stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Final review 4 Flashcards | StudBud
Explore
/
Final review 4
What is a dictionary attack?
The sudoers file contains system logs.
Final review 4
86 terms
·
StudBud Administration
·
14 plays
Imported from external platform
Flashcards
86 cards
F
Practice quiz
P
Host live
L
Questions
86
Answers
1
The sudoers file contains system logs.
True
False
2
What is a dictionary attack?
Compiling a list of words from a website
Encrypting a dictionary file
Hashing a list of words to compare with a target hash
Using brute force to find words in a dictionary
3
Which online sandbox is widely used in the malware analysis community?
Total Analysis
API Logger
Cuckoo
Wireshark
4
What does a 200 HTTP status code indicate in directory enumeration results?
The request was successful, and the resource exists
The server redirected the request
The resource is forbidden, but exists
The directory or file is inaccessible
5
What is the primary goal of the recovery stage in incident handling?
Returning systems and operations to normal functionality.
Developing strategies to prevent future incidents.
Analysing the root cause of the security breach.
haring incident analysis and outcomes with stakeholders.
6
What does the acronym PBKDF2 stand for?
Password-Based Key Derivation Function 2
Password-Based Key Data Feature 2
Partition-Based Kernel Data Framework 2
Public-Based Key Distribution Framework 2
7
What does the ">" operator do in Linux?
Installs packages
Deletes files
Extracts strings
Pipes output to a file
8
What is the priority in crisis management?
Avoiding media attention
Punishing employees
Keeping operations running
Stopping attackers
9
What is the main goal of advanced static analysis?
Monitor live network activity in a safe environment
Reverse engineer malware to understand its behaviour
Decrypt malware files for dynamic analysis
Execute malware in a safe environment
10
Which phase focuses on bypassing antivirus or firewalls?
Defense Evasion
Privilege Escalation
Exfiltration
Execution
11
Risk probability is the key determinant in deciding prioritization levels.
False
True
12
Why is enumeration important before exploitation?
Verifies if exploits worked
Avoids triggering noisy scans.
Finds active devices on the network.
Maps services and finds vulnerabilities.
13
What is process hollowing?
Debugging malware
Injecting malicious code into a legitimate process
Encrypting files on a system
Running malware in a sandbox.
14
What actions help reduce the likelihood of insider threats?
Assume all employees are equally trustworthy.
Monitor for unusual activity and report concerns promptly.
Restrict access to sensitive data based on job responsibilities.
Rely solely on technical controls.
15
What is a Whois lookup used for?
Identifying website vulnerabilities
Mapping a website’s internal structure
Retrieving domain registration details
Scanning ports of a website
16
What type of Indicator of Compromise (IoC) includes email addresses used in phishing?
Spoofed Email
Domain
File Hash
IP Address
17
How do phishing and spear phishing differ?
Phishing occurs on social media, whereas spear phishing happens via email.
There’s no distinction; both terms mean the same thing.
Phishing targets many users; spear phishing targets specific individuals.
Spear phishing targets many; phishing is for specific individuals.
18
What kind of malware can turn a workstation into a part of a DDoS attack?
Spyware
Ransomware
Botnet
Trojan Horse
19
What is the common format for PowerShell cmdlets?
Noun-Verb
Command-Action
Verb-Verb
Verb-Noun
20
What is the expected response when a closed port is scanned with a SYN or TCP Connect scan?
SYN/ACK
RST (Reset)
ICMP unreachable
No response
21
What does credentials harvesting mean in the context of cybersecurity?
Encrypting sensitive login data in transit
Backing up user accounts in a secure environment
Storing user credentials safely against data breaches
Collecting stolen usernames, passwords, and tokens for malicious use
22
Which type of XSS attack is delivered through a URL?
Stored XSS
Reflected XSS
HTTP Injection
DOM-based XSS
23
What could suggest that a cybersecurity incident is occurring?
High scanner activity and malware alerts.
Normal app usage and no antivirus issues.
Routine VPN logins and scheduled updates.
Spam reported but no suspicious links clicked.
24
Which threat involves intercepting data between two parties by masquerading as each other?
Privilege Escalation
Denial of Service
Bandwidth Theft
Man-in-the-Middle Attack
25
What is a principle of the Biba model?
No execute up
No delete down
No write up
No read down
26
What does the tail -n command do?
Deletes temporary logs
Opens a file for editing
Displays the last n lines of a file
Searches for specific strings
27
Which resource best explains web server attack techniques?
Diamond model
MITRE ATT&CK
Tabletop exercise
ISO 27701
28
Which phase of the CTI lifecycle involves sorting, organizing, and presenting data?
Processing
Direction
Collection
Analysis
29
Which framework focuses on adversary behaviour and tactics?
TAXII
MITRE ATT&CK
STIX
Cyber Kill Chain
30
What tool did can use to find hidden pages in web applications?
Wireshark
Nessus
Metasploit
Gobuster
31
What type of phishing targets specific individuals or organizations?
Vishing
Mass phishing
Spear-phishing
Smishing
32
What is the primary purpose of port forwarding?
To encrypt outgoing traffic
To route inbound traffic to internal devices
To block all traffic from entering a network
To monitor internal user activity
33
How does an anomaly-based IDS identify malicious traffic?
By matching patterns in a signature database
By scanning all packets for known exploits using DPI
By comparing traffic to a baseline of normal behaviour
By encrypting network traffic once enters the network
34
What is Shodan primarily designed to search?
Private company networks
Internet-connected devices and services
Encrypted email servers
Firewall configurations
35
What is the process of gathering publicly available email addresses for phishing attacks called?
Email harvesting
Spam collection
Email scraping
Social engineering
36
What is the primary use of a PE header in malware analysis?
To calculate hashes for further analysis
To understand file structure and imports
To execute files safely before sharing them
To identify malicious strings on the sample
37
What does the "Zero Trust" principle advocate?
Trust external devices but verify regularly
Always trust internal users
Assume all entities are threats until verified
Grant unlimited access to trusted users
38
Risk probability is the key determinant in deciding prioritization levels.
False
True
39
What phase defines goals and objectives for threat intelligence?
Feedback
Direction
Collection
Dissemination
40
What is the importance of MD5 checksums in malware analysis?
They debug malware.
They identify unique file fingerprints.
They execute malware samples..
They encrypt malware data.
41
Which step in the Cyber Kill Chain involves designing a malicious payload for future use?
Weaponization
Reconnaissance
Command and Control
Privilege Escalation
42
What is the difference between HIDS and NIDS?
HIDS monitors network traffic; NIDS monitors host activity.
HIDS monitors host activity; NIDS monitors network traffic.
HIDS is for enterprises; NIDS is for individuals.
HIDS prevents attacks; NIDS detects intrusions.
43
What is the primary purpose of the tool "sqlmap"?
To encrypt database communication for added security.
To automate the detection and exploitation of SQL injection vulnerabilities
To detect SQL servers with default credentials.
To scan for open ports on database servers.
44
What does Static Analysis involve?
Running the malware to observe behaviour
Analysing malware without executing it
Monitoring network traffic to find the C2
Removing the malware from the system
45
Which tool in the FLARE VM identifies capabilities of a PE file?
CyberChef
Strings
Malware Bazaar
Capa
46
How does a security engineer handle exceptions to policies for business needs?
Ignoring the policies
Disabling security measures
Implementing mitigations
Delaying business processes
47
The Tor Browser is inherently faster than other browsers.
True
False
48
Which privacy regulation specifically protects the personal data of EU citizens?
GDPR
SOC 2
PCI DSS
HIPAA
49
Which command updates package information in Debian-based distributions?
dpkg upgrade
dnf update
yum update
apt update
50
What does TTP stand for in cybersecurity?
Tools, Trends, Patterns
Threat Tracking Process
Technical Testing Protocol
Tactics, Techniques, Procedures
51
What is the first stage of the Incident Response process?
Detection and Analysis
Containment
Preparation
Post-Incident Activity
52
What is an example of a method used for persistence?
Phishing
File sharing
Fake cookies
Startup scripts
53
What are Sysinternals tools primarily used for?
Troubleshooting and analysing Windows systems.
Replacing Windows kernel drivers.
Developing portable Windows applications.
Managing Linux processes on Windows.
54
Why is it risky to leave default credentials unchanged?
It makes websites slower
Hackers can easily guess them and gain access
It prevents authorized users from logging in
It disables encryption protocols
55
In Powershell, which command is used to get help about a specific cmdlet?
Help-Command
Get-Manual
Cmdlet-Info
Get-Help
56
What does the term "pivoting" refer to in cyber attacks?
Hiding malware within files
Moving laterally within a network to access other systems
Encrypting stolen data
Switching attack methods
57
Who is responsible for maintaining security awareness?
Security officers
The IT department only
Everyone in the organization
Leadership teams exclusively
58
A sandbox allow testing of unknown software in a secure and isolated space.
False
True
59
What command checks the type of a file in Linux?
VirusTotal
strings
md5sum
file
60
What is the main function of Sysmon?
Inspecting alternate data streams
Deleting system logs
Managing NTFS permissions
Monitoring and logging system activity
61
What is Metasploit primarily used for?
File encryption
Exploitation framework
Network defence
System backup
62
What is the primary objective of security awareness?
To eliminate all threats to organizational security
To educate users on reducing cyber risks
To detect malware in real time
To implement IT policies in the workplace
63
What does Cisco Talos specialize in?
Monitoring internet speeds
Providing actionable threat intelligence
Offering hardware solutions
Designing antivirus software
64
What is the size of an IPv4 address in bytes?
6 bytes
4 bytes
2 bytes
8 bytes
65
What does requiring a username/password and smart card for access represent?
Accounting
Authorization
Authentication
Availability
66
1.What does "PIM" stand for in access management?
Protected Integrity Mechanism
Personal Information Model
Privileged Identity Management
Privileged Information Management
67
Changing a file's name alters its hash value.
True
False
68
Which role focuses on investigating malware behaviour?
Threat Hunter
SOC Analyst
Forensic Analyst
Malware Analyst
69
What is the purpose of analysing malware strings?
To encrypt files
To remove malware
To identify behaviours
To modify malware
70
Defence-in-Depth applies only to physical security.
True
False
71
The Containment phase should always precede Eradication.
False
True
72
What does Regshot compare to identify changes?
Network activity logs from different tools
Deleted running processes
Snapshots of the system registry
API call sequences between 2 samples
73
What is the focus of the "Availability" element in the CIA Triad?
Making data accessible to authorized users when needed
Preventing unauthorized data alterations
Encrypting data for security
Ensuring only authorized users can access data
74
Which of the following best describes "vulnerability"?
The severity of potential damage from a cyber attack
The likelihood of a threat occurring
A system's potential exposure to cyber-attacks
A weakness or flaw that can be exploited by a threat
75
All ports on a network-enabled device are well-known and standardized.
True
False
76
What email subject is likely to grab attention in a phishing attack?
“Company update”
“Annual sales report”
“Your account has been compromised!”
“Weekly newsletter”
77
Which system is designed to recognize malware through signature matching and block it?
Antivirus
Firewall
SIEM
IDS
78
If a credit card number is exposed after a data breach which regulatory compliance will take effect?
GUDP
GBLM
HIPPA
PCI DSS
79
What type of security professional simulates adversary attacks to test an organization?
Security Analyst
Penetration Tester
SOC Analyst
Blue Teamer
80
The purpose of malware analysis is only to detect IOCs.
False
True
81
What is created during the Weaponization phase?
A phishing email
A list of vulnerabilities
A malicious payload
A fake domain
82
Which password policy enforces using at least three character types, such as uppercase, lowercase, & special characters?
Enforce password history
Password complexity requirements
Password age policy
Minimum password length
83
What prints the message "This program cannot be run in DOS mode"?
DOS Stub
Section Table
Import Table
PE Header
84
What does the crontab file do in Linux?
Stores user data and then deletes it.
Logs system errors.
Schedules tasks to run automatically.
Monitors network traffic when SOC closes.
85
What is the opposite of Confidentiality in the DAD triad?
Destruction
Disclosure
Integrity
Denial
86
What is a common anti-sandbox technique?
Running instantly
Obfuscating sections
Importing DLLs
Long sleep calls
