stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Final review 1 Flashcards | StudBud
Explore
/
Final review 1
What is a process in Windows?
What does the strings command do?
Final review 1
86 terms
·
StudBud Administration
·
18 plays
Imported from external platform
Flashcards
86 cards
F
Practice quiz
P
Host live
L
Questions
86
Answers
1
What does the strings command do?
Detects malicious behaviour
Runs malware
Lists readable text in a file
Compresses malware
2
What is a process in Windows?
A file stored in the NTFS
Execution of a program with its resources
A DLL loaded into memory
A stolen thread in execution
3
Confidentiality ensures data is accessible during emergencies
.
False
True
4
What is a common limitation of signature-based IDS?
It cannot handle encrypted traffic.
It cannot monitor host activities.
It cannot detect unknown attacks.
It is resource-intensive.
5
What does Gobuster rely on to discover hidden directories or pages?
Scanning for vulnerabilities
Guessing user credentials
Using a list of potential page names
Analysing website traffic
6
Which section in a PE file contains executable code?
.text
.reloc
.rsrc
.data
7
What is the primary purpose of the Tor network?
To enhance web search results
To enable fast downloads
To host public servers
To enable anonymous communication
8
What is the last phase of the Incident Response process?
Recovery
Post-Incident Activity
Containment
Eradication
9
What is the name for a malicious script planted on a web server to maintain access?
Web shell
Worm
Rootkit
Trojan
10
What does the Containment phase focus on?
Removing the threat actor
Recovering from the incident
Stopping the incident from spreading
Analysing logs to set the scope
11
How can fileless malware be executed on a Windows system?
It requires downloading a malicious executable
It requires physical access to the target machine
It cannot be executed on Windows systems
It can be run through Windows PowerShell
12
What does DNS stand for?
Domain Network Service
Domain Name System
Domain Navigation System
Domain Name Service
13
What tool can help investigate privileged commands on a Linux system?
curl
top
syslog
netcat
14
What is the purpose of packing in malware?
To encrypt the payload
To make analysis difficult
To simplify the code
To increase propagation speed
15
How does Gartner assist in cybersecurity decision-making?
By running penetration tests
By developing security platforms
By providing expert research and strategic advice
By offering tools for risk management
16
What is NOT a common PE file section?
.exe
.text
.rdata
.rsrc
17
What does CTI stand for?
Cyber Threat Investigation
Cyber Threat Intelligence
Cyber Tactical Insights
Critical Threat Indicators
18
What type of account is NOT recommended due to increased security risks?
Shared accounts
Tier 0 admin accounts
User accounts
Privileged accounts
19
When securely transmitting files over a network, which protocol is ideal?
Telnet
SCP
FTP
HTTP
20
What should be done to detect bandwidth bottlenecks?
Change the router’s default credentials
Disable all non-essential services
Enable port forwarding
Monitor real-time traffic statistics
21
What is the primary objective of performing a port scan?
To circumvent security measures
To determine active services and open ports on a target system
To identify weaknesses in firewall configurations
To replicate denial-of-service conditions
22
What type of account should be used for daily tasks on a Windows machine?
Developer Account
Administrator
Guest Account
Standard Account
23
Which tool is commonly used for advanced static analysis?
Metasploit
Ghidra
Wireshark
Nessus
24
What is an example of a secure protocol?
HTTP
SSH
Telnet
FTP
25
What is John the Ripper primarily used for?
Encrypting files
Scanning networks
Analysing malware
Cracking hashes
26
Which phase of the CTI lifecycle involves providing insights to stakeholders?
Analysis
Direction
Dissemination
Feedback
27
What is the main goal of Incident Management (IM)?
Monitor live network traffic
Respond effectively to the incident's scope
Determine the technical details of an incident
Investigate malware behaviour
28
What role do logs play in incident identification?
They replace the need for an Asset Inventory
They provide data for analysis of suspicious activities
They prevent unauthorized access
They are used only after incidents are resolved
29
What is Process Explorer primarily used for?
Monitoring running processes
Encrypting malicious files
Debugging network connections
Deleting registry keys
30
Which framework maps adversary tactics and techniques?
STRIDE
DREAD
PASTA
MITRE ATT&CK
31
What tool is often used to create and manage reverse shells?
Fuff
OpenSSH
Socat
Nmap
32
What is the primary purpose of LUKS encryption?
Speed up disk read/write performance
Encrypt data for protection against physical theft
Prevent unauthorized software installation
Restrict access to specific applications
33
What is the role of Integrity in the CIA triad?
Ensures only authorized people access data
Detects and prevents unauthorized data alterations
Ensures services are accessible when needed
Blocks all access to sensitive data
34
Gathering public information about an organization on online forums is an example of OSINT
False
True
35
What additional capability does an Intrusion Prevention System (IPS) have compared to an IDS?
Detects suspicious activity
Encrypts all traffic
Blocks malicious activity
Analyses encrypted communications
36
Which step is NOT part of the phishing analysis phase?
Identifying sender and recipient
Extracting URLs and attachments from emails
Reimaging infected machines
Checking email metadata
37
What is an example of Defence-in-Depth?
Keeping sensitive documents offline
Using a single strong password
Combining firewalls, encryption, and user training
Only securing your email server
38
What is an imphash used for in malware analysis?
To analyse similar file permissions
To compare malware imports for similarity
To identify exact file duplicates regardless filename
To encrypt data with the most important hash
39
Which Nmap switch is used to detect the version of a running service?
-vV
-v
-sV
-O
40
What information can IP history tools provide about a domain name?
A historical list of IP addresses that the domain has been hosted on.
A real-time list of active subdomains under the domain.
A detailed report of DNS server configurations for the domain.
Only a list of current IP addresses used by the domain.
41
Which type of encryption uses one shared key for securing and unlocking data?
Hybrid Encryption
Symmetric Encryption
Asymmetric Encryption
Quantum Encryption
42
What does Threat Intelligence aim to understand?
Internet browsing behaviours
Adversaries and their tactics
Network bandwidth issues
The cost of cybersecurity solutions
43
What compliance standard might apply to a healthcare organization?
ISO27001
HIPAA
SOC2
PCI-DSS
44
What is the main goal of nation-state cyber threat actors?
Geopolitical objectives
Personal satisfaction
Financial gain
Random mischief
45
What is a potential indicator of malicious activity in log files?
Installation of a new printer.
Frequent use of backup commands.
High CPU usage.
Unusual use of elevated privileges.
46
Why is segmenting networks effective in limiting the spread of malicious software?
It isolates ransomware to specific segments
It reduces the ability of any malware to propagate
A)It blocks unauthorized software downloads
It prevents spyware from gaining access
47
How is an Ethical Hacker best described?
Someone authorized to test security systems for vulnerabilities
A hacker who avoids legal consequences but breaks cybersecurity laws
An individual claiming good intentions while hacking illegally
A person who repairs hardware without engaging in hacking
48
What does a SQL injection attack aim to achieve?
Unauthorized access to sensitive database data
To fix errors in the database schema
To install database patches
To make databases run faster
49
What is the primary focus of technical Threat Intelligence?
Understanding attacker motives
Examining adversary tactics
Analysing business risk
Assessing attack artefacts
50
What tactic involves impersonating employees to gain sensitive information?
Credential Dumping
Exploitation
Weaponization
Social Engineering
51
Why is a virtual machine recommended for malware analysis?
It encrypts malware samples
It speeds up malware execution
It provides internet access for malware
It isolates the malware from live systems
52
Which of the following accurately describes the purpose of a "dropper" in cybersecurity?
An email attachment to deceive users into opening malicious content
A type of software used to download and install malicious programs
A security protocol that is no longer effective in protecting systems
An exploit designed to take advantage of vulnerabilities in web browsers
53
A packet capture shows email addresses and passwords in plain text. What vulnerability does this indicate?
Outdated software patches.
Insufficient encryption standards.
Misconfigured open ports
Use of unsafe communication protocols
54
GRUB passwords prevent resetting root passwords from bootloader menus.
True
False
55
What is the primary purpose of the Cyber Kill Chain framework?
To identify and eliminate insider threats
To understand and defend against cyberattacks
To replace antivirus software with detailed Yara rules
To develop and spread ransomware
56
How do developers sometimes inadvertently expose vulnerabilities in web applications?
By using outdated software
By hosting applications on unsecured servers
By creating weak encryption
) By leaving sensitive comments in the code
57
How can fuzzy hashing help in cybersecurity?
By encrypting User-Agent strings
By matching similar files based on content
By generating new domain names
By detecting phishing campaigns
58
Which threat actor is ideologically motivated?
Hacktivists
Thrill-seekers
Cybercriminals
Insider threats
59
Which tool is best for inspecting auto-start programs on a system?
ProcDump
PsExec
Autoruns
Process Monitor
60
What type of malware attack targets as many devices as possible?
Network-Based Campaign
Targeted Campaign
Host-Based Campaign
Mass Campaign
61
What does "CVE-2019-6499" refer to?
A malware type
A vulnerability
An anti-malware tool
A bug bounty program
62
Which three elements form the triad of identification?
Alerts, Logs, and Evidence
People, Processes, and Technology
Incident Managers, Analysts, and Tools
Tools, Tactics, and People
63
Which of the following is unrelated to a cybersecurity education and awareness program for users?
Setting up an automated system to back up user files
Offering instructions on creating secure passwords
Educating users on how to identify phishing attacks
Hosting periodic security training sessions for employees
64
Which team uses malware analysis to hunt for Indicators of Compromise (IOCs)?
Incident Response
Threat Hunt Team
Threat Research Team
Security Operations Team
65
Deleting accounts that are no longer active or needed helps address the broken access control OWASP vulnerability.
False
True
66
What format is used for modern Windows authentication hashes?
SHA-256
MD5
NTLM
Whirlpool
67
What is a Risk in cybersecurity?
Likelihood and impact of a threat
A potential vulnerability in a system
Weakness in hardware or software
Any possible danger, regardless of likelihood
68
What technique allows malware to evade static analysis?
Long sleep calls
Obfuscation
Sandbox detection
File hashing
69
Which hashing algorithm is NOT cryptographically secure?
MD5
SHA-3
SHA-512
SHA-256
70
What is PowerShell?
A network monitoring tool
A Windows scripting language and shell
A Linux shell
A programming framework for Java
71
What does the "deny" keyword in a firewall rule do?
Logs unauthorized access attempts
Ignores the rule completely
Blocks traffic that matches the rule
Blocks traffic coming from untrusted sources
72
In STRIDE, what principle focuses on logging activity for accountability?
Tampering
Denial of Service
Elevation of Privileges
Repudiation
73
Which type of IPS detects and blocks traffic by identifying deviations from normal behavior?
Behaviour-based
Signature-based
Heuristic
Anomaly-based
74
What is the term for hard-coded sensitive data in applications?
Encryption
Obfuscation
Static information
Sandbox
75
The -T5 switch in Nmap sets the fastest timing template.
True
False
76
What does the auxiliary module in Metasploit do?
Exploits vulnerabilities
Provides additional functionality
Encodes payloads
Generates shell scripts
77
What activity involves analysing malware's assembler code with tools like debuggers?
Reverse engineering
Malware creation
Social engineering
Decryption
78
What is the first step in ensuring an organization's cybersecurity?
Upgrading all computers
Disabling the internet
Maintaining an asset inventory
Monitoring employee emails
79
What type of data does PCI DSS primarily protect?
Personal identifiable information
Cardholder data (CHD)
Healthcare records
Intellectual property
80
What kind of Cyber Threat Intelligence (CTI) supports creating defence strategies and automated tools?
Operational
Technical
Strategic
Tactical
81
What is the primary purpose of information security governance?
To manage, direct, and protect information assets
To handle cyber incident responses exclusively
To enforce industry compliance laws
To replace existing policies with new ones regularly
82
Static Analysis involves analysing malware without executing it.
False
True
83
What does the | operator do?
Loops through output
Ends a script
Passes the output of one command as input to another
Combines two commands into one
84
Which of these methods is effective for identifying malicious activity executed via PsExec?
Analysing packets, Crafting signatures, Performing reverse engineering
Binary metadata, Registry modifications, Named pipes
Hash comparisons, Detecting malware obfuscation, Verifying file integrity
Dynamic scans, Network traffic capture, Anti-debugging
85
What kind of malware manages a network of infected devices and executes tasks from a central server?
Adware
Rootkit
Botnet
Worm
86
What is Python primarily used for in cybersecurity?
Running firewalls
Scripting tools and automating tasks
Hacking wireless networks
Replacing antivirus software
