Questões de Concurso

A figura abaixo apresenta uma arquitetura de rede com firewall. DMZ refere-se a uma DeMilitarized Zone ou zona desmilitarizada.

Um Técnico, observando a figura, afirma corretamente que

The purpose of most backup policies is to create a copy of data so that a particular file or application may be restored after data is lost, corrupted, deleted or a disaster strikes. Thus, backup is not the goal, but rather it is one means to accomplish the goal of protecting data. Testing backups is just as important as backing up and restoring data. Backup applications have long offered several types of backup operations. Two of the most common backup types are described below.

I. This operation will result in copying only the data that has changed since the last backup operation of any type. The modified time stamp on files is typically used and compared to the time stamp of the last backup. Backup applications track and record the date and time that backup operations occur in order to track files modified since these operations. Because this backup will only copy data since the last backup of any type, it may be run as often as desired, with only the most recent changes stored.

II. This type of backup makes a copy of all data to another set of media, which can be tape, disk or a DVD or CD. The primary advantage to performing this backup during every operation is that a complete copy of all data is available with a single set of media. This results in a minimal time to restore data, a metric known as a Recovery Time Objective (RTO).

The backup types I and II are, respectivelly,

Consider the statements below.

I. It is defined as a procedure requiring the combination of several factors, including at least two of the following: Knowledge-something the user knows, e.g., a password, a personal identification number (PIN); Ownership-something the user has, e.g., token, smart card, mobile phone/SIM; Inherence − something the user is, e.g., fingerprint. It is worth highlighting that the aforementioned requirement of having mutually independent factors could be difficult to match. In fact, in the context of access to Internet services, when using ownership and inherence factors as well as when inputting a PIN or password, the user transmits digital data to the verifying counterpart, so that regardless of the generating factor, susceptibility to interception is a common vulnerability.

II. Security administration can be costly and prone to error because administrators usually specify access control lists for each user on the system individually. With this kind of control, security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Security administration with it consists of determining the operations that must be executed by persons in particular jobs, and assigning employees to the proper roles. Complexities introduced by mutually exclusive roles or role hierarchies are handled by its software, making security administration easier.

The statements I and II refers respectively to

Batizada de Drown, a séria vulnerabilidade descoberta afeta HTTPS e outros serviços que dependem de SSL e TLS, alguns dos protocolos mais essenciais para segurança na internet. O Drown aproveita que na rede, além de servidores que usam TLS por padrão, há outros que também suportam ........ e, explorando a vulnerabilidade do protocolo antigo, podem quebrar a criptografia do padrão TLS. Em testes realizados pelos pesquisadores, um PC normal foi capaz de quebrar a criptografia TLS em um servidor vulnerável em menos de 1 minuto. Durante um período, os pesquisadores realizaram uma ampla varredura na internet e descobriram que 33% de todo tráfego HTTPS pode estar vulnerável ao ataque Drown. É importante ressaltar que a quebra da criptografia depende também da capacidade de monitorar o tráfego TLS, mas isto é facilmente realizável em redes públicas ou a partir da invasão da rede tanto no lado do cliente como do lado do servidor. Como a vulnerabilidade está do lado do servidor, não há nada que possa ser feito no lado do cliente, que nem fica sabendo que o ataque está acontecendo.

(Disponível em: https://blog.leverage.inf.br/2016/03/01/drown-attack-nova-vulnerabilidade-no-tls/. Acessado em: 03 jul.2017)

Ao ler esta notícia, da qual foi omitido o protocolo de segurança, um Analista Judiciário concluiu, corretamente, que