stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Intro v4 - Exam Review Flashcards | StudBud
Explore
/
Intro v4 - Exam Review
Intro v4 - Exam Review
58 terms
·
StudBud Administration
·
657 plays
Imported from external platform
Flashcards
58 cards
F
Practice quiz
P
Host live
L
Questions
58
Answers
1
Which of the following is the correct equation for risk?
Asset + vulnerability + threat = risk
Vector + asset + credentials = risk
Confidentiality + integrity + availability = risk
Risk management + asset management = risk
2
What type of professional is hired by organizations to legally hack into their networks and identify weak entry points?
IT Auditor
Ethical Hacker
Cybersecurity Engineer
Defensive Cybersecurity Analyst
3
CANNOT be discovered in the course of a routine vulnerability assessment
File and directory permissions
Zero-day vulnerability
Kernel flaw
Buffer overflow
4
What is black hat hacking?
Giving someone a black hat
trolling a person or business for fun
Maliciously hacking a person or businesses network
Getting paid to find holes in someone's online security
5
During which phase of the cyber kill chain does the attacker gather information about a target?
Actions on objects phase
Exploitation phase
Reconnaissance phase
Installation phase
6
What is the first step you should take when hardening a Linux system?
Secure the bootloader.
Eliminate any unpatched software.
Determine server purpose and requirements
Install the latest updates.
7
SSID stands for?
Service suit identification
Service set identification
Singleplayer super intelligence defibrillator
Service station identification
8
What technique does an adversary use to gain knowledge about a system or network?
Recon
Initial Access
Lateral Movement
Discovery
9
Which technique does an adversary use to move between systems on a network?
Initial access
Reconnaissance
Discovery
Lateral movement
10
Which of the following network attacks causes a service to fail by flooding the target with traffic?
DoS
Exploit
Malware
On Path
11
What is the difference between an IP address and a MAC address?
An IP address is a physical address, while a MAC address is logical.
The router uses a MAC address, while a switch uses an IP address
A MAC address is a physical address. An IP address is a logical address
An IP (hardware) can't be changed but a MAC (hardware) can.
12
What is risk transfer?
same risks can be transferred to another company
assuming the cost of an uninsurable risk
ethics
principles
13
Which of the following is an example of a MAC address?
4309:FD21:ACB3:0012
192.17.2.1
http://www.comptia.org
00-00-00-1B-02-55
14
Which wireless encryption protocol is now considered insecure and should no longer be used?
CCMP
WPA2
WEP
WPA
15
A technique, whereby an attacker sends a fraudulent email message from a seemingly reputable source?
Baiting
Phishing
Tailgating
Pretexting
16
Which of the following controls allows for the creation of rules that allow or block traffic?
OpenDLP
iptables
CIS Benchmarks
ClamAV
17
Which network infrastructure type connects users and end devices located in a small area such as an office building?
PAN
MAN
WAN
LAN
18
What is Hydra used for?
To generate secure passwords for daily usage.
To configure security restrictions at enterprise networks.
To accomplish encryption and backup information.
To perform password cracking using brute-force attacks.
19
A Vulnerability Assessment
Finding reasons to spend money on cyber security tools
Looking at your network and assessing its vulnerabilities
Is a tool to see how awesome your network is
Hacking the network to find its vulnerabilities
20
Which team is responsible for providing security assessments that outline an organization’s system defense efficacy
Blue
Purple
Red
Green
21
What is the Open Web App Security Project (OWASP)?
A community-driven organization focused on application security
A government organization designed to promote secure data use and storage
University departments collected to work on secure coding
A private, for-profit organization dedicated to application security
22
Which of the following types of network attacks modifies or alters data?
Inactive attack
Active attacks
On path
Passive attacks
23
What type of information could include addresses, dates of birth, or social securitynumbers?
API
PII
SSN
Legal liability
24
Which of the following can be accomplished using a firewall?
take over the world
stop all possible attacks
route traffic based on source and destination MAC address
monitoring and filtering network traffic
25
Which is a true statement about the Windows Operating System?
It has a tree-like file system.
It has an open-source file system.
It has a folder-based file system.
It has a ring-topology file system.
26
Which duty is the primary focus of data loss prevention (DLP)?
Preventing unauthorized sharing of privileged information
Wiping company data from devices of employees as they leave the company
Stopping exfiltration of sensitive data during a breach
Deterring credential theft through layered obfuscation
27
What is the purpose of a demilitarized zone (DMZ)?
To separate internal networks from untrusted external traffic
To allow authenticated users to access the main router
To check the authenticity of self-signed certificates
To block all traffic within a network
28
Which of the following is not considered a factor of risk?
Convenience
Threat
Mitigation
Cost
29
Which of the following descriptions is included in the category of OS hardening?
The process of removing unused features from an operating system.
The process of updating an operating system to its latest version.
All of the above.
The process of improving the security of an operating system.
30
Which of the choices below best describes an attack resulting from an unknown vulnerability exploit.
Phishing
Zero-day attack
Same-day attack
Patching attack
31
Which term refers to the idea of moving security earlier in the SSDLC to avoid downstream bugs and vulnerabilities?
Safety first
Shift-left
lifecycle security
purple team
32
Which framework focuses on the offensive side of an attack rather than the defensive?
FISMA
NIST cybersecurity
Incident response lifecycle
MITRE ATT&CK
33
What does Windows Defender ATP proactively do in client hardening?
Automates routine tasks.
Analyze misconfigured endpoints.
Enhances network connectivity.
Set up a backup mechanism.
34
What is MAC address filtering?
A way of limiing who can access a network using IP adresses on a MAC
A way of limiing who can access a network using MAC adresses
APPLE's way of security
A 32-bit number that uniquely identifies a host
35
A global network connecting sites worldwide.
Extranet
Internet
Intranet
None of the above
36
What is application fuzzing?
A process for testing the end-user experience of a piece of software
Automated data is injected into an app to test response and security.
Half of the app’s code is encrypted to test the effects of ransomware
A string is injected and used to drop (delete) tables of sensitive data.
37
Which tool can be used to scan and map computers on a network?
Ettercap
nmap
Hydra
Ping
38
Which of the following is not considered a social engineering tactic?
Vishing
Pretexting
Phishing
Password Cracking
39
Which of the following terms is an example of a Linux distribution?
Kernel
Bootloader
Kali
Root
40
Which is a step toward increasing server security?
Disabling unneeded services to reduce the attack surface
Dumping your credential database to see how easy it is
Setting a unique internal clock time to confuse attackers
Deploying sleeper honeypots to DMZs for protection
41
What is a MAC address?
A unique address given to a computer on a network
A unique address given to the network interface card
42
What is the primary focus of generative AI?
Mimicking human cognitive abilities
Surpassing human intelligence across all cognitive abilities
Creating new content from existing data
Enhancing security measures and detecting threats
43
What is the purpose of the
ping
command?
To request connection to the file server
To obtain a dynamic IP address from the server
To test connectivity to other networks
To resolve the domain name to its IP address
44
Which Linux distro is packaged for information security tasks such as security research or penetration testing?
Ubuntu
Debian
Fedora
Kali
45
According to NIST, what is the primary objective of incident response (IR)?
Providing support services for the end user
Mitigating violations of security policies and recommended practices
Support the electrical team if there is a power outage
Minimizing weaknesses before the incident
46
Which targeted attack floods a network with false requests in an attempt to halt business operations?
SQLi
Phishing
On Path
DoS
47
Which term best describes actions taken to increase infrastructure security?
Subrogation
Layering
Hardening
Assimilation
48
A Kill Chain phase in which the attacker opens and maintains a communication channel between the target and the attacker
Exploitation
Reconnaissance
Installation
C2
49
Which of the following is not one of the three states of data?
Data in transit
Data under investigation
Data in use
Data at rest
50
Which goal of network security ensures that only intended recipients can read the data?
Confidentiality
Readability
Integrity
Availability
51
What are some potential impacts of a cybersecurity breach?
Financial loss due to theft or destruction ofdata
All of the above
Damage to reputation and loss of customer trust
Legal and regulatory penalties for non-compliance
52
What is data loss prevention (DLP)?
A network security service to block cyber-attacks.
A technique used to prevent unauthorized access to sensitive information.
A technique used to encrypt information.
A Microsoft service to share data between entities.
53
What are the three As of Security?
Accountability, Access control and Accounting
Authorization, Access Control and Audi Parking
Authentication, Authorization and Accounting
Authentication, Accountability and Acoustics
54
_________ uniquely identifies a network destination.
IP Table
Rules Table
MAC address
IP address
55
Which command is used to create a new directory in the LInux OS?
ls
cd
mkdir
touch
56
Which of the following is a likely cause of continued issues related to the EternalBlue CVE?
Weak password policies
Lack of proper threat intelligence
Unchecked insider threats
Poor patch management
57
How do breaches affect an organization?
Legal liability
Reputation loss
Financial impact
All of the above
58
Which of the following standards is most applicable to a company that utilizes any payment card for its operations?
HIPAA
GLBA
SOX
PCI-DSS
