Light

Episode #943 Quiz

The Top 10 Cybersecurity Misconfigurations
Date: 2023-10-10 | Length: 2 hrs | Episode page at twit.tv

About this episode

NSA and CISA’s advisory lists ten common misconfigurations: default credentials, privilege separation failures, poor monitoring, no segmentation, weak patching, access-control bypasses, flawed MFA, permissive ACLs, poor credential hygiene, and unrestricted code execution. Recommended mitigations include hardening defaults, disabling unused services, automating patches, tightening admin accounts, and mandating phishing-resistant MFA.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the NSA/CISA advisory discussed in the episode, which misconfiguration is listed as number one on the Top 10 list?

Question 1

According to the NSA/CISA advisory discussed in the episode, which misconfiguration is listed as number one on the Top 10 list?

Weak or misconfigured multifactor authentication methods Default configurations of software and applications Improper separation of user and admin privileges Insufficient internal network monitoring

Question 2: What did the NSA and CISA recommend software manufacturers do regarding multifactor authentication in the advisory?

Question 2

What did the NSA and CISA recommend software manufacturers do regarding multifactor authentication in the advisory?

Offer MFA only after customers complete initial deployment Mandate phishing-resistant MFA for privileged users by default Restrict MFA to externally exposed applications only Replace MFA with device certificates for all accounts

Question 3: What mechanism did the episode say malicious actors can use when LLMNR and NetBIOS Name Service are enabled on a network?

Question 3

What mechanism did the episode say malicious actors can use when LLMNR and NetBIOS Name Service are enabled on a network?

DNSSEC key rollover abuse to redirect recursive resolvers Certificate forgery to bypass TLS client validation Spoofing and poisoning responses to obtain domain hashes OAuth token replay against cloud identity providers

Question 4: How did the episode describe the impact of Encrypted ClientHello on enterprise content filtering?

Question 4

How did the episode describe the impact of Encrypted ClientHello on enterprise content filtering?

It would not materially change it if the enterprise proxies TLS traffic It would force enterprises to disable all outbound TLS connections It would eliminate enterprise filtering unless DNS over HTTPS is disabled It would prevent enterprises from installing root certificates on managed devices

Question 5: What explanation did Steve give for why Matthew's 140-bit-entropy password would make PBKDF iteration count effectively irrelevant?

Question 5

What explanation did Steve give for why Matthew's 140-bit-entropy password would make PBKDF iteration count effectively irrelevant?

Its brute-force resistance dwarfs the added cost of extra iterations Its entropy forces attackers to use only online guessing Its length prevents any password hash from being computed at all Its randomness eliminates the need for any encryption algorithm

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.