TECM 747 Exam Prep - Cyber Basics and Threats

Worms are a type of Malware that target sprecific operating systems or application

Which of these is NOT a type of social engineering?

these are code and logic related, programmers need to understand security.

What type of risk response involves deciding against signing a contract with a potential partner who has known risk?

uses two or more separate entities operating in concert to protect sensitive functions or information

SQL injection is a type of Application Attack

fake news. leads to poor decision making (social media).

A policy or mechanism that is put in place as part of an asset’s protection

program that appears to have successful function, also has hidden & potentially malicious function that evades security

Tracking all users and services to know what they are doing

even if one has all the necessary official approvals to access certain information, one would not be given access

How many times did Beth change her background in class on Saturday Nov 13?

distributed denial of service attack

divides critical functions among different staff to ensure no one individual has enough information to perpetrate fraud

Taking advantage of / Acting on a known vulnerability

Once in, they begin to break the program to make it inoperable or operates in a way the attacker wants.

Security policies pertain to

Which promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology

group of attackers who work together, are highly motivated, funded, skilled, & patient. They have specific goal / target

users make mistakes could have downloaded ransomware into the organizations network. Or share username and password.

distributed reflective denial of service

A cybersecurity policy sets the standards of behavior for activities

How do we accomplish Confidentiality?

Dumpster diving is a type of Social Engineering attack

Malicious programs that lays dormant until a specific date and time which triggers the malicious code to execute

Malicious program that lays dormant until a specific condition occurs which triggers the malicious code to execute

An attacker gains control of amplifying capable server or network device (commonly it’s control for a router)

trusted person within organization but will intentionally harm the organization. Tough to detect/find because trusted

allows an attacker to gain almost total control over your entire operating system

Practicing continuous monitoring is an example of

Putting a firewall up between the Internet and your network is what type of risk response?

combat the threats

Assurance the sender of information is provided w/ proof of delivery & recipient is provided with proof of the sender's

DDoS attacks are easy to defend because the responses are coming from legitimate & necessary Internet Services

The cyber environment today is focused on specific devices that only connect to the internet.

How do we accomplish Integrity?

an attacker gets between the client and the server

Creating proper security policies, standards, baselines, guidelines, & procedures is an example of

information security concept in which a user is given the minimum levels of access needed to perform job functions

DoS does not have to be a malicious attack, it can be accidental or human error

Purchasing insurance is what type of risk response?

takes advantage of the legitimate three-way handshake used by TCP/IP to connect users to a server

The CIA triad stands for

attacker overwhelms the memory and resources that causes systems to freeze or crash

Malicious programs that lays dormant until a specific date and time which triggers the malicious code to execute

Monitors activities and transmits them to remote system/attacker. Usually downloaded accidently by users/attached leg

Humas that are part of the cyber environment.

Attackers offer a promise of an item or good that they use to entice victims to give up their login credentials

use technology and the internet for their own benefit or agenda. Hacker are hard to catch

race condition where timing vulnerability exists; program checks access permissions too far in advanced of resource use

Form of identity fraud that will use a mix of real and fake credentials to create an illusion of a real person.

What type of risk response involves known risk being entered into?

Security vulnerability in web applications

takes advantage of normal internet operations services, DBS, routing update, etc...

circumstance or event with the potential to adversely impact organizational operations as defined by NIST SP 800 Series