) in computers and perform the same basic functions as a hard drive.

7). Team can access all the files which are connected to the network. This will be a single access point for storage, regardless of where they are located. Which technology will be implemented here:

In this task the file was attached in the network storage and employees where access that files in network without change the location of employees and they access it with single port. Here we need to use the NFS (Network File System) technology is best option to this type of task perform.

NFS: Network File System (NFS) is a client-server application that allows users to view and modify files on remote computers as if they were local files. NFS is one of several standards for distributed file systems on network attached storage (NAS).

8). The team needs to ensure that this can be achieved by combining several independent and relatively small disks into a single storage of a large size. What features will be enabled here:

In this task the team need several independent and relatively small disks into a single storage of a large size. Now here use the RAID feature to enable this type performance in between team to achieve the work.

RAID: Redundant Array of Independent Disks (RAID) is a storage technology that creates a data loss fail-safe by merging two or more hard disk drives (HDDs) or solid-state drives (SSDs) into one cohesive storage unit, or array.

RAID storage protects against the total loss of a disk drive’s data by repeating or recreating that data and storing it on the additional drive or drives, a process also known as data redundancy.

9). budget for strict fault tolerance. But , the team is planning for a minimum of two disks to work and provides data redundancy and failover. It reads and writes the exact same data to each disk. From the above answer which specific feature will be implemented:

In this task the budget friendly RAID feature device which used to provide data redundancy and failover. It also read and write the exact same data to each disk. When here need RAID 5 feature specification need to will perform this kind of scenario.

RAID 5: RAID 5 stripes data and protects it by distributing parity data across all disks. Because no extra disks are occupied with mirroring, RAID 5 costs are immediately less than those for RAID 1 and its derivatives. Data protection is good because of parity enabling drive rebuilds, but performance takes a hit because of the processing overhead in calculating parity data. It has the fault-tolerance while doing the work.

10). Alex need to configure a computer which serves instructions to the other computers. This will be a vital piece of the IT infrastructure. What kind of device is this:

In this task alex need to configure a computer with server which servers the data to other companies like IT infrastructure. So here need to use Microsoft Window Server is best option to perform similar this kind of scenario.

Window Server: Windows Server is a group of operating systems designed by Microsoft that supports enterprise-level management, data storage, applications, and communications. Previous versions of Windows Server have focused on stability, security, networking, and various improvements to the file system. Other improvements also have included improvements to deployment technologies, as well as increased hardware support. Microsoft has also created specialized SKUs of Windows Server that focus on the home and small business markets. Windows Server 2012 R2 is the latest release of Windows Server, and focuses on cloud computing.

11). Based on the above answer Alex need to configure a device which need to authenticate all the users on the organization where Windows based systems will be connected. What kind of device is this:

In this task alex need to configured a device by the authentication of all user in the organization while using the window based system where connected in company. Here the Window Authentication need perform this kind of scenario.

Windows authentication: Windows authentication (formerly named NTLM, and also referred to as Windows NT Challenge/Response authentication) is a secure form of authentication because the user name and password are hashed before being sent across the network. When you enable Windows authentication, the client browser sends a strongly hashed version of the password in a cryptographic exchange with your Web server.

12). The same device Alex need to configure as such when the client devices are connected the IP address of all devices on that network need to be assigned automatically. What protocol need to be enabled here:

In this task here need to configure client device are connected to the IP address of all device on the network need to assign the automatically. Here need the DCHP Protocol while need to perform like this type of scenario.

DHCP: The DHCP (Dynamic Host Configuration Protocol) can automatically assign Internet addresses to networks devices, such as servers, desktop computers, mobile devices, etc.

DHCP is an acronym for "Dynamic Host Configuration Protocol," which enables network managers to automate the job of allocating internet protocol addresses inside a network. DHCP enables network administrators to distribute IP addresses from a central location and to automatically deliver the newest IP Address when a device connects from a different place on the network. It is a client-server-based protocol.

13). he client systems Alex need to ensure that the users should be restricted for accessing all the features such as IP configuration, default gateway changes, or installing any unwanted applications which requires admin privilege. Which feature in windows need to be enabled to ensure a approval is needed where is requests for admin permissions:

In this task the alex need to ensure the client where have the restricted for accessing all features such as IP configuration, default gateway changes or installing any unwanted software application the system. Here UAC User Access Control feature is enable to control this types of unwanted access or installing software by the admin privilege.

UAC: The User Account Control (UAC) helps prevent malicious programs (also called malware) from damaging a computer and helps organizations deploy a better-managed desktop. With UAC, applications and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized applications and prevent inadvertent changes to system settings.

14). required exactly to gain access for UAC:

UAC is enabled to the start menu and click the control panel. From there click User Accounts. You will see an option 'Turn User Account Control on or off' - click that and you will then see a checkbox to enable UAC.

15). After installing all mandatory applications on the workstation Alex noticed that booting process is slow. Many applications are executed as part of startup such as Skype, Adobe update etc. Which utility tool can fix this issue:

This types of issue is fixed by using Disable Startup application setting while present in Services.

Steps to fix this booting up issue:

Disable startup applications: If the slow booting is caused by a startup software application or service, you can troubleshoot the exact application causing this by disabling each application with the help of the msconfig utility.

If, after removing/disabling a specific software application, your computer begins to boot correctly and not slow as it was, the issue can be from that software application. Try to update it to the latest available version.

To run msconfig, follow these steps:

1. Boot into your system
2. Click Start
3. Click Run
4. Type: msconfig
5. Press Enter or click OK
6. Go to the Startup or Services tab
7. Disable all services listed in this tab
8. Click OK
9. Click Restart
10. Restart the computer

16). The disk drives and their contents in organization need to be encrypted. When encrypted, others cannot see your files even if the computer had been stolen or the hard disk was taken. Which feature need to be enabled here:

In this task the data from the drive should be encrypted by using Bitlocker option enable to encrypt the data content in the disk drive while it will be stolen by some malicious action. The data from the disk should be encrypted.

Bitlocker: BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.

BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline.

17). Hardware (microcontroller) is mandatory to enable such feature:

In this task while using the bitlocker to encrypt data in drive while enable the hardware (microcontroller) is TPM Trusted Platform Module is perform symmetric encryption method on the Driver.

TPM: Trusted Platform Module (TPM) is a standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. On a physical level, the TPM might be implemented as a built-in chip, an additional module one can install into a slot on the desktop motherboard, or as a virtual emulator (the Intel PTT technology).

18). The similar type of encryption need to be enabled on the portable device such as USB drives. Which feature need to be enabled for this:

There some steps to take encrypt the portal USB drive using the Bitlocker.

Encrypting a portable USB flash drive is a great way to prevent sensitive data falling into the wrong hands via data breaches and security incidents. This guide will demonstrate how to securely encrypt a USB flash drive within Windows so that the data stored on it cannot be read nor accessed without entering a secure password.

• Insert The USB flash drive into your Windows PC.
• Open File Explorer.
• Right click on flash drive and select Turn on BitLocker.
• We will be prompted on how you would like to unlock the drive. Select Use a Password to Unlock This Drive.
• Enter and confirm a password in the spaces provided to unlock the drive. Here can change this password later, provided you remember the original password.
• When prompted How Do You Want to Store Your Recovery Key, select Save the Recovery Key to a File. Save this recovery file in a location of your choosing that only you have access to. Please note that this file does not contain your password.
• If available, please select Encrypt Used Space Only.
• Windows will securely encrypt your USB flash drive; it should only take a few minutes. then will be notified when it is complete. PIC3

19). Alex need to write a script and automate the tasks on the windows so he don’t need to do things manually on all workstations. Which feature in windows can accomplish such tasks via CLI mode itself:

In this task here use the PowerShell where used to write script automate the task on the window don’t need any manually thing to do the workstation.

PowerShell: PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework. PowerShell runs on Windows, Linux, and macOS.

CLI Command Line Interface PowerShell is a modern command shell that includes the best features of other popular shells. Unlike most shells that only accept and return text, PowerShell accepts and returns .NET objects.

20). In few workstation Alex noticed that files has been corrupted. Which windows command will fix this issue:

In this task we need to install System File Checker tool (SFC.exe). Open an elevated command prompt and enter some command to fix the issue. The command is sfc/scannow.

After install this application then locate the file DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccess

Note: Replace the C:\RepairSource\Windows placeholder with the location of your repair source. For more information about using the DISM tool to repair Windows, reference Repair a Window Image.

At the command prompt, type the following command, and then press ENTER:

Command: sfc /scannow

The sfc /scannow command will scan all protected system files, and replace corrupted files with a cached copy that is located in a compressed folder at %WinDir%\System32\dllcache.
The %WinDir% placeholder represents the Windows operating system folder. For example, C:\Windows.

21). Which command in Windows will fetch all the system related information such as hostname, os name, Bios version etc:

In this task there use systeminfo command to access the system information window to view the information like Hostname, OS version, BIOS name…etc.

Type the command line systeminfo and press Enter. The computer will show you all the specs for The system--just scroll through the results to find what need for this type of task.

22). Alex was requested to build few linux based servers. That can be used by the development team. For configuring a new linux system which file format will be compatible for installing the latest Linux OS:

In this task the UBUNTU Linux server best option use to development team and configuring a new linux system to gather file format which compatible in the organization.

UBUNTU Linux Server: As the most popular desktop distribution of Linux, Ubuntu’s reputation might lead you to think that it’s best suited to home users and also greater control, management, small businesses. While Ubuntu's stability and flexibility for end users is very solid, there's also a free-to-use Ubuntu Server (opens in new tab) version to handle your backend tasks.

One of Ubuntu's strongest features is the level of support it benefits from. The vast user base means there's a raft of technical documentation available, and its generous community has answered just about every question you might have.

23). All client specific files need to be placed under the folder named condifential and organization related files need to be placed under the folder named Org. A new folder need to be created for this activity. How this can be created via Linux CLI:

In this task we need to create a folder in the linux server by using CLI (Command Line Interface) because of store data of the client in the folder. In Linux server the folder is called by another name as Directory. Here some command is used to create directory in linux using Terminal CLI (Command Line Interface).

The procedure is as follows:

1. Open the terminal application in Linux
2. The mkdir command is is used to create new directories or folders.
3. Say we need to create a folder name org in Linux, type: mkdir org

syntax in Terminal: $ mkdir [folder name]

Command in Terminal: $ mkdir org

24). After the folder creation now alex is navigated to the folder location where the organization files are located. Now as per the recommendation the organization file named abc.txt need to be moved to the folder path /home/project/org. Which command need to be entered here:

In this task move particular file name is abc.txt to the directory where placed in the path is /home/project/org using the command is mv

The procedure is as follows:

1. Open the terminal application in Linux
2. The mv command is used to move file or document to directory or folder.
3. Say we need to move file abc.txt in directory to particular path is /home/project/org in Linux, type: mv abc.txt /home/project/org

syntax in Terminal: $ mv [File name] [Folder or Directory in Particular Path]

Command in Terminal: $ mv abc.txt /home/project/org

25). Alex noticed there is a client specific file in the confidential folder but that utilized larger disk space. Now alex thought of compressing the file named SOW.txt. Which command need to be entered here:

In this task we need to compress the SOW.txt file because of it’s occupied large space in the folder so now we need use tar command to compress the file SOW.txt

The Procedure to follow:

1. Open the terminal application in Linux.
2. Now we need to use tar used to compress the file SOW.txt
3. Say we need to compress file SOW.txt in confidential folder path is /home/project/org in Linux, type: tar -cf SOW.tar /home/project/org/SOW.txt

syntax in Terminal: $ tar [Option] [Folder or Directory in Particular Path]

Command in Terminal: $ tar -cf SOW.tar /home/project/org/SOW.txt {-c is Create an archive, -f is allow specify the file name to archive}

26). Alex was requested to install few third party applications on the Linux servers. In which default path these applications will be installed:

In this scenario the all third-party application software where installed default in /opt directory path location in Linux servers.

27). The above scenario Alex was requested to install the third-party applications such as office suites, multimedia players and designing tools. Which structure of Linux enables such feature:

In this scenario we need to install the third party application like office suites, multimedia players and designing tools. Here we need to use Linux Terminal which is CLI (Command Line Interface) used to install those application.

Syntax: $ sudo apt-get install [File name]

Command in Terminal: $ sudo apt-get install office_suite

28). On part of trouble shooting Alex need to evaluate the logs which are generated by the servers. In which specific path such kind of logs will be stored:

In this scenario the trouble shooting need to evaluate the logs file which are generated by server where automatically it stored at default location is /var/log in the Linux server system.

29). the network infra based on the organization size. Which device will Michal suggest in first place to direct all the incoming traffic which will act as the first line of defense:

In this type of task the first place to direct all incoming traffic where the first line of defence is Firewall is need to architecture used in network security.

Network Security firewall: When looking at network security, firewalls act as the critical first line of defense in identifying who is doing what, where, and when. Firewalls have progressed from their early days of simply blocking IP addresses and restricting access to specific websites.

30). kind of specific device need to be purchased based on the size of the organization where it performs a simple check of the data packets coming through the router—inspecting information such as the destination and origination IP address, packet type, port number:

The device is Packet Filter Firewall device is suitable to this kind scenario.

Packet Filter Firewall: Type of firewall architecture, packet-filtering firewalls create a checkpoint at a traffic router or switch. The firewall performs a simple check of the data packets coming through the router-inspecting information such as the destination and origination IP address, packet type, port number, and other surface-level details without opening the packet to examine its contents. It then drops the packet if the information packet doesn’t pass the inspection.

31). Which network device serves two primary functions: managing traffic between these networks by forwarding data packets to their intended IP addresses, and allowing multiple devices to use the same Internet connection:

The device Router is suitable to this kind of scenario.

Router: A router is a device that connects two or more packet-switched networks or subnetworks. It serves two primary functions: managing traffic between these networks by forwarding data packets to their intended IP addresses, and allowing multiple devices to use the same Internet connection.

32). Based on the above answer which specific device will be used for optimizing the bandwidth and designed to connect similar devices:

Based on this type of scenario the Edge Router has this kind of capability to handle optimize the bandwidth and designed to connect similar device.

Edge Router: An edge router, also called a gateway router or just "gateway" for short, is a network's outermost point of connection with external networks, including the Internet. Edge routers are optimized for bandwidth and designed to connect to other routers to distribute data to end users.

33). Which network device uses the MAC address to identify which attached device outgoing packets are being sent from and where to deliver incoming packets:

In this task the Switch device is uses the MAC address to identify which attached device outgoing packets are being sent from and where to deliver incoming packets.

34). which specific type of device will be suitable for basic fixed configuration and generally used as a plug and play device:

In this task the unmanaged Switch device will be suitable for basic fixed configuration and generally used as a plug and play device.

35). Which technology enables the user to connect wireless to the network:

In this task the Wireless local area network (WLAN). A WLAN is enabled via Wi-Fi technology in a local area network. It uses a wireless access point that enables connectivity with endpoint devices.

36). which band is applicable to utilize the network speed more than 50 Mbps:

In this task 2.4GHz 802.11n bandwidth has applicable to utilize the network speed more than 50Mbps. The 2.4GHz 802.11n has support 300Mbps in theoretical and real work speed is 150Mbps.

37). Michael recommended to Rivera that they can use a specific hardware feature where it will project a wifi signal to a designated area by connecting to a wired router/switch via ethernet cable. Which device is that named:

In this scenario Access Point is the device which used to to project a wifi signal to a designation area by connecting to a wired router/switch via ethernet cable.

Access Point: An Access Point is a device that creates a wireless local area network, or WLAN, usually in an office or large building. An access point connects to a wired router, switch, or hub via an Ethernet cable, and projects a WiFi signal to a designated area. For example, if you want to enable WiFi access in your company's reception area but don’t have a router within range, you can install an access point near the front desk and run an Ethernet cable through the ceiling back to the server room.

38). From above scenario which kind of device will be recommended if they need to extend the wifi signal on the same floor without connecting to the ethernet cable:

In this scenario the Range Extender is device which used to extend the wifi signal on the same floor without connecting to the ethernet cable.

Range Extender: A Range Extender lengthens the reach of an existing WiFi network. Since range extenders connect wirelessly to WiFi routers, they must be placed where the WiFi router's signal is already strong, not in the location of the actual dead spot. For instance, if your router is in the basement of a two-story building, installing a range extender on the ground floor (where coverage from the WiFi router is still strong) will eliminate potential dead zones on the second floor.

39). Type of address in the workstation can’t be changed manually and it’s a unique address for each workstation:

In this scenario the Static IP address in the workstation is can’t be changed manually and it’s unique address for each workstation.

40). Which windows command will be used to fetch the MAC address and IP address details:

In this task use ipconfig/all command to view all data to fetch the MAC address and IP address detail.

Steps to view this kind of task.

1. From Start, perform a search.
2. Type cmd and make sure you have Apps selected (not Settings or Files).
3. In the results, find Command Prompt on the left. Click on it to open the Command Prompt.
4. In the Command Prompt window, type ipconfig /all and press Enter. Under the Ethernet Adapter Local Area Connection section, look for the “Physical Address”. This is your MAC Address.

41). The devices to be connected to the network, what must be configured initially on all the devices:

In this scenario at first we need check the network configuration The right network configuration is essential to supporting the flow of traffic through a network, and it can also support and enhance network security and improve network stability. In addition, the use of network configuration management and check devices are switch and router where initially on all connected to system in organization.

42). need to configure maximum of 50 devices since this is a small organization , what range of IP address can be used for this requirement:

In this scenario the IPV 4 Class C has 192-223 it best suitable range is used Class C addresses are most common and used in small business and home networks. These support up to 256 hosts on each of 2 million networks.

43). 192.168.10.0/24. Provide the below Start and End IP address of this CIDR IP address range:

Start and End IP address of this CIDR IP address range for 192.168.10.0/24 is the start range is 92.168.10.1 and end range is 192.168.10.255.

44). IP range what subnet mask will be provided:

In this task the 192.168.10.0/24 IP range subnet mask is 255.255.255.0

45). The Windows AD server is configured with the IP address 192.168.10.10. Via CLI which command will be used check if the connection is established from client servers to this AD server:

In this scenario the Command PING is used to check the connection between the client and server in the window system. Following steps is used to check the connect between client and server.

1. Open the window comment prompt.
2. Type ping command with the preference ip address.

Syntax: $ ping [IP address or Domain name]

Command: $ ping 192.168.10.10

Ping: Ping is a command-line utility, available on virtually any operating system with network connectivity, that acts as a test to see if a networked device is reachable. The ping command sends a request over the network to a specific device.

46). Which command in windows will list show the IP address information:

In this task type ipconfig/all command which in window will list the IP address Information in the comment prompt.

47). Which command in windows will provide the number of hops information between the client and the AD server:

In this task type traceroute command in windows will trace the number of hops information between the client and the AD server:

Syntax: traceroute [IP address or Domain Name]

Command: traceroute 192.168.10.10

Traceroute: Traceroute is a computer network diagnostic tool for displaying the route (path), and measuring transit delays, of packets across an Internet Protocol (IP) network. This section shows how to run Traceroute, and how to interpret the results.

48). In Linux server which command will provide the IP address information:

In this task type ifconfig command in linux terminal to find the IP address of linux machine.

Command: $ ifconfig

49). We need to view the DNS related query for rivera.com. Which command in linux will provide this information:

In this task used to view DNS related query for rivera.com is nslookup command used to view this kind of scenario.

Syntax: $ nslookup [Domain or IP address]

Command: $ nslookup rivera.com

50). the architecture need to be revised in that way. The organization may expand it’s business about 1 million employees. In this case which IP address class will be required to fulfill it’s requirement:

In this particular scenario there use Class A IP Address is suitable because it has large number of host connection over through multiple geo location any organization.

This IP address class is used when there are a large number of hosts. In a Class A type of network, the first 8 bits (also called the first octet) identify the network, and the remaining have 24 bits for the host into that network.

An example of a Class A address is 102.168.212.226. Here, “102” helps you identify the network and 168.212.226 identify the host.

Class A addresses 127.0.0.0 to 127.255.255.255 cannot be used and is reserved for loopback and diagnostic

51). Can ensure the impact on breach will be reduced. Rivera need to be proactive where the attacks on the network need to be eliminated in the first place. What kind of device need to be implemented here:

In this scenario the data can breach or cause any attack in network of organization, here used to implement the Firewall as Whitelisting Protection. Which it is act as the firewall blocks everything except specifically listed network traffic.

Whitelisting Firewall: Which is used to accept the specifically list provide by organization is only pass through the network. So, this means there reduce data breach and pro-active attack from the network-based problem.

52). The organization is planning to monitor all the network related traffic on the network device as well as on the host level also. What technology/hardware will be used in this scenario:

In this kind of scenario organization need to implement the Network Traffic Analysis which it is used to monitor all network related traffic on network device.

Network traffic analysis (NTA) is a method of monitoring network availability and activity to identify anomalies, including security and operational issues. Common use cases for NTA include:

• Collecting a real-time and historical record of what’s happening on your network
• Detecting malware such as ransomware activity
• Detecting the use of vulnerable protocols and ciphers
• Troubleshooting a slow network
• Improving internal visibility and eliminating blind spots

53). The organization is looking for reactive approach as to detect the alerts / malicious traffic in the first place, which kind of device will be implemented:

In this scenario the organization need IDS (Intrusion Detection System) which is detect the alter/malicious traffic in the first place to SOC team in organization.

IDS: An Intrusion Detection System (IDS) is a monitoring system that detects suspicious activities and generates alerts when they are detected. Based upon these alerts, a security operations center (SOC) analyst or incident responder can investigate the issue and take the appropriate actions to remediate the threat.

54). What will be protection level when compared to IDS Vs IPS:

In scenario the protection level of IDS (Intrusion Detection System)

• monitor and analyze network traffic for packets and other signs of network invasion.
• The system then flags known threats and hacking methods.
• IDS systems detect port scanners, malware, and other violations of system security policies.

In scenario the protection level of IPS (Intrusion Prevention System)

• reside in the same area as a firewall, between the internal network and the outside internet.
• The IDS system flags something as a threat, the IPS system denies the malicious traffic.
• The traffic represents a known threat in the databases, the IPS will shut the threat out and not deliver any malicious packets.

55). The devices such as servers, workstation and all network devices are connected to the network for the first time. What type of transmission will be used to reveal it’s MAC information to the entire network hierarchy:

In this scenario the transmission will used to reveal it’s MAC information to the entire network is ARP (Address Resolution Protocol) this device is used in workstation.

ARP: The ARP (Address Resolution Protocol) is a layer 2 protocol used to map MAC addresses to IP addresses. All hosts on a network are located by their IP address, but NICs do not have IP addresses, they have MAC addresses. ARP is the protocol used to associate the IP address to a MAC address.

56). what kind of address need to be assigned on the IP level to send messages to all nodes of network?(provide the IP address):

In this scenario the address need to assigned on the IP level message to all node in network is ARP (Address Resolution Protocol) When a host must find the MAC address of the destination, it will send out an ARP request. This is after the node consults its ARP table and determines that the address is in fact unknown. In the first line, one node (192.168.1.1) which it response through the MAC Address.

57). Using which protocol MAC address details can be fetched on the network:

In this scenario the ARP (Address Resolution Protocol) where has MAC (Media Access Control) address details can be fetched on the network.

ARP is the Address Resolution Protocol. It is the system that network systems use to map IP address allocations to the physical addresses of devices on the network. Physical addresses are known as MAC addresses.

58). To establish communication from the servers for SSH and RDP access. What port numbers need to be enabled for this access:

In this scenario SSH is defined as Secure Shell is communication the server using TCP (Transmission Control Protocol) the port number is 22. The SSH is works on Linux based machine.

In this scenario RDP is defined as Remote Desktop Protocol is communication the server using TCP (Transmission Control Protocol) the port number is 3389. The RDP is works on Window based machine.

59). which device on the network hierarchy will block all the unwanted ports:

In this scenario we use window Firewall is used to block the unwanted ports at network hierarchy. Port Blocking is the action performed by an Internet Service Provider (ISP) to identify and block the Internet traffic by using the Port Number and Transfer Protocol.

Steps to Block Ports on Computer

1. Go to Start -> Control Panel -> System and Security -> Windows Firewall.
2. Select ‘Advance Settings’ -> ‘Inbound Rules’ (to block an inbound port)’ OR ‘Outbound Rules’ (to block an outbound port).
3. Select ‘New Rule‘ choose ‘Port‘ from options and click Next.
4. Choose ‘TCP‘ or ‘UDP‘ and click on ‘Specific Local Ports‘.
5. Enter the Port Number and click ‘Next‘.
6. Click ‘Block the Connection‘ and then click ‘Next‘. Choose the network location (public, private, domain) on which the rule applies and click ‘Next‘.
7. Create a Rule name and add a description for it. Click on ‘finish‘ to block ports on a computer.

60). Which Technology allow multiple devices to access the Internet through a single public address:

In this scenario The NAT (Network Address Translation) technology to access the Internet, one public IP address is needed, but we can use a private IP address in our private network. The idea of NAT is to allow multiple devices to access the Internet through a single public address.

61). Which specific technology ensures all the network traffic to be encrypted when the employees are working from home too:

In this scenario the VPN (Virtual Private Network) is used to network traffic encryption when employees are working from home.

Using VPN (Virtual Private Network) This keeps you secure on public hotspots and allows for remote access to secure computing assets. VPNs can reduce the risk of certain cyber attacks, like MITM attacks, as they make it difficult to snoop on your traffic and intercept what they doing.

62). Request as virtualization need to be enabled on few windows servers. When alex trying to configure this, he is getting error message as he need to enabled this feature on hardware level. From which specific location he can enable this feature:

In this scenario Hyper-V (hypervisor-based) feature is used to virtualization need to be enabled on few windows servers. To configure this, he is getting error message as he need to enabled this feature on hardware level.

Hyper-V (hypervisor-based) is feature virtualization used in Hardware assisted virtualization and data execution protection must be enable the BIOS

Hyper-V Enable process:

1. Enable Hyper V - You can do this by running the following command as administrator. - dism.exe /Online /Enable-Feature:Microsoft-Hyper-V /All
2. Enable Hypervisor with following command - bcdedit /set hypervisorlaunchtype auto.

63). From Cybersecurity team they are requesting to enable this feature where they can execute all malicious files and understand it’s behavior. What terminology will be used from Cyber security:

In this scenario here use RASP (Runtime Application Self-Protection) this feature terminology is used to requesting enable execute all malicious files and understanding it’ behaviors.

RASP is a technology that runs on a server and kicks in when an application runs. It's designed to detect attacks on an application in real time. When an application begins to run, RASP can protect it from malicious input or behavior by analyzing both the app's behavior and the context of that behavior. By using the app to continuously monitor its own behavior, attacks can be identified and mitigated immediately without human intervention.

64). Defines the security operations of the organization and they need to communicate with management about security issues and oversee compliance tasks. What will be role of this person:

In this scenario the Security Analyst role in SOC (Security Operation Center) where suitable to communicate management about security issues and overseas compliance task.

Security analysts are cybersecurity first responders. They report on cyberthreats and implement any changes needed to protect the organization. They’re considered the last line of defense against cybersecurity threats, work alongside security managers and cybersecurity engineers, and usually report to the CISO.

65). Brian will be working in SOC team. What will be aim of the SOC team:

SOC: The function of the security operations center (SOC) is to monitor, prevent, detect, investigate, and respond to cyber threats around the clock. SOC teams are charged with monitoring and protecting the organization’s assets including intellectual property, personnel data, business systems, and brand integrity.

Aim and Work of SOC: The primary mission of the SOC is security monitoring and alerting. This includes the collection and analysis of data to identify suspicious activity and improve the organization’s security. Threat data is collected from firewalls, intrusion detection systems, intrusion prevention systems, security information and event management (SIEM) system and threat intel. Alerts are sent out to SOC team members as soon as discrepancies, abnormal trends or other indicators of compromise are picked up.

• Asset Discovery
• Behavioral Monitoring
• Maintaining Activity Logs
• Alert Ranking
• Incident Response
• Root Cause Investigation
• Compliance Management

66). Suspicious email patters. Brian received an email from one of the customers stating that he is seeking permission for a part of hacking where he will identify vulnerability and report to the organization. What kind of hacker is he exactly:

In this type Suspicious email pattern vulnerability is known as Phishing attack. Phishing is a form of fraud in which an attacker masquerades as a reputable entity or person in email or other forms of communication. Attackers will commonly use phishing emails to distribute malicious links or attachments that can perform a variety of functions.

67). The customer found this option on the Rivera website mentioned as they can report the security vulnerabilities , bug and exploits where they will be recognized and compensated. What program is this exactly:

In this type of scenario, the customer is found some kind of vulnerabilities and bug in the website the exploit it where they recognized and compensated the program is called Bug Bounty Program.

A bug bounty program is a deal offered by many websites, organizations and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.

68). Brian found a similar activity from his monitoring tool and identified a hacker is trying to infiltrate the network by doing a brute force attack. What kind of hacker:

In this type scenario the activity from his monitoring tool and identified a hacker is trying to infiltrate the network by doing a brute force attack. This type of hacking is Botnet (Bots).

Brute force attacks are usually carried out by bots that make up large armies of infected computers around the world (known as botnets). The attackers use the botnet to repeatedly attempt to log into accounts using a long list or 'dictionary' of words and numbers as passwords.

69). In one of the security blog Brian saw news as Israel is trying to target Afghanistan’s government agencies and cause major damage and disruption. What source of cyber threat is this:

In this scenario the cyber threat is Hostile Nation-States. This type of threat National cyber warfare programs provide emerging cyber threats ranging from propaganda, website defacement, espionage, and disruption of key infrastructure to loss of life. Government-sponsored programs are increasingly sophisticated and pose advanced threats when compared to other threat actors. Their developing capabilities could cause widespread, long-term damages to the national security of many countries, including the United States. Hostile nation-states pose the highest risk due to their ability to effectively employ technology and tools against the most difficult targets like classified networks and critical infrastructures like electricity grids and gas control valves.

70). workstations there is a malicious software which is used for stealing and damaging the computer. What terminology is this exactly:

In this scenario the Spyware is the type of malware that downloads onto a device without the user's permission. It steals users' data to sell to advertisers and external users. Spyware can track stealing credentials and obtain bank details and other sensitive data. It infects devices through malicious apps, links, websites and email attachments.

Spyware, on the other hand, is a type of malware designed to gain access and damage your computer.

71). What kind of virus is designed to bypass the antivirus software:

In this scenario the Stealth virus that escape notice even if they're not specifically designed to do so are also described as stealth viruses. This sometimes occurs because the virus is new or because users haven't updated their antivirus software to be able to detect the infection. It is easily bypass the antivirus in the system.

72). Brian identified an application which was disguised as legitimate application where it can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. What type of virus is this exactly:

In this type scenario the Trojan Virus is Once downloaded, the malicious code will execute the task the attacker designed it for, such as gain backdoor access to corporate systems, spy on users' online activity, or steal sensitive data.

73). After deploying this application on the sandbox environment Brian noticed that this application is trying to download additional malware files on the system. What type of Trojan is this exactly:

In this type of scenari, the Trojan-Downloader is is a type of trojan that installs itself to the system and waits until an Internet connection becomes available to connect to a remote server or website in order to download additional programs (usually malware) onto the infected computer.

74). He tried to access the Rivera website, but it got redirected to untrusted search engines and many ad’s getting displayed on that website where it shouldn’t get displayed. What kind of infection is this:

In this type of scenario, the Adware (or advertising-supported software) is a type of malware (or malicious software) that hides on your computer and automatically displays advertising material when you are online. If It have been getting annoying pop-up offers appearing on your screen, your computer might be infected.

75). If Virus was detected in the production environment, which tool will detect and suppress the infection in the first place:

In this scenario the virus is detected and supressed by using any paid subscribed trusted anti-virus software or in window there is default Window Defender are there it used to remove the virus from system. But the we need check the regular update of window Defender.

76). Which team in the organization will take care of this tool and ensure that AV signatures are updated:

In this scenario the Security Engineer in SOC (Security Operation Center) is manage the usually software or hardware specialists, and are in charge of maintaining and updating tools and systems. They are also responsible for any documentation that other team members might need, such as digital security protocols.

77). Monitoring Brian noticed that one server is having multiple login failures and the count is huge. What kind of attack is this:

In this scenario the Brute Force Attack is one of the hacking technics used to hack the server by trillion number passwords are used to crack the login. In Dictionary Brute Force Attack is one of type in brute force attack it is check, the password and username is dictionary and try to login with huge number of times.

78). In sandbox environment Brian noticed that the application is trying to reach one of the IP. After analysis Brian noticed that IP is malicious. What kind of server communication is that application trying to establish:

In this type of scenari, the IP Address Spoofing is kind of the creation of Internet Protocol (IP) packets with a false source IP address to impersonate another computer system. IP spoofing allows cybercriminals to carry out malicious actions, often without detection.

79). 100 servers infected with such kind of infection and tried establishing the connection . Now these servers will do any instructions until the system is infected. What do we call for such malware infected computers:

In this scenario the Worm is one of Malware which is infected through the server and wait for instruction pass in between the server communication. Worm can also self-replicate and spread full copies and segments of itself via network connections, email attachments, and instant messages Unlike viruses, however, a worm does not require a host program in order to run, self-replicate, and propagate. Once infected, worms spread quickly over the internet and computer networks.

80). What specific kind of malware will monitor and record of everything you type on a computer or mobile keyboard and use it for malicious activity:

In this scenario the Keylogger is one of the malicious attack have legitimate uses; businesses can use them to monitor employee activity and everything you type on a computer or mobile keyboard and use it for malicious activity.

81). key concept will keep recording every key stroke pressed on the keyboard:

In this scenario, the Keystroke Logging is one from keylogger which the concept oncept of a keylogger breaks down into two definitions: Keystroke logging Record-keeping for every key pressed on your keyboard. Keylogger tools: Devices or programs used to log your keystrokes.

82). Rivera is trying to create a website where the customers and clients can purchase and do the transactions digitally. The Website need to be secure and they need to ensure all the connections need to be encrypted. How the customers can identify the Website is secure:

IN this scenario the HTTPs (Hypertext Transfer Protocol secure) is used in the website a secure URL should begin with “https” rather than “http.” The “s” in “https” stands for secure, which indicates that the site is using a Secure Sockets Layer (SSL) Certificate. This lets you know that all your communication and data is encrypted as it passes from your browser to the website's server.

83). what port number will be used to establish a secure communication to the website:

In the scenario Port 443. HTTP Secure (HTTPS) is like HTTP but more secure. All HTTPS web traffic goes straight to port 443. Any network service that uses HTTPS for encryption, such as DNS over HTTPS, also connects directly to this port.

84). which protocol will be used:

In this scenario the port 443 has http protocol over TLS(Transfer Layer Security)/SSL(Secure Socket Layer)

85). Mention the list of List of HTTP Request methods:

The HTTP (Hypertext Transfer Protocol) request method are,

• GET
• POST
• PUT
• HEAD
• DELETE
• PATCH
• OPTIONS
• CONNECT
• TRACE

86). In Which HTTP Method the Information will be visible when the user is trying to access the website:

In this scenario The GET method can retrieve information identified by the request-URl (Uniform Resource Identifier). GET requests can be viewed in the browser history and access the website. It enables you to save the results of a HTML form. You can easily use GET method to request required data.

87). In which HTTP method the data can’t be cached:

In this scenario Responses to POST method are not cacheable, UNLESS the response includes appropriate Cache-Control or Expires header fields.

88). When a customer is accessing the Ravera website, they are tying to login with the credentials. If the credentials are valid and accessing the contents of the page as expected which HTTP status code will be displayed:

In this scenario the HTTP status code is 200 ok which it is display the successfully login into the website. A 200 response is cacheable by default. The meaning of a success depends on the HTTP request method: GET , the resource has been fetched and is transmitted in the message body.

89). Website with admin-based login but the credentials are invalid. Meanwhile this kind of access is available only for particular users .The user is getting a forbidden error message. What HTTP status code will be displayed here:

In this scenario show HyperText Transfer Protocol (HTTP) 401 Unauthorized response status code indicates that the client request has not been completed because it lacks valid authentication credentials for the requested resource.

90). Which security device will monitor all the web application-based attack and defend in the first place:

In this scenario A web application firewall (WAF) protects web applications from a variety of application layer attacks such as Cross-site scripting, SQL injection and cookie, among others. Attacks to apps are the leading cause of breaches they are the gateway to your valuable data. With the right WAF in place, can block the array of attacks that aim to exfiltrate that data by compromising the systems.

91). which team in the SOC will monitor and take care of all the security incidents on the Web application-based tool:

In this scenario the security analysts is monitor the threat and Security engineer is sort out the threat in web application based tool

Security analysts are cybersecurity first responders. They report on cyberthreats and implement any changes needed to protect the organization. They’re considered the last line of defense against cybersecurity threats, work alongside security managers and cybersecurity engineers, and usually report to the CISO.

Security engineers are usually software or hardware specialists, and are in charge of maintaining and updating tools and systems. They are also responsible for any documentation that other team members might need, such as digital security protocols.

92). Which specific type of web-based attack uses Java script to inject malicious code:

Cross-Site Scripting (XSS) attacks take these opportunities to inject malicious scripts into trusted websites. A text containing malicious code (typically in JavaScript) is inserted into a web page during a Cross-Site Scripting attack. When an unsuspecting user visits that web page, the code is executed

93). The security team, he needed to validate all the Suspicious IP address and validate the severity. From which source he will validate this information:

In this type of scenario the Suspicious IP address the attacker can implement many kinds of attacks (for example, attacker-in-the-middle attacks, reflective attacks, flood-based attacks and poisoning attacks) while hiding their real identity. Source Address Validation (SAV) is important to mitigate source address spoofing. In recent years, the Mutually Agreed Norms for Routing Security (MANRS) has been calling on network operators to implement SAV.

The SAV (Source Address Validation) has the information of all IP address all activities in the system. At the access network level, Source Address Validation Improvement (SAVI) is the best practice. It is implemented at switches and forces each host to use legitimate source IP addresses.

94). Rivera is using a CRM tool for the organization. Brian noticed a vulnerability on the CRM tool where it will enable the hackers to inject malicious code and take control of the systems. When Brian trying to find that vulnerability on that specific CRM application, the information is not disclosed on any public website. What is this exactly:

In this scenario the information of CRM application is not disclosed on any public website because of hacker using here Information Disclosure Vulnerabilities to steal the sensitive information and data from the CRM application.

The information Disclosure Vulnerabilities also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:

• Data about other users, such as usernames or financial information
• Sensitive commercial or business data
• Technical details about the website and its infrastructure

Information disclosure vulnerabilities can have both a direct and indirect impact depending on the purpose of the website and, therefore, what information an attacker is able to obtain. In some cases, the act of disclosing sensitive information alone can have a high impact on the affected parties. For example, an online shop leaking its customers' credit card details is likely to have severe consequences.

95). Based on the above answer the hackers can do this activity and they can breach the organization. What kind of attack is this:

In this scenario the Information Disclosure Vulnerabilities is an attack were aimed at acquiring system specific information about a web site including software distribution, version numbers, and patch levels. The acquired information might also contain the location of backup files or temporary files.

Most web sites will disclose some amount of information. The more information that an attacker learns about a web site, the easier the system will be to compromise.

Types of Attacks in Information Disclosure Vulnerabilities:

• Directory Indexing: Exploits a function in a web server that lists all the files within a requested directory if the normal base file is not present.
• Information Leakage: Exploits a web site that reveals sensitive data, such as developer comments or error messages.
• Path Traversal: Forces access to files, directories, and commands that are located outside the web document root directory.
• Predictable Resource Location: Uncovers hidden web site content and functions.

96). CRM Vendor released the latest version as 6.1.0. On the 6.1.0 version it has new features and functionality. What need to be done exactly to have the latest version:

In this scenario CRM (Customer Relationship Management) tool which it is refers to any strategy, tool, technique or technology that enterprises use for retaining, acquiring and developing customers. Sales and marketing reps can manage and automate the customer life cycle using them. These solutions aid critical CRM functions by consolidating customer information in a central repository, which enables automated business processes, organized relationships, closely monitored performance and improved productivity.

The Feature in CRM tool:

• Contact Management
• Sales Team and Customer Opportunity Management
• Read Management for Determining High-Quality Leads
• Reports and Dashboards
• Sales Analytics
• Mobile CRM
• Sales Force Automation
• Sales Forecasting.
• Email Client Integration
• Workflow and Approvals
• Sales Data
• CRM Data/File Storage
• Inside Sales Console
• Sales Performance Management
• Marketing Automation Integration
• Pipeline Management
• Customer Service Automation
• Social Media Management Integration
• Testing Environment
• Cloud-based or on-premises CRM

In this scenario to enable the latest CRM 6.1.0 tool in rivera industry to renewal the subscription and check the security patch validation. The rivera using the free subscription there is limited features where only support use. Where the industry is renewal the CRM 6.1.0 tool is support all the features and functions.

97). Vulnerability Management Team:

Vulnerability management is the ongoing, regular process of identifying, assessing, reporting on, managing and remediating cyber vulnerabilities across endpoints, workloads, and systems. Typically, a security team will leverage a vulnerability management tool to detect vulnerabilities and utilize different processes to patch or remediate them.

A strong vulnerability management program uses threat intelligence and knowledge of IT and business operations to prioritize risks and address vulnerabilities as quickly as possible.

The 5 Steps of the Vulnerability Management Cycle

There are five main stages in the vulnerability management cycle include:

• Assess
• Prioritize
• Action
• Reassess
• Improve

98). Particular Team identify the vulnerability, how it will be remediated in the organization:

Before an organization can correct vulnerabilities, they need to discover them. Traditional remediation workflows rely on scanning and communication tools to function. Traditional remediation can increase the mean time to respond (MTTR) and leaves systems vulnerable for longer than necessary.

Some vulnerability remediation occurs as a result of penetration testing, or vulnerability assessments. These tests produce reports on vulnerabilities and outline how to fix them. The reports serve as a checklist for security teams that rank flaws by severity, allowing the team to patch the critical flaws first. Once developers deploy a patch, they can do another scan or retest to validate the patch. Retesting is an essential part of vulnerability remediation, as some patches may introduce new flaws.

Vulnerability remediation is the process of addressing system security weaknesses. The steps include the following:

• Discover: Identify vulnerabilities through testing and scanning
• Prioritize: Classify the vulnerabilities and assess the risk
• Remediate: Block, patch, remove components, or otherwise address the weaknesses
• Monitor: Continue monitoring for new vulnerabilities and weaknesses

99). Which team in Ravera will enforce all users to authenticate their identity and login to all the servers and workstation:

In this scenario the Identity and Access Management (IAM) team which used to enforce the identities of users where login to the server or workstation. Identity and access management (IAM) ensures that the right people and job roles in your organization (identities) can access the tools they need to do their jobs. Identity management and access systems enable your organization to manage employee apps without logging into each app as an administrator. Identity and access management systems enable your organization to manage a range of identities including people, software, and hardware like robotics and IoT devices.

Companies need IAM to provide online security and to increase employee productivity.

• Security: Traditional security often has one point of failure - the password. If a user's password is breached - or worse yet, the email address for their password recoveries - your organization becomes vulnerable to attack. IAM services narrow the points of failure and backstops them with tools to catch mistakes when they're made.
• Productivity: Once you log on to your main IAM portal, your employee no longer has to worry about having the right password or right access level to perform their duties. Not only does every employee get access to the perfect suite of tools for their job, their access can be managed as a group or role instead of individually, reducing the workload on your IT professionals.

Identity management solutions generally perform two tasks:

1. IAM confirms that the user, software, or hardware is who they say they are by authenticating their credentials against a database. IAM cloud identity tools are more secure and flexible than traditional username and password solutions.
2. Identity access management systems grant only the appropriate level of access. Instead of a username and password allowing access to an entire software suite, IAM allows for narrow slices of access to be portioned out, i.e. editor, viewer, and commenter in a content management system.

Task of IAM:

• Manage user identities
• Provisioning and deprovisioning users
• Authenticating users
• Authorizing users
• Reporting
• Single Sign-On

SHORT ANSWER :