Question

A vendor has asked a company to run an agent that collects and transmits log data from a faulty server. A security engineer has been engaged and is concerned about running the agent on the given server because the server contains sensitive business data.

Before running the agent, which of the following methods would BEST ensure sensitive data does not leave the network? (Select TWO)

1. Fuzzing
2. Log Analysis
3. HTTP MITM
4. Reverse Engineering
5. Protocol Analysis
6. Penetration Testing

PLEASE PROVIDE AN EXPLANATION FOR THE 2 OPTIONS SELECTED AND WHY THE OTHER OPTIONS ARE NOT CORRECT FOR UPVOTE - THANK YOU

Answer 1

be

The TWO methods which are selected among following methods are Log Analysis and Protocol Analysis

because ,Data stored in logs contains information like IP addresses, client/server requests, HTTP status etc. With proper analysis, also you can track down suspicious requests and system vulnerabilities and set  configuration parameters accordingly that protect you from similar future threats. Log analysis software can alert you via email or any other source  whenever a suspicious activity (ex-a login attempt from outside your trusted network) happens

A protocol is a standard procedure for regulating data transmission between computers. Protocol analysis is the process of examining those procedures. The way we go about this analysis is with special tools .protocol analysis techniques are to understand the procedures occurring on your network.

Fuzzing cannot be used as it is less effective in dealing security threats like  viruses, Trojan, etc.( that do'nt create program crashes) and it  can only detect simple threats.also it require significant time to perform a task.It ensures that the application is robust and secure, but do not ensure sensitive data does not leave the network . It is exploitable by hackers including unhandled exceptions, crashes,etc

penetration testing are not done properly, they can cause a lot of damage. Tests that are not carried out properly can crash servers, data, corrupt,expose , or cause adverse effects.

reverse engineering only supports finding faults in the product and  to ensure the safety and well-being of the product's users. but do not ensure sensitive data does not leave the network

A Man in the Middle attack, or MITM, is a situation in which malicious entity can read or write data that is being transmitted between two or more system In a MITM attack, the attacker may use one of the many possible ways to split the TCP connection into two separate connections. One is client and the attacker, whereas the second connection is between  attacker and the web server.Hence attacker can read and write sensitive data easily.