The aim of trend analysis can be defined as…

Detecting patterns by analysing data

What is the purpose of DNS Sinkholing?

Block and redirect malicious domain traffic

What is the primary role of network devices in a network?

To filter, transfer, and manage data across networks

What is a tabletop exercise?

A theoretical discussion of security scenarios

Why should organizations pay attention to insider threats

They may lead to significant financial and reputational damage.

What best describes a network artifact?

Custom User-Agent strings or HTTP requests

What is one advantage of CAPA?

It automates the reverse engineering process.

Why is post-incident activity critical?

It identifies lessons to improve future responses

What is the purpose of NSE's "vuln" script category?

To detect vulnerabilities in services

What is the main goal of compliance in information security?

To align with legal, regulatory, and industry standards

What is a Dynamic Link Library (DLL)?

A library of reusable code and data for programs

What should you do if you suspect ARP poisoning on your system?

Look for duplicate MAC addresses

What is a Command and Control (C&C) server?

A server that issues instructions to malware

What is static analysis in malware analysis?

Analysing malware without running it

What is the purpose of packing in malware?

To obfuscate code and hinder analysis

How do IR playbooks differ from the Incident Response process?

Playbooks provide specific, detailed actions for use cases

What are default credentials in security contexts?

Common login details often left unmodified.

What distinguishes DOM-based XSS from other types like reflected and stored XSS?

Occurs in the client-side DOM and does not involve server responses

How is Privilege Escalation defined?

A process for bypassing restrictions to access higher-level resources.

Why is it essential to revert the VM to a clean state after analysis?

To remove malware traces from the VM

What does a disassembler do?

Converts machine code into assembly language

What is the primary benefit of implementing LDAP signing in AD?

Prevents replay and MiTM attacks

studbud

Final review 3

86 termsStudBud Administration20 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
Kerberos use ticket-based authentication with symmetric key cryptography.
True
False
2
The aim of trend analysis can be defined as…
Analysing the most used cybersecurity tools
Detecting patterns by analysing data
Discovering new resources for SOC
Fixing a baseline
3
Packed malware often shows random garbage strings during static analysis.
True
False
4
Which of the following is a Windows-based malware analysis VM?
FLARE VM
REMnux
Ubuntu
Kali Linux
5
How many "well-known" ports exist in networking standards?
2048
256
1024
512
6
What is the purpose of DNS Sinkholing?
Allow connections to suspicious domains
Block and redirect malicious domain traffic
Improve network bandwidth
Capture credentials from phishing websites
7
What is the primary role of network devices in a network?
To route data between different networks
To filter, transfer, and manage data across networks
To serve as user endpoints backups
To act as storage devices for business
8
What is a tabletop exercise?
A physical simulation of an attack
A software development session
A security audit
A theoretical discussion of security scenarios
9
Which Boolean operator requires both conditions to be true?
XOR
AND
NOT
OR
10
Why should organizations pay attention to insider threats
Only large companies with intellectual property are impacted.
They may lead to significant financial and reputational damage.
They are rare and can be ignored.
Insiders are inherently trustworthy and not a risk.
11
What best describes a network artifact?
A fixed IP address used for communication
Custom User-Agent strings or HTTP requests
Malware-related strings stored in a browser cache
A domain associated with phishing activities
12
What is one advantage of CAPA?
It requires expert knowledge of reverse engineering.
It focuses only on network analysis.
It automates the reverse engineering process.
It runs malware in a live environment.
13
Which type of authentication provides the highest level of security?
Biometric authentication
Single-factor authentication
Password-based authentication
Multi-factor authentication
14
Why is post-incident activity critical?
It ensures backups are secure
It reviews compliance with legal standards
It allows systems to be fully restored
It identifies lessons to improve future responses
15
What is the purpose of NSE's "vuln" script category?
To brute-force credentials
To evade firewalls
To query services for information
To detect vulnerabilities in services
16
What does the term IOC stand for?
Internal Operational Center
Indicators of Compromise
Intrusion Observation Chart
Internet Operations Control
17
What does the Nmap switch -sS represent?
UDP Scan
Service Detection
Aggressive Scan
SYN Scan
18
Confidentiality ensures only authorized parties can access data.
True
False
19
What command is used in Linux to extract readable text from a file?
strings
find
echo
grep
20
What is the main goal of compliance in information security?
To create baselines for system performance
To implement SIEM systems for monitoring
To align with legal, regulatory, and industry standards
To reduce the cost of cyber incidents
21
Which tool helps view real-time changes on a webpage?
Network Tab
Debugger
View Source
Inspector
22
What principle ensures that data remains accurate and consistent in the CIA Triad?
Integrity
Reliability
Confidentiality
Availability
23
Powershell scripts use the .ps1 file extension.
True
False
24
What is a Dynamic Link Library (DLL)?
A file for storing dynamic user preferences
A library of reusable code and data for programs
A memory allocation unit that changes it size
A process that runs in the background
25
Which tool is best suited for capturing and analysing network packets to investigate traffic from external sources?
Nessus
Wireshark
Netstat
Nmap
26
Which HTTP header attribute helps secure cookies against theft?
HTTPOnly
Secure-Cookie
Content-Encryption
X-Frame-Options
27
Which type of IDS needs frequent updates for new threats?
Signature-based IDS
Rule-less IDS
Anomaly-based IDS
Behaviour-based IDS
28
Which of the following tools is BEST suited to identify all active inbound connections on a Linux web server?
netcat
nmap
netview
netstat
29
What type of content in Microsoft Office documents can run computer commands?
Spreadsheets
Charts
Images
Macros
30
What is the first phase in the NIST Incident Management Framework?
Eradication
Preparation
Containment
Detection and Analysis
31
IP addresses and hashes fall under which type of threat intelligence?
Technical
Operational
Strategic
Tactical
32
What should you do if you suspect ARP poisoning on your system?
Delete the Hosts file
Look for duplicate MAC addresses
Install a VPN
Enable SMB protocol
33
What is a Command and Control (C&C) server?
A data storage model
A web hosting platform
A server that issues instructions to malware
A tool for network defence
34
What is static analysis in malware analysis?
Analysing malware without running it
Analysing malware by running it
Disassembling malware
Monitoring network activity
35
What principle states that users should have only the permissions needed for their tasks?
Principle of Least Privilege
Zero Trust
Role-Based Access Control
Defense in Depth
36
What is the purpose of packing in malware?
To obfuscate code and hinder analysis
To reduce file size
To improve compatibility
To enhance performance
37
How do IR playbooks differ from the Incident Response process?
The IR process is only for low-severity incidents
The IR process focuses only on technology
Playbooks are less detailed than the IR process
Playbooks provide specific, detailed actions for use cases
38
What are default credentials in security contexts?
Randomly generated passwords for admin accounts
Common login details often left unmodified.
Predefined username-password pairs for secure access.
Hardcoded encryption keys
39
What distinguishes DOM-based XSS from other types like reflected and stored XSS?
Happens only when interacting with local scripts
Is easier to detect with firewalls compared to reflected and stored XSS.
Occurs in the client-side DOM and does not involve server responses
Relies on client-side processing; others use server-side input.
40
Which of these is NOT a responsibility of a penetration tester?
Testing for vulnerabilities
Reporting findings to the company
Exploiting security weaknesses
Fixing the vulnerabilities
41
Which Nmap command can be used to scan IP addresses across a specified range?
nmap -list 192.168.1.0/16
nmap -target 192.168.1.0/16
nmap 192.168.1.0-50
nmap range 192.168.1.0-50
42
How is Privilege Escalation defined?
Preventing unauthorized users from accessing a system
A)Securely encrypting credentials in a database
A method of locking down sensitive system areas
A process for bypassing restrictions to access higher-level resources.
43
Why is it essential to revert the VM to a clean state after analysis?
To reduce memory usage
To increase analysis speed
To analyse the same malware again
To remove malware traces from the VM
44
Which password policy setting ensures users cannot reuse recently used passwords?
Minimum password length
Account lockout policy
Password complexity requirements
Enforce password history
45
What is Shodan.io used for?
Searching for IoT devices
Managing cloud data storage
Performing antivirus scans
Encrypting sensitive files
46
What does a disassembler do?
Encrypts binaries for secure sharing
Executes code in a Debian sandbox
Compiles high-level code and encode it
Converts machine code into assembly language
47
What is the main goal of Offensive Security?
Find vulnerabilities
Defend against cyberattacks
Build secure systems
Monitor network traffic
48
What does loT refer to?
Intranet of Things
Instance of Things
Internet of Things
Input of Things
49
What feature should be disabled to prevent persistent access by attackers?
Secure protocols
Startup scripts
Logging
Multi-Factor Authentication
50
What is the main use of hashing in malware analysis?
Encrypting malware
Running malware
Analyzing network traffic
Identifying unique files
51
What is the primary benefit of implementing LDAP signing in AD?
Enforces default settings
Allows plain-text communication
Disables access to legacy systems
Prevents replay and MiTM attacks
52
Which analysis method involves executing malware to observe its behaviour?
Host-Based Analysis
Dynamic Analysis
Network-Based Analysis
Static Analysis
53
Zero-day vulnerabilities are unknown to software vendors.
False
True
54
How does a man-in-the-middle attack compromise communication?
By intercepting or modifying the data flow between a sender and a receiver
By tampering with data directly at the origin
By hacking the recipient's system to access messages
By launching a direct attack on the sender's device
55
What does the CIA triad stand for in cybersecurity?
Cybersecurity, Integrity, Access
Confidentiality, Integrity, Authentication
Confidentiality, Intelligence, Availability
Confidentiality, Integrity, Availability
56
What does the term "elevated privileges" mean?
Accessing system logs.
Running commands as a team manager.
Installing software updates.
Running commands with root permissions.
57
Which protocol is a secure alternative to FTP?
HTTP
NFS
TFTP
SFTP
58
What is the primary objective of the "Recovery" phase in Incident Response?
Train employees on security policies
Contain the threat
Identify root causes of the breach
Return systems to business as usual
59
What is an attacker’s primary goal during the Defense Evasion phase?
Avoid detection by security measures
Disrupt business operations
Steal credentials
Escalate privileges
60
What can enhance the effectiveness of the identification phase?
Expanding all alert thresholds
Regular system backups
Deploying firewalls at every network endpoint
Continuous learning and vigilance among staff
61
What does the Bell-LaPadula model emphasize?
Possession
Confidentiality
Availability
Integrity
62
Phishing is a type of…
Physical security
Software vulnerability
Social engineering
Cyberstalking
63
What happens to customer confidence after a data breach?
It becomes more loyal due to remediation efforts.
It decreases significantly.
It remains unaffected.
It increases due to transparency.
64
Which option does NOT fall under the category of intellectual property?
Copyright
User passwords
Patents
Trademarks
65
Which classification of Threat Intelligence examines an adversary's motives?
Strategic Intel
Technical Intel
Operational Intel
Tactical Intel
66
What is the name of the commonly used wordlist included with John the Ripper?
rockyou.txt
passlist.txt
common.txt
SecList
67
What is the opposite of the CIA concept of Integrity?
Alteration
Destruction
Disclosure
Possession
68
The MITRE ATT&CK framework focuses on scoring risks numerically.
True
False
69
It is possible to reverse a hashed value to retrieve the original input.
True
False
70
Which log file lists authentication attempts on Debian-based systems?
/var/log/secure
/var/log/messages
/var/log/kern.log
/var/log/auth.log
71
Which are the common categories of Cross-Site Scripting (XSS) attacks?
Injection, Spoofing, Redirects
Phishing, CSRF, Malvertising
Reflected, Stored, DOM-based
Stored, Token-based, URL-based
72
What is the primary goal of threat modelling?
To create attack scenarios for testing
To identify, prioritise, and address security threats
To audit organisational compliance
To test firewalls and intrusion detection systems
73
What is the Tor Browser primarily used for?
Anonymous browsing
Faster web access
Watching movies
Running phishing campaigns
74
What is the primary reason malware uses obfuscation?
To improve execution speed
To facilitate propagation
To encrypt communications
To avoid detection and analysis
75
Which Sysinternals tool logs system activity in real-time?
ProcMon
BgInfo
PsExec
WinObj
76
What is the first step in a malware attack process?
Delivery
Persistence
Execution
Propagation
77
What is the purpose of a sandbox in malware analysis?
Isolating malware execution
Cleaning malware
Deleting malicious files
Encrypting data
78
What is a commonly used resource for locating dark web pages, such as sites offering fake IDs?
Maltego
Dark Web Index
Tor Wiki
Hidden Wiki
79
Which section in PE files contains imported libraries and APIs?
.text
.rdata
.reloc
.rsrc
80
What is the main purpose of the Installation phase?
Establishing persistence
Escalating privileges
Scanning for vulnerabilities
Delivering the payload
81
Which phase includes exploiting vulnerabilities to gain unauthorized access to a system?
Actions on Objectives
Exploitation
Installation
Actions on Objectives
82
What does Gobuster use to perform brute force enumeration?
Wordlists
AI models
Algorithms
Database queries
83
The Biba model focus on preserving integrity in the CIA triad.
True
False
84
What is the primary purpose of OSINT in online investigations?
To access restricted databases
To gather publicly available information for analysis
To monitor social media accounts
To exploit vulnerabilities
85
What is a Yara rule?
A debugger for executing malware in Windows
A utility for generating malware hashes during analysis
A file scanner for detecting viruses before downloading
A pattern-matching tool for identifying malware behaviours
86
Which SQL injection command retrieves the DBMS version?
'show dbms version() -- '
'get dbms version() -- '
'display version() -- '
'union select version() -- '

Final review 3 Flashcards | StudBud