What is static analysis in malware analysis?

Analysing malware without running it

What are default credentials in security contexts?

Common login details often left unmodified.

What best describes a network artifact?

Custom User-Agent strings or HTTP requests

What is the purpose of packing in malware?

To obfuscate code and hinder analysis

What is the purpose of NSE's "vuln" script category?

To detect vulnerabilities in services

Why is post-incident activity critical?

It identifies lessons to improve future responses

What can enhance the effectiveness of the identification phase?

Continuous learning and vigilance among staff

The aim of trend analysis can be defined as…

Detecting patterns by analysing data

What is a Command and Control (C&C) server?

A server that issues instructions to malware

How do IR playbooks differ from the Incident Response process?

Playbooks provide specific, detailed actions for use cases

What is a tabletop exercise?

A theoretical discussion of security scenarios

What is the primary purpose of OSINT in online investigations?

To gather publicly available information for analysis

What is one advantage of CAPA?

It automates the reverse engineering process.

What does a disassembler do?

Converts machine code into assembly language

What is an attacker’s primary goal during the Defense Evasion phase?

Avoid detection by security measures

A pattern-matching tool for identifying malware behaviours

What should you do if you suspect ARP poisoning on your system?

Look for duplicate MAC addresses

What is the primary objective of the "Recovery" phase in Incident Response?

Return systems to business as usual

studbud

Final review 3

86 termsStudBud Administration20 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
Packed malware often shows random garbage strings during static analysis.
False
True
2
Which option does NOT fall under the category of intellectual property?
Copyright
User passwords
Trademarks
Patents
3
Which of these is NOT a responsibility of a penetration tester?
Reporting findings to the company
Fixing the vulnerabilities
Testing for vulnerabilities
Exploiting security weaknesses
4
Which Boolean operator requires both conditions to be true?
XOR
AND
OR
NOT
5
Which tool is best suited for capturing and analysing network packets to investigate traffic from external sources?
Nessus
Netstat
Nmap
Wireshark
6
What is static analysis in malware analysis?
Analysing malware without running it
Monitoring network activity
Analysing malware by running it
Disassembling malware
7
What happens to customer confidence after a data breach?
It remains unaffected.
It increases due to transparency.
It decreases significantly.
It becomes more loyal due to remediation efforts.
8
What are default credentials in security contexts?
Randomly generated passwords for admin accounts
Predefined username-password pairs for secure access.
Hardcoded encryption keys
Common login details often left unmodified.
9
What best describes a network artifact?
Custom User-Agent strings or HTTP requests
Malware-related strings stored in a browser cache
A domain associated with phishing activities
A fixed IP address used for communication
10
Confidentiality ensures only authorized parties can access data.
True
False
11
What is the main goal of Offensive Security?
Find vulnerabilities
Defend against cyberattacks
Build secure systems
Monitor network traffic
12
Phishing is a type of…
Physical security
Social engineering
Software vulnerability
Cyberstalking
13
Powershell scripts use the .ps1 file extension.
False
True
14
What is the purpose of packing in malware?
To enhance performance
To reduce file size
To obfuscate code and hinder analysis
To improve compatibility
15
What is the purpose of NSE's "vuln" script category?
To detect vulnerabilities in services
To evade firewalls
To query services for information
To brute-force credentials
16
Why is post-incident activity critical?
It allows systems to be fully restored
It ensures backups are secure
It identifies lessons to improve future responses
It reviews compliance with legal standards
17
Which classification of Threat Intelligence examines an adversary's motives?
Technical Intel
Tactical Intel
Operational Intel
Strategic Intel
18
Which protocol is a secure alternative to FTP?
NFS
HTTP
SFTP
TFTP
19
Which of the following tools is BEST suited to identify all active inbound connections on a Linux web server?
netstat
nmap
netcat
netview
20
What can enhance the effectiveness of the identification phase?
Continuous learning and vigilance among staff
Regular system backups
Deploying firewalls at every network endpoint
Expanding all alert thresholds
21
It is possible to reverse a hashed value to retrieve the original input.
False
True
22
The aim of trend analysis can be defined as…
Discovering new resources for SOC
Fixing a baseline
Analysing the most used cybersecurity tools
Detecting patterns by analysing data
23
What principle states that users should have only the permissions needed for their tasks?
Role-Based Access Control
Zero Trust
Defense in Depth
Principle of Least Privilege
24
What is a Command and Control (C&C) server?
A web hosting platform
A tool for network defence
A server that issues instructions to malware
A data storage model
25
Which HTTP header attribute helps secure cookies against theft?
Content-Encryption
X-Frame-Options
Secure-Cookie
HTTPOnly
26
How do IR playbooks differ from the Incident Response process?
Playbooks provide specific, detailed actions for use cases
The IR process is only for low-severity incidents
The IR process focuses only on technology
Playbooks are less detailed than the IR process
27
What is Shodan.io used for?
Searching for IoT devices
Managing cloud data storage
Performing antivirus scans
Encrypting sensitive files
28
What is a tabletop exercise?
A software development session
A theoretical discussion of security scenarios
A security audit
A physical simulation of an attack
29
What is the first step in a malware attack process?
Delivery
Execution
Persistence
Propagation
30
Which type of IDS needs frequent updates for new threats?
Anomaly-based IDS
Rule-less IDS
Behaviour-based IDS
Signature-based IDS
31
What is the primary purpose of OSINT in online investigations?
To monitor social media accounts
To gather publicly available information for analysis
To exploit vulnerabilities
To access restricted databases
32
The MITRE ATT&CK framework focuses on scoring risks numerically.
False
True
33
What is one advantage of CAPA?
It runs malware in a live environment.
It focuses only on network analysis.
It automates the reverse engineering process.
It requires expert knowledge of reverse engineering.
34
What feature should be disabled to prevent persistent access by attackers?
Multi-Factor Authentication
Secure protocols
Startup scripts
Logging
35
What command is used in Linux to extract readable text from a file?
grep
find
echo
strings
36
What type of content in Microsoft Office documents can run computer commands?
Charts
Spreadsheets
Images
Macros
37
What does a disassembler do?
Compiles high-level code and encode it
Converts machine code into assembly language
Executes code in a Debian sandbox
Encrypts binaries for secure sharing
38
Which password policy setting ensures users cannot reuse recently used passwords?
Password complexity requirements
Enforce password history
Account lockout policy
Minimum password length
39
What is an attacker’s primary goal during the Defense Evasion phase?
Disrupt business operations
Avoid detection by security measures
Escalate privileges
Steal credentials
40
What is the first phase in the NIST Incident Management Framework?
Containment
Eradication
Detection and Analysis
Preparation
41
What is a Yara rule?
A debugger for executing malware in Windows
A pattern-matching tool for identifying malware behaviours
A file scanner for detecting viruses before downloading
A utility for generating malware hashes during analysis
42
Which phase includes exploiting vulnerabilities to gain unauthorized access to a system?
Installation
Exploitation
Actions on Objectives
Actions on Objectives
43
What does loT refer to?
Intranet of Things
Internet of Things
Input of Things
Instance of Things
44
Which tool helps view real-time changes on a webpage?
View Source
Network Tab
Debugger
Inspector
45
How many "well-known" ports exist in networking standards?
512
2048
1024
256
46
What should you do if you suspect ARP poisoning on your system?
Look for duplicate MAC addresses
Delete the Hosts file
Install a VPN
Enable SMB protocol
47
What is the primary objective of the "Recovery" phase in Incident Response?
Identify root causes of the breach
Contain the threat
Return systems to business as usual
Train employees on security policies
48
What does the Bell-LaPadula model emphasize?
Integrity
Confidentiality
Availability
Possession
49
What is the name of the commonly used wordlist included with John the Ripper?
rockyou.txt
passlist.txt
SecList
common.txt
50
What is the main purpose of the Installation phase?
Delivering the payload
Escalating privileges
Establishing persistence
Scanning for vulnerabilities
51
Which section in PE files contains imported libraries and APIs?
.text
.rsrc
.rdata
.reloc
52
Why is it essential to revert the VM to a clean state after analysis?
To increase analysis speed
To analyse the same malware again
To remove malware traces from the VM
To reduce memory usage
53
What does the Nmap switch -sS represent?
Service Detection
SYN Scan
UDP Scan
Aggressive Scan
54
Which type of authentication provides the highest level of security?
Single-factor authentication
Password-based authentication
Multi-factor authentication
Biometric authentication
55
Which of the following is a Windows-based malware analysis VM?
Kali Linux
Ubuntu
FLARE VM
REMnux
56
Why should organizations pay attention to insider threats
Only large companies with intellectual property are impacted.
They are rare and can be ignored.
Insiders are inherently trustworthy and not a risk.
They may lead to significant financial and reputational damage.
57
Zero-day vulnerabilities are unknown to software vendors.
False
True
58
What is the main goal of compliance in information security?
To reduce the cost of cyber incidents
To implement SIEM systems for monitoring
To align with legal, regulatory, and industry standards
To create baselines for system performance
59
What principle ensures that data remains accurate and consistent in the CIA Triad?
Reliability
Availability
Integrity
Confidentiality
60
Which Sysinternals tool logs system activity in real-time?
PsExec
ProcMon
WinObj
BgInfo
61
Which log file lists authentication attempts on Debian-based systems?
/var/log/secure
/var/log/kern.log
/var/log/auth.log
/var/log/messages
62
What does Gobuster use to perform brute force enumeration?
AI models
Wordlists
Database queries
Algorithms
63
How is Privilege Escalation defined?
Preventing unauthorized users from accessing a system
A)Securely encrypting credentials in a database
A method of locking down sensitive system areas
A process for bypassing restrictions to access higher-level resources.
64
Which are the common categories of Cross-Site Scripting (XSS) attacks?
Phishing, CSRF, Malvertising
Injection, Spoofing, Redirects
Stored, Token-based, URL-based
Reflected, Stored, DOM-based
65
What is the primary reason malware uses obfuscation?
To avoid detection and analysis
To encrypt communications
To facilitate propagation
To improve execution speed
66
What does the CIA triad stand for in cybersecurity?
Cybersecurity, Integrity, Access
Confidentiality, Integrity, Authentication
Confidentiality, Intelligence, Availability
Confidentiality, Integrity, Availability
67
The Biba model focus on preserving integrity in the CIA triad.
True
False
68
What is the primary goal of threat modelling?
To create attack scenarios for testing
To identify, prioritise, and address security threats
To test firewalls and intrusion detection systems
To audit organisational compliance
69
What is the primary role of network devices in a network?
To filter, transfer, and manage data across networks
To serve as user endpoints backups
To act as storage devices for business
To route data between different networks
70
What is the purpose of DNS Sinkholing?
Capture credentials from phishing websites
Block and redirect malicious domain traffic
Allow connections to suspicious domains
Improve network bandwidth
71
Which analysis method involves executing malware to observe its behaviour?
Dynamic Analysis
Static Analysis
Host-Based Analysis
Network-Based Analysis
72
What does the term "elevated privileges" mean?
Accessing system logs.
Running commands as a team manager.
Running commands with root permissions.
Installing software updates.
73
Which Nmap command can be used to scan IP addresses across a specified range?
nmap 192.168.1.0-50
nmap range 192.168.1.0-50
nmap -target 192.168.1.0/16
nmap -list 192.168.1.0/16
74
Kerberos use ticket-based authentication with symmetric key cryptography.
False
True
75
What is the main use of hashing in malware analysis?
Analyzing network traffic
Identifying unique files
Encrypting malware
Running malware
76
What is the purpose of a sandbox in malware analysis?
Cleaning malware
Isolating malware execution
Deleting malicious files
Encrypting data
77
How does a man-in-the-middle attack compromise communication?
By intercepting or modifying the data flow between a sender and a receiver
By hacking the recipient's system to access messages
By tampering with data directly at the origin
By launching a direct attack on the sender's device
78
What distinguishes DOM-based XSS from other types like reflected and stored XSS?
Happens only when interacting with local scripts
Relies on client-side processing; others use server-side input.
Occurs in the client-side DOM and does not involve server responses
Is easier to detect with firewalls compared to reflected and stored XSS.
79
What is a Dynamic Link Library (DLL)?
A file for storing dynamic user preferences
A library of reusable code and data for programs
A memory allocation unit that changes it size
A process that runs in the background
80
What is the Tor Browser primarily used for?
Watching movies
Anonymous browsing
Running phishing campaigns
Faster web access
81
What is the opposite of the CIA concept of Integrity?
Destruction
Possession
Alteration
Disclosure
82
What is a commonly used resource for locating dark web pages, such as sites offering fake IDs?
Maltego
Tor Wiki
Dark Web Index
Hidden Wiki
83
What is the primary benefit of implementing LDAP signing in AD?
Allows plain-text communication
Prevents replay and MiTM attacks
Disables access to legacy systems
Enforces default settings
84
Which SQL injection command retrieves the DBMS version?
'show dbms version() -- '
'get dbms version() -- '
'union select version() -- '
'display version() -- '
85
IP addresses and hashes fall under which type of threat intelligence?
Tactical
Strategic
Technical
Operational
86
What does the term IOC stand for?
Internet Operations Control
Indicators of Compromise
Intrusion Observation Chart
Internal Operational Center

Final review 3 Flashcards | StudBud