What is the primary use of a PE header in malware analysis?

To understand file structure and imports

What is Shodan primarily designed to search?

Internet-connected devices and services

What are Sysinternals tools primarily used for?

Troubleshooting and analysing Windows systems.

What is the primary goal of the recovery stage in incident handling?

Returning systems and operations to normal functionality.

What does the acronym PBKDF2 stand for?

Password-Based Key Derivation Function 2

What is the focus of the "Availability" element in the CIA Triad?

Making data accessible to authorized users when needed

Why is it risky to leave default credentials unchanged?

Hackers can easily guess them and gain access

What is a dictionary attack?

Hashing a list of words to compare with a target hash

What does Cisco Talos specialize in?

Providing actionable threat intelligence

How do phishing and spear phishing differ?

Phishing targets many users; spear phishing targets specific individuals.

What is the main goal of advanced static analysis?

Reverse engineer malware to understand its behaviour

What does Static Analysis involve?

Analysing malware without executing it

What does the tail -n command do?

Displays the last n lines of a file

What does TTP stand for in cybersecurity?

Tactics, Techniques, Procedures

Why is enumeration important before exploitation?

Maps services and finds vulnerabilities.

What is the primary purpose of port forwarding?

To route inbound traffic to internal devices

What is the primary purpose of the tool "sqlmap"?

To automate the detection and exploitation of SQL injection vulnerabilities

Which of the following best describes "vulnerability"?

A weakness or flaw that can be exploited by a threat

studbud

Final review 4

86 termsStudBud Administration14 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
Which command updates package information in Debian-based distributions?
dnf update
apt update
dpkg upgrade
yum update
2
What is the primary use of a PE header in malware analysis?
To calculate hashes for further analysis
To execute files safely before sharing them
To understand file structure and imports
To identify malicious strings on the sample
3
If a credit card number is exposed after a data breach which regulatory compliance will take effect?
GBLM
HIPPA
GUDP
PCI DSS
4
What is the common format for PowerShell cmdlets?
Verb-Verb
Verb-Noun
Noun-Verb
Command-Action
5
Which phase focuses on bypassing antivirus or firewalls?
Execution
Exfiltration
Defense Evasion
Privilege Escalation
6
Which system is designed to recognize malware through signature matching and block it?
IDS
Antivirus
SIEM
Firewall
7
What is the first stage of the Incident Response process?
Detection and Analysis
Preparation
Containment
Post-Incident Activity
8
Which online sandbox is widely used in the malware analysis community?
Cuckoo
Wireshark
API Logger
Total Analysis
9
The Tor Browser is inherently faster than other browsers.
False
True
10
All ports on a network-enabled device are well-known and standardized.
False
True
11
What is a common anti-sandbox technique?
Long sleep calls
Running instantly
Importing DLLs
Obfuscating sections
12
What is the purpose of analysing malware strings?
To modify malware
To encrypt files
To remove malware
To identify behaviours
13
What does the ">" operator do in Linux?
Extracts strings
Deletes files
Pipes output to a file
Installs packages
14
What is Shodan primarily designed to search?
Private company networks
Firewall configurations
Encrypted email servers
Internet-connected devices and services
15
What are Sysinternals tools primarily used for?
Managing Linux processes on Windows.
Developing portable Windows applications.
Troubleshooting and analysing Windows systems.
Replacing Windows kernel drivers.
16
What does requiring a username/password and smart card for access represent?
Authentication
Accounting
Authorization
Availability
17
What is the primary goal of the recovery stage in incident handling?
Analysing the root cause of the security breach.
Returning systems and operations to normal functionality.
haring incident analysis and outcomes with stakeholders.
Developing strategies to prevent future incidents.
18
Risk probability is the key determinant in deciding prioritization levels.
False
True
19
The Containment phase should always precede Eradication.
True
False
20
What does the acronym PBKDF2 stand for?
Partition-Based Kernel Data Framework 2
Password-Based Key Derivation Function 2
Password-Based Key Data Feature 2
Public-Based Key Distribution Framework 2
21
What is the focus of the "Availability" element in the CIA Triad?
Preventing unauthorized data alterations
Making data accessible to authorized users when needed
Encrypting data for security
Ensuring only authorized users can access data
22
Why is it risky to leave default credentials unchanged?
It disables encryption protocols
It makes websites slower
It prevents authorized users from logging in
Hackers can easily guess them and gain access
23
What is a dictionary attack?
Encrypting a dictionary file
Using brute force to find words in a dictionary
Compiling a list of words from a website
Hashing a list of words to compare with a target hash
24
What is the expected response when a closed port is scanned with a SYN or TCP Connect scan?
RST (Reset)
SYN/ACK
No response
ICMP unreachable
25
Risk probability is the key determinant in deciding prioritization levels.
False
True
26
Which framework focuses on adversary behaviour and tactics?
Cyber Kill Chain
MITRE ATT&CK
STIX
TAXII
27
In Powershell, which command is used to get help about a specific cmdlet?
Help-Command
Cmdlet-Info
Get-Manual
Get-Help
28
What does Cisco Talos specialize in?
Monitoring internet speeds
Providing actionable threat intelligence
Designing antivirus software
Offering hardware solutions
29
How do phishing and spear phishing differ?
Phishing occurs on social media, whereas spear phishing happens via email.
Phishing targets many users; spear phishing targets specific individuals.
Spear phishing targets many; phishing is for specific individuals.
There’s no distinction; both terms mean the same thing.
30
The sudoers file contains system logs.
False
True
31
What is the main goal of advanced static analysis?
Reverse engineer malware to understand its behaviour
Execute malware in a safe environment
Monitor live network activity in a safe environment
Decrypt malware files for dynamic analysis
32
Which type of XSS attack is delivered through a URL?
HTTP Injection
Reflected XSS
DOM-based XSS
Stored XSS
33
What does Static Analysis involve?
Running the malware to observe behaviour
Analysing malware without executing it
Monitoring network traffic to find the C2
Removing the malware from the system
34
What does the tail -n command do?
Deletes temporary logs
Displays the last n lines of a file
Searches for specific strings
Opens a file for editing
35
What does TTP stand for in cybersecurity?
Tools, Trends, Patterns
Threat Tracking Process
Tactics, Techniques, Procedures
Technical Testing Protocol
36
Why is enumeration important before exploitation?
Finds active devices on the network.
Maps services and finds vulnerabilities.
Verifies if exploits worked
Avoids triggering noisy scans.
37
What phase defines goals and objectives for threat intelligence?
Direction
Feedback
Dissemination
Collection
38
What is the process of gathering publicly available email addresses for phishing attacks called?
Spam collection
Email scraping
Email harvesting
Social engineering
39
A sandbox allow testing of unknown software in a secure and isolated space.
True
False
40
What is the primary purpose of port forwarding?
To block all traffic from entering a network
To route inbound traffic to internal devices
To monitor internal user activity
To encrypt outgoing traffic
41
Defence-in-Depth applies only to physical security.
False
True
42
Changing a file's name alters its hash value.
True
False
43
The purpose of malware analysis is only to detect IOCs.
True
False
44
What is the primary purpose of the tool "sqlmap"?
To encrypt database communication for added security.
To detect SQL servers with default credentials.
To automate the detection and exploitation of SQL injection vulnerabilities
To scan for open ports on database servers.
45
Which of the following best describes "vulnerability"?
A system's potential exposure to cyber-attacks
The likelihood of a threat occurring
A weakness or flaw that can be exploited by a threat
The severity of potential damage from a cyber attack
46
What is the priority in crisis management?
Punishing employees
Avoiding media attention
Keeping operations running
Stopping attackers
47
What is the opposite of Confidentiality in the DAD triad?
Destruction
Denial
Disclosure
Integrity
48
Which threat involves intercepting data between two parties by masquerading as each other?
Denial of Service
Privilege Escalation
Bandwidth Theft
Man-in-the-Middle Attack
49
What type of Indicator of Compromise (IoC) includes email addresses used in phishing?
IP Address
File Hash
Spoofed Email
Domain
50
What prints the message "This program cannot be run in DOS mode"?
Import Table
PE Header
DOS Stub
Section Table
51
1.What does "PIM" stand for in access management?
Privileged Information Management
Personal Information Model
Privileged Identity Management
Protected Integrity Mechanism
52
What command checks the type of a file in Linux?
file
strings
md5sum
VirusTotal
53
What is created during the Weaponization phase?
A fake domain
A malicious payload
A list of vulnerabilities
A phishing email
54
What type of phishing targets specific individuals or organizations?
Mass phishing
Vishing
Smishing
Spear-phishing
55
What is a principle of the Biba model?
No execute up
No write up
No delete down
No read down
56
Which phase of the CTI lifecycle involves sorting, organizing, and presenting data?
Processing
Analysis
Collection
Direction
57
What is the importance of MD5 checksums in malware analysis?
They identify unique file fingerprints.
They execute malware samples..
They encrypt malware data.
They debug malware.
58
What is an example of a method used for persistence?
Phishing
Fake cookies
Startup scripts
File sharing
59
Which step in the Cyber Kill Chain involves designing a malicious payload for future use?
Weaponization
Command and Control
Privilege Escalation
Reconnaissance
60
What does the crontab file do in Linux?
Monitors network traffic when SOC closes.
Logs system errors.
Stores user data and then deletes it.
Schedules tasks to run automatically.
61
Which role focuses on investigating malware behaviour?
SOC Analyst
Forensic Analyst
Malware Analyst
Threat Hunter
62
What is a Whois lookup used for?
Retrieving domain registration details
Scanning ports of a website
Identifying website vulnerabilities
Mapping a website’s internal structure
63
Which resource best explains web server attack techniques?
Diamond model
MITRE ATT&CK
ISO 27701
Tabletop exercise
64
What is process hollowing?
Injecting malicious code into a legitimate process
Debugging malware
Encrypting files on a system
Running malware in a sandbox.
65
What does a 200 HTTP status code indicate in directory enumeration results?
The resource is forbidden, but exists
The request was successful, and the resource exists
The directory or file is inaccessible
The server redirected the request
66
What email subject is likely to grab attention in a phishing attack?
“Weekly newsletter”
“Company update”
“Your account has been compromised!”
“Annual sales report”
67
What could suggest that a cybersecurity incident is occurring?
Normal app usage and no antivirus issues.
Routine VPN logins and scheduled updates.
Spam reported but no suspicious links clicked.
High scanner activity and malware alerts.
68
What is the size of an IPv4 address in bytes?
4 bytes
8 bytes
6 bytes
2 bytes
69
What tool did can use to find hidden pages in web applications?
Nessus
Metasploit
Gobuster
Wireshark
70
What does Regshot compare to identify changes?
API call sequences between 2 samples
Snapshots of the system registry
Network activity logs from different tools
Deleted running processes
71
How does a security engineer handle exceptions to policies for business needs?
Delaying business processes
Disabling security measures
Ignoring the policies
Implementing mitigations
72
What actions help reduce the likelihood of insider threats?
Assume all employees are equally trustworthy.
Monitor for unusual activity and report concerns promptly.
Rely solely on technical controls.
Restrict access to sensitive data based on job responsibilities.
73
How does an anomaly-based IDS identify malicious traffic?
By encrypting network traffic once enters the network
By comparing traffic to a baseline of normal behaviour
By matching patterns in a signature database
By scanning all packets for known exploits using DPI
74
What is the primary objective of security awareness?
To implement IT policies in the workplace
To educate users on reducing cyber risks
To detect malware in real time
To eliminate all threats to organizational security
75
What is the main function of Sysmon?
Monitoring and logging system activity
Managing NTFS permissions
Deleting system logs
Inspecting alternate data streams
76
What is Metasploit primarily used for?
Network defence
Exploitation framework
System backup
File encryption
77
What does the "Zero Trust" principle advocate?
Trust external devices but verify regularly
Assume all entities are threats until verified
Grant unlimited access to trusted users
Always trust internal users
78
Who is responsible for maintaining security awareness?
The IT department only
Security officers
Leadership teams exclusively
Everyone in the organization
79
Which tool in the FLARE VM identifies capabilities of a PE file?
Malware Bazaar
CyberChef
Capa
Strings
80
What is the difference between HIDS and NIDS?
HIDS monitors network traffic; NIDS monitors host activity.
HIDS prevents attacks; NIDS detects intrusions.
HIDS monitors host activity; NIDS monitors network traffic.
HIDS is for enterprises; NIDS is for individuals.
81
What kind of malware can turn a workstation into a part of a DDoS attack?
Botnet
Ransomware
Spyware
Trojan Horse
82
Which privacy regulation specifically protects the personal data of EU citizens?
PCI DSS
GDPR
SOC 2
HIPAA
83
What does the term "pivoting" refer to in cyber attacks?
Switching attack methods
Moving laterally within a network to access other systems
Encrypting stolen data
Hiding malware within files
84
Which password policy enforces using at least three character types, such as uppercase, lowercase, & special characters?
Password complexity requirements
Minimum password length
Enforce password history
Password age policy
85
What type of security professional simulates adversary attacks to test an organization?
Security Analyst
SOC Analyst
Blue Teamer
Penetration Tester
86
What does credentials harvesting mean in the context of cybersecurity?
Collecting stolen usernames, passwords, and tokens for malicious use
Storing user credentials safely against data breaches
Encrypting sensitive login data in transit
Backing up user accounts in a secure environment

Final review 4 Flashcards | StudBud