What does "Risk" refer to in cybersecurity?

Chance a threat exploits a vulnerability

What is the primary focus of the PASTA threat modeling framework?

Viewing the application from an attacker's perspective

What is the primary focus of the MITRE D3FEND™ framework?

Defensive countermeasures for offensive techniques

What is the purpose of the Common Vulnerability Scoring System?

Standardize vulnerability scores

What is a zero-day exploit?

Exploiting a newly discovered flaw

What does the CIA triad stand for?

Confidentiality, Integrity, Availability

What is the main focus of ISO 27001?

Information security management

What is Proprietary Intelligence in cybersecurity?

Information collected by an organization's internal resources

What is the purpose of threat intelligence in cybersecurity

Process of gathering, analyzing and understanding threats

What are the three key factors used to characterize adversarial threat sources or actors?

Capability, intent, opportunity

What does "Non-Repudiation" mean in cybersecurity?

Protection against individual falsely denying performing particular actions

studbud

Duplicate of Block III Quiz Review

75 termsStudBud Administration2 plays

F-0303L + F-0302L + F-0301L

Flashcards75 cardsFPractice quizPHost liveL

Questions 75

Answers

1
What does "Risk" refer to in cybersecurity?
The type of attack
Process of encrypting information
The level of security
Chance a threat exploits a vulnerability
2
What does cybersecurity primarily protect?
Human resources
Financial data
Physical assets
Cyberspace
3
What is the main focus of the CIA triad?
Network monitoring
Data protection
Software development
User training
4
Which intelligence source uses electronic signals?
OSINT
CSINT
SIGINT
HUMINT
5
True or False? A threat event is a situation that has the potential to cause an impact.
False
True
6
Which method profiles hypothetical attackers?
PASTA
D3FEND
Persona non grata
COBIT
7
Who is the audience for tactical intelligence?
General public
Board members
Executives
SOC analysts
8
What is the goal of risk mitigation?
Enhance attack methods
Increase vulnerabilities
Reduce potential losses
Limit user access
9
Which framework focuses on IT governance and management?
MITRE ATT&CK
COBIT
NIST CSF
PASTA
10
Which step of the Cyber Threat Intelligence Lifecycle focuses on gathering information?
Processing
Direction
Collection
Feedback
11
Which threat actor is known for ethical hacking?
Grey Hat
Black Hat
White Hat
Red Hat
12
True or false: Cyber Kill Chain describes the attack process.
True
False
13
What is the primary focus of the PASTA threat modeling framework?
Automating threat detection processes
Viewing the application from an attacker's perspective
Ensuring compliance with security standards
Developing software without vulnerabilities
14
What is a common motivation for cybercriminals?
Political change
Financial gain
Personal satisfaction
Ideological beliefs
15
What is the primary focus of the MITRE D3FEND™ framework?
Defensive countermeasures for offensive techniques
Developing new offensive techniques
Automating cybersecurity processes
Cyber adversary behavior
16
What does the Cyber Kill Chain emphasize?
Increasing bandwidth
Encrypting all data
User training
Disrupting attack steps
17
What is the benefit of combining intelligence methods?
Comprehensive understanding
Resource saving
Risk reduction
Limited overview
18
What is the purpose of the Common Vulnerability Scoring System?
Develop software applications
Monitor network traffic
Create user accounts
Standardize vulnerability scores
19
What is the role of the Intelligence, Surveillance, and Reconnaissance Division (ISRD)?
Software development
Cyber training
Threat analysis
Intelligence C2
20
What is the purpose of MITRE ATT&CK?
Monitor user activity
Increase bandwidth
Encrypt all data
Understand attacker methods
21
Which intelligence method is riskier due to directly engaging with the target?
Human
Active
Passive
Technical
22
What does AFOSI conduct?
Cyber training
Threat analysis
Criminal investigations
Software development
23
True or false: Threat modeling is a linear process.
True
False
24
What is a zero-day exploit?
A common attack method
Exploiting a newly discovered flaw
An outdated system
A type of malware
25
Which is NOT a NIST CSF Core function?
Protect
Recover
Monitor
Identify
26
What does the 'Mitigate' function in CSF involve?
Identify risks
Govern policies
Recover from incidents
Apply cybersecurity safeguards
27
What does the CIA triad stand for?
Confidentiality, Integrity, Availability
Control, Information, Availability
Confidentiality, Identity, Access
Control, Integrity, Access
28
What does the term 'threat actor' refer to?
A company that sells security software
A malicious individual
A computer malware
A team that protects systems
29
What does the 'Protect' function in NIST CSF do?
Detects incidents
Implement security safeguards
Restores operations
Assesses risks
30
What does the intelligence cycle help with?
Data analysis
Software development
Network setup
User feedback
31
What is the main goal of threat modeling?
Reduce hardware costs
Strengthen cybersecurity
Increase network speed
Expand user access
32
Which scoring system rates vulnerabilities?
CVSS
STRIDE
PASTA
COBIT
33
Which Threat Modeling method utilizes an open-source matrix tool that integrates assets, rules, and actors?
STRIDE
Trike
COBIT
Cyber Kill Chain
34
What is the impact of a cyberattack?
Improved defenses
Loss of data
Enhanced performance
Increased security
35
What does CSINT identify?(Closed Source Intelligence)
Simple threats
User feedback
Network logs
Advanced threats
36
What is the main focus of ISO 27001?
Information security management
Hardware upgrades
Network speed
User training
37
What is Proprietary Intelligence in cybersecurity?
Data gathered from external threat feeds
Publicly available intelligence reports
Information collected by an organization's internal resources
External Network logs
38
What types of assessments does the National Air and Space Intelligence Center (NASIC) conduct?
Foreign cyberspace
Network logs
Software bugs
Local threats
39
What is the purpose of threat intelligence in cybersecurity
Automating cybersecurity defenses
Process of gathering, analyzing and understanding threats
Responding to cyber threats in real time
Identifying vulnerabilities in software
40
What activities are involved in Human Intelligence (HUMINT) gathering?
Signal interception
Network monitoring
Human sources
Technical analysis
41
What does threat research enhance?
Threat data and intelligence
User training
Software development
Network monitoring
42
What is the purpose of penetration testing?
Develop software applications
Measure system strengths
Monitor network traffic
Create user accounts
43
What are the three key factors used to characterize adversarial threat sources or actors?
Expertise, damage, and targeting
Resources, tools, and timing
Malware, exploits, and vulnerabilities
Capability, intent, opportunity
44
Which of the following is a common attack vector?
Firewall
Encryption
Backup
Malware
45
True or false: Cybersecurity is only for large organizations.
False
True
46
Which intelligence source is publicly available?
TECHINT
HUMINT
CSINT
OSINT
47
What is an example of a passive attack?
Malware deployment
Data interception
Direct system modification
Physical access
48
What is strategic intelligence focused on?
Technical details
High-level overview
Real-time data
Human sources
49
What does "Non-Repudiation" mean in cybersecurity?
Preventing unauthorized access to data
Protection against individual falsely denying performing particular actions
Ensuring data is encrypted during transmission
Regularly backing up data
50
What is the purpose of authentication?
Monitor network traffic
Encrypt data
Verify user identity
Store sensitive information
51
Which step comes first in the Threat Modeling Process?
Validate controls
Define assets
Visualize pathways
Mitigate threats
52
What does operational intelligence provide?
Technical analysis
Human insights
Long-term trends
Real-time information
53
What is technical intelligence focused on?
High-level overview
Detailed analysis
Human sources
Real-time data
54
What is a vulnerability in cybersecurity?
A system flaw
A threat actor
A strong defense
A security measure
55
What does the 'Identify' function in CSF do?
Recover from incidents
Implement security safeguards
Recognize risks
Govern policies
56
True or false: The CIA triad includes Confidentiality, Integrity, and Availability.
True
False
57
What is a key feature of attack trees?
No visualization
Focus on hardware
Single entry point
Multiple attack paths
58
What does the NIST Cybersecurity Framework focus on?
Data encryption
User training
Cybersecurity risk management
Risk assessment
59
Which term describes malicious activities against systems?
Cyber threat
Cyber defense
Cyberattack
Cybersecurity
60
Which attack vector involves overloading a system?
Phishing
Malware
SQL Injection
Denial-of-Service
61
What does the intelligence cycle adapt to?
Organizational needs
User feedback
Software bugs
Network logs
62
What does the 'Detect' function in CSF involve?
Govern policies
Implement security controls
Recognize cybersecurity events
Establish risk management
63
True or false: All hackers have malicious intent.
True
False
64
What does the 'Recover' function in CSF ensure?
Identifies risks
Implements security safeguards
Restores operational capabilities
Governs policies
65
What capability does the 616th OC provide?
Cyber training
Software development
Operational C2
Threat analysis
66
True or false: Passive intelligence requires more resources.
True
False
67
What is the goal of a cyberattack?
To disrupt operations
To improve systems
To gather intelligence
To enhance security
68
Which threat actor focuses on countering cyber threats?
Red Hat
Black Hat
White Hat
Green Hat
69
What does the 'Govern' function in CSF establish?
Network monitoring system
User training program
Risk management strategy
Incident response plan
70
What does feedback improve?
User feedback
Network logs
Software bugs
Intelligence cycle
71
What is the purpose of the 'Dissemination' step?
Information distribution
Threat analysis
Feedback provision
Data collection
72
What does the STRIDE method analyze?
User satisfaction
Hardware costs
Threat types
Network speed
73
What does TECHINT provide?
Technical insights
High-level overview
Human insights
Real-time data
74
Which process simulates attacks for testing?
Data backup
Governance review
Penetration testing
Risk assessment
75
True or false: Insider threats can be unintentional.
True
False

Duplicate of Block III Quiz Review Flashcards | StudBud