stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
MSOE Cybersecurity Exam 1 Flashcards | StudBud
Explore
/
MSOE Cybersecurity Exam 1
3 MFA types?
Example of Symmetric Encryption?
MSOE Cybersecurity Exam 1
169 terms
·
StudBud Administration
·
4 plays
Imported from external platform
Flashcards
169 cards
F
Practice quiz
P
Host live
L
Questions
169
Answers
1
Example of Symmetric Encryption?
SHA
TLS
AES
RSA
2
3 MFA types?
See, Touch, Hear
Know, Have, Are
Password, PIN, Code
Device, App, Email
3
Europe’s equivalent to CISA?
ISO
ENISA
NIST
CAC
4
Network Segmentation uses?
Firewalls only
Single IP range
Subnets/VLANs to avoid flat network
Encryption layers
5
What is BEC?
Basic Encryption Crack
Business Email Compromise
Backup Error Correction
Breach Event Control
6
IAAA stands for?
Inspect, Attack, Alert, Adapt
Ident, AuthN, AuthZ, Audit
Install, Assess, Authorize, Act
Identify, Alert, Assess, Audit
7
Secure coding avoids validating user inputs.
False
True
8
Types of AES?
AES128, AES192, AES256
AES256 only
AES64, AES128, AES512
AES1, AES2, AES3
9
Pen testing tool?
Splunk
Proofpoint
Kali Linux
Drata
10
Black Box testing means?
No knowledge of environment
Random guessing
Some knowledge
Full knowledge
11
MITRE ATT&CK focuses on?
Attacker tactics/techniques
Hardware flaws
Defender tactics
App vulnerabilities
12
OSI Model mnemonic?
Please Do Not Throw Sausage Pizza Away
Packets Do Navigate Through Systems Perfectly
Please Design Networks To Secure Private Access
People Don’t Need To See Packets Always
13
Type of XSS impacting all users?
Dynamic
Stored
Reflected
encrypted
14
OWASP Top-10 includes Injection as a vulnerability
True
False
15
What do IDS/IPS do?
Back up data
Detect and prevent break-ins
Encrypt traffic
Monitor power
16
CISA is part of the US Dept of Homeland Security.
False
True
17
Supply Chain Attacks target?
Internal servers
Vendors/third-parties
End users
Firewalls
18
WPA3 encryption standard?
AES
DES
SHA
RSA
19
Defense in Depth uses multiple security layers
False
True
20
What is the Purple Team?
Blend of Blue and Red teams
External hackers
Log analysts
Hardware engineers
21
Most common injection type?
SQL Injection
CSS Injection
HTML Injection
XSS Injection
22
Asymmetric encryption is faster than symmetric.
True
False
23
What does CIA Triad stand for?
Control, Inspect, Attack
Capture, Interfere, Alter
Create, Integrate, Access
Confidentiality, Integrity, Availability
24
What is Risk?
A protective measure
Threat + vuln causing unwanted outcome
A security event
An asset’s strength
25
Quantum-resilient algorithm?
ML-KEM
AES128
SHA
RSA
26
What does DAD Triad stand for?
Data, Access, Delete
Disclosure, Alteration, Denial
Deny, Alter, Disclose
Detect, Attack, Defend
27
Traditional AV vs Next-gen AV?
Old vs new
Free vs paid
Hardware vs software
Signature vs behavior + ML
28
Examples of PII include?
Company patents, secrets
Medical records, diagnoses
SSN, Birth Dates, Student IDs
Credit card numbers, PINs
29
OSI Layer 4?
Transport (datagrams, TCP/UDP)
Session (connection)
Network (IP)
Application (use)
30
What is SOAR?
Software Oversight & Repair
Secure Online Access Rules
System Operations & Recovery
Security Orchestration & Response
31
What is IAM?
Internal Audit Monitoring
Intrusion Alert Management
Internet Attack Mitigation
Identity Access Management
32
What is DevSecOps?
Security in DevOps (Agile/CI/CD)
Design Security Only
Security in Waterfall
Developer Security Ops
33
Protect info in DB from disclosure?
Availability, Policy, Processing
Confidentiality, Tech, Storage
Confidentiality, Policy, Storage
Integrity, Tech, Transmission
34
What is Role-Based Access Control?
Access by time
Access by clearance
Access by rules
Access based on job/role
35
Who are Criminal Enterprises?
Hack for secrets
Hack for money
Hack for thrill
Hack for ideology
36
Name an IDS/IPS software.
Mimecast
Keeper
Snort
Nessus
37
What is Asymmetric Encryption?
No encryption
Hashing method
Same key used
Different keys to encrypt/decrypt
38
OWASP Top-10 #2?
Vulnerable Components
Cryptographic Failures
Injection
Security Misconfiguration
39
PHI is related to HIPAA regulations
False
True
40
What does PII stand for?
Protected Internet Identity
Payment Information Index
Personally Identifiable Information
Private Infrastructure Info
41
Name a firewall brand.
Fortinet Fortigate
Datto
Snort
Cloudflare
42
What is HaveIBeenPwned?
Monitors devices
Scans networks
Encrypts passwords
Checks breach data
43
Authorization in IAAA?
What can they do?
Where were they?
Are they real?
Who are they?
44
Who are Skilled Hackers?
Cause-driven hackers
Unskilled thrill-seekers
Nation-state actors
Hack for money or bragging
45
Port 22 used for?
FTP
SSH/SFTP
RDP
HTTPS
46
Who is Trudy?
Intruder
Legit user
Spy
Opponent
47
OSI Layer 1?
Transport (datagrams)
Network (packets)
Data Link (frames)
Physical (bits & bytes)
48
What is S-SDLC?
Security in DevOps
Secure System Learning
Simple Software Design
Security in SDLC
49
Internet connectivity backup?
UPS battery
Biometrics
Firewall pair
Cellular or satellite
50
WiFi 7’s MLO means?
Multiple Layer Operations
Mobile Link Oversight
Main LAN Optimizer
Multi-Link Operations
51
OWASP Top-10 #4?
Crypto Failures
Authentication Failures
Server Side Forgery
Insecure Design
52
What is XSS?
Cross-Server Scanning
Cross-Site Scripting
Crypto-Site Scripting
53
What is Shodan?
Vulnerability scanner
Search engine for exposed devices
Encryption tool
Password checker
54
Global equivalent to NIST?
CAC
ENISA
CISA
ISO
55
Purpose of public IP addresses?
Encrypt data
Communicate on public networks
Store backups
Internal network only
56
What is Hashing?
Using two keys
Decrypting data
Backing up files
Encrypting data w/o plaintext
57
Physical security example?
SOC
Cameras
AES
Yubikey
58
MITRE D3FEND focuses on?
Attacker methods
AI security
Cloud controls
Defender tactics/techniques
59
What is SIEM?
Software Integration Engine
Security Info & Event Management
System Intrusion Encryption
Secure Internet Monitoring
60
What does Red Team do?
Monitors logs
Defends systems
Designs software
Tests (e.g., pen testers)
61
OSI Layer 3?
Presentation (format)
Transport (TCP/UDP)
Physical (modems)
Network (packets, IP)
62
What is Rule-Based Access Control?
Access by security level
Access by rules (e.g., location)
Access by role
Access by user ID
63
What is a Security Incident?
Just a log entry
Full CIA breach
Routine maintenance
Requires specific security attention
64
Confidentiality in CIA Triad means?
Systems are always available
Data is unchanged
Data is encrypted
No unauthorized access to sensitive info
65
Ideal data center humidity?
70-80%
40-60%
20-30%
10-20%
66
OWASP Top-10 #1?
Injection
Insecure Design
Crypto Failures
Broken Access Control
67
What is a Threat?
Outside force that could harm us
A system flaw
Something we protect
A risk outcome
68
WPA3 authentication method?
SHA
AES
TLS
SAE
69
Way to secure wireless comms?
Spread spectrum
No encryption
Single channel
Open access
70
Port 20/21 used for?
SSH
DNS
FTP
HTTP
71
OSI Layer 3 uses IP addresses.
True
False
72
Identification in IAAA?
Who is this?
Where have they been?
Are they real?
What can they do?
73
Name a power backup example.
Nmap
Generac generator
Fortigate
Cloudflare
74
What is DLP?
Data Log Processing
Dynamic Learning Program
Device Link Protection
Data Loss Prevention
75
Bell Lapadula/Biba models do?
Assign access by security class
Role-based access
Rule-based access
Random access
76
What does PHI/ePHI stand for?
Protected Health Info / Electronic PHI
Payment Health Integration
Personal Hardware Identification
Private Host Interface
77
NIST SP 800-88 guides what?
Firewall setup
Backup protocols
Disk sanitization
Encryption standards
78
What is Data Remanence?
Data left after deletion
Data transfer
Data encryption
Data backup
79
Example of private IP address?
8.8.8.8
192.168.1.1
1.1.1.1
74.125.224.72
80
What do Firewalls protect?
Internal systems from bad internet
Web apps from users
Power from outages
Data from backups
81
OSI Layer 5?
Session (connection)
Transport (TCP)
Presentation (format)
Physical (bits)
82
Who are Alice & Bob?
Eavesdroppers
Hackers
Legit users communicating
Malicious actors
83
OWASP Top-10 #6?
Insecure Design
Logging Failures
Broken Access Control
Vulnerable and Outdated Components
84
Who are Black Hat hackers?
Neutral hackers
Corporate spies
Good guy hackers
Bad guy hackers
85
Example of “something you are”?
Biometrics (fingerprint, eye scan)
Token
Smart card
Passphrase
86
What is a GRC tool?
Encrypts data
Manages risk & compliance
Monitors email
Scans networks
87
Who is Oscar?
User
Intruder
Opponent
Spy
88
Example of “something you know”?
Yubikey
Password/passphrase
Fingerprint
Text code
89
What is PASTA?
Plan for Attack Security & Testing Always
Protect Against Systems Threats Annually
Program for Audit Security & Threats
Process for Attack Sim & Threat Analysis
90
What do vuln scanners do?
Monitor power
Scan for vulnerabilities
Back up files
Encrypt data
91
DAD Triad relates to CIA how?
Enhances CIA protection
Supports CIA goals
Replaces CIA in breaches
Opposite—bad outcomes of CIA breach
92
What is CISA?
Critical Internet Security Alliance
Cyber Incident Standards Authority
Cybersecurity & Infrastructure Security Agency
Central Intelligence Security Agency
93
What is a SOC?
Encryption tool
Software for backups
24/7 cybersecurity monitoring
Firewall hardware
94
What is Ransomware?
Steals/encrypts data, extorts money
Hijacks emails
Hacks vendors
Denies service
95
What is a Security Breach?
Minor log event
System update failure
Breach of the CIA Triad
Requires minor attention
96
Phishing awareness software?
Drata
CrowdStrike
Snort
KnowBe4
97
STRIDE stands for?
Scan, Test, Report, Inspect, Deny, Esc
Start, Threaten, Record, Infect, Delete
Secure, Track, Review, Isolate, Detect
Spoof, Tamper, Repud, Info, DoS, Elev
98
Who are Hacktivists?
Hack for fun
Hack for a cause
Hack for spies
Hack for profit
99
What is IP in cybersecurity?
Infrastructure Plan
Intellectual Property
Internal Protection
Internet Protocol
100
Hacktivists hack to embarrass or disrupt.
False
True
101
Email security gateway example?
Nessus
Splunk
Kali
Mimecast
102
What does Blue Team do?
Defends systems
Hacks for fun
Tests systems
Blends offense/defense
103
IT vs OT?
Info vs Threats
Internet vs Offline
Internal vs External
Biz tech vs operational tech
104
What is a secrets manager?
Vulnerability scanner
Password safe/key management
Firewall controller
Backup system
105
Rank severity: Event, Incident, Breach
Breach > Event > Incident
Breach > Incident > Event
incident > Breach > Event
Event > Incident > Breach
106
Firewalls protect internal systems from the internet.
True
False
107
Secure coding principle?
Use MFA
Use legacy protocols
Hard-code credentials
Store all data
108
What is Salting/Peppering?
Key generation
Double encryption
Adding noise to hashes
Removing encryption
109
OWASP Top-10 #3?
Injection
Broken Access Control
Logging Failures
Insecure Design
110
Competitors hack for?
Corporate espionage
Disruption
Ideology
Thrill
111
Who are White Hat hackers?
Good guys (pen testers, ethical)
In-between hackers
Script kiddies
Malicious hackers
112
DREAD stands for?
Deny, Record, Escalate, Attack, Detect
Design, Review, Encrypt, Assess, Defend
Data, Risk, Eval, Alert, Destroy
Damage, Repro, Exploit, Affect, Discov
113
Who are Script Kiddies?
Hack for money
Hack for a cause
Hack for intel
Unskilled, hack for thrill
114
What is a honeypot?
Firewall type
System to raise alarm if touched
Backup storage
Encryption tool
115
What is PCI CHD?
Payment Card Industry Cardholder Data
Personal Computer Interface Data
Protected Critical Infrastructure Data
Private Cloud Information Data
116
Authentication in IAAA?
Who are they?
What permissions?
Are they authentic?
Where did they go?
117
What is NIST?
Sets cybersecurity standards for gov & biz
Monitors cyber threats globally
Develops encryption algorithms only
Protects critical infrastructure
118
What is a Security Event?
Requires security attention
Something in our logs
A hacker attack
Breach of CIA Triad
119
Nation States are also called?
Hacktivists
Insiders
Advanced Persistent Threats
Script Kiddies
120
What do WAFs protect?
Internal networks
Email systems
Physical servers
Web apps from bad internet
121
What is Purging?
Data recovery
Physical destruction
Repeating clearing multiple times
Single overwrite
122
What are High Availability Firewalls?
Web app protectors
Intrusion detectors
Single strong firewall
Two firewalls, one backs up the other
123
Types of Insider Threats?
Accidental, Negligent, Purposeful
Skilled, Unskilled, Mixed
External, Internal, Hybrid
Random, Planned, Mixed
124
OWASP Top-10 #9?
Authentication Failures
Insecure Design
Crypto Failures
Security Logging and Monitoring Failures
125
Asymmetric provides what?
Hashing
Non-Repudiation
Speed
Simplicity
126
What is SAST?
Dynamic App Security Testing
Static App Security Testing
Secure Access Security Test
System Audit Security Test
127
Grey Box testing means?
Complete ignorance
Some knowledge of environment
Hardware focus
Total awareness
128
What is Penetration Testing?
Automated scanning
Encryption testing
Human-led attack simulation
Data backup
129
What is a Vulnerability
A protected item
An external danger
A breach result
Negative quality of an asset
130
What is DAST?
Dynamic App Security Testing
Static App Security Testing
Device Audit Security Test
Data Access Security Test
131
What is an Asset?
An outside threat
Something we protect
A system weakness
An unwanted outcome
132
The CIA Triad ensures data is always encrypted.
False
True
133
Who is Eve?
Attacker
Eavesdropper
Intruder
User
134
Vuln scanning tool?
Nmap
Keeper
Mimecast
ArcticWolf
135
Port 53 used for?
SSH
HTTP
DNS
RDP
136
Clearing overwrites a disc multiple times
False
True
137
Who are Grey Hat hackers?
Corporate insiders
Always ethical hackers
Somewhere in the middle
Purely evil hackers
138
Accountability in IAAA?
Are they legit?
Where have they been?
Who are they?
What can they do?
139
What are the 6 cybersecurity goals?
Plan, Build, Test, Deploy, Monitor, Fix
Identify, Protect, Detect, Respond, Recover, Govern
Encrypt, Decrypt, Hash, Salt, Pepper, Store
Attack, Defend, Detect, Respond, Recover, Hide
140
What is Clearing?
Shredding disc
Overwriting disc with 1s and 0s
Backing up files
Encrypting data
141
OSI Layer 6?
Application (use)
Network (IP)
Presentation (data formatting)
Data Link (MAC)
142
OSI Layer 7?
Physical (bytes)
Application (usable data)
Transport (UDP)
Session (connection)
143
OWASP Top-10 #5?
Injection
Security Misconfiguration
Software Integrity Failures
Vulnerable Components
144
3 dimensions of McCumber Cube?
Threats, Risks, Assets
Hardware, Software, Network
Goals (CIA), Safeguards, States
Users, Admins, Hackers
145
Is AES256 quantum-proof?
Not resilient at all
Only AES128 is resilient
Fully quantum-proof
Quantum-resilient, not proof
146
What are Data Backups?
Prevent intrusions
Power generators
Access controllers
Replicate data onsite/remotely
147
Availability in CIA Triad means?
Systems are offline
Data is unaltered
Info/systems ready for legit users
Data is confidential
148
Asymmetric Encryption example?
RSA
AES
DES
3DES
149
OWASP Top-10 #10?
Logging Failures
Server Side Forgery Request
Vulnerable Components
Injection
150
What is Defense in Depth?
Backup strategy
Firewall only
Layered security approach
Single-layer protection
151
Port 80 used for?
HTTP
HTTPS
DNS
FTP
152
OSI Layer 2?
Application (data)
Data Link (frames, MAC)
Physical (bits)
Session (connection)
153
OWASP Top-10 #8?
Broken Access Control
Vulnerable Components
Software and Data Integrity Failures
Injection
154
Ideal data center temp?
30-40°F
80-90°F
50-60°F
60-75°F
155
What is NIST SSDF?
Standard Software Design Format
System Security Defense Fund
Secure System Deployment Framework
Secure Software Dev Framework
156
White Box testing means?
Partial knowledge
External testing
No knowledge
Full knowledge of environment
157
Port 3389 used for?
RDP
FTP
HTTPS
DNS
158
Penetration testing is always automated
True
False
159
What is DoS/DDoS?
Encrypts data
Impacts service availability
teals emails
Hacks supply chain
160
What is Symmetric Encryption?
Same key to encrypt/decrypt
Hashing only
Different keys
No keys used
161
Secure by Design means?
No design
Vulnerable design
Random design
Good design practices
162
OWASP Top-10 #7?
Identification and Authentication Failures
Server Side Forgery
Crypto Failures
Security Misconfiguration
163
Port 443 used for?
SSH
RDP
HTTPS
HTTP
164
Integrity in CIA Triad means?
No unauthorized data modifications
Systems are accessible
Data is backed up
Data is kept secret
165
What is Destruction?
Backing up disc
Encrypting disc
Physically destroying disc
Overwriting once
166
Red Team focuses on defensive security.
True
False
167
Example of “something you have”?
Password
Face ID
PIN
Yubikey, MFA push, text code
168
Who is Mallory?
Malicious actor
Defender
Legit user
Eavesdropper
169
What is FIM?
File Integrity Monitoring
Fast Incident Mitigation
File Internet Mapping
Firewall Intrusion Manager
