Module 5

Network device or software acting on behalf of clients to retrieve requested content from an origin content server (OCS)

Attacker with sufficient resources can incessantly ‘guess’ auth tokens until one of the attempts proves successful.

Provides a secure encryption communication method for TCP connections, especially for HTTP.

A DoD info system used to record, track and disseminate critical vulnerability info through the DoD Enterprise network.

Which are common Intrusion Detection Tools (IDS)

What are the types of vulnerability assessments?

Contains elements of both Dynamic and Static testing

What is a Secure Technical Implementation Guide (STIG)?

___% is the compliance threshold that the base CFP needs to meet assisted by the NOS. NOS sets the compliance threshold.

Assessment of policies and practices to prevent unauthorized access to private or public networks.

Identifying of security vulnerabilities in web applications and their source code.

Secondary sites that connect to primary site.

Type of application security that validates who someone says they are.

Primarily utilized to protect the endpoint from unauthorized device insertions.

An attacker can maliciously inject JavaScript into an application running on the victim’s browser.

Are responsible for identifying the information systems controlled by a Program Management Office (PMO) within their AOR

What are application security tools? (Choose Two)

Activity is actually an attacker (most dangerous).

A comprehensive security management solution that runs on network computers to identify and stop threats automatically.

The Vulnerability Remediation Process includes which three phases.

Tool used as an analytical utility to process data collected by Snort.

____ & ____ are intended for cybersecurity professionals responsible for auditing computer attacks.

Application security that validates what a user has permissions to do.

Consists of primary sites that house MECM database, data for its connected sites, and distribute global data between

An attacker with physical access to a victim’s device can steal auth tokens in multiple ways

These make Information Assurance (IA) easier to implement providing security for IT systems.

Platform used by the Air Force to monitor and maintain the thousands of systems across the network.

Widely adopted security protocol designed to facilitate privacy an data security for communication over the internet.

Forgo all testing and release patch within 24 hours with a mandated minimum of 70% of machines.

Successfully ignoring acceptance behavior.

Monitors the network in real-team, continuously looking for new vulnerabilities without a need for active scanning.

5 operational units support daily operations of the ESS service and monitors/maintains health and operations of ESS

Technique used to control network access by monitoring outgoing and incoming packets, either by allowing or blocking.

Target all machines that require an update, are not part of an exemption, and are not designated a PMA/medical.

Analyzes running code while simulating outside, or “black box” attacks.

Designed to support a faster pace of system updating and patch management for our network connected Windows devices.

Administrators should maintain the security of the IDS components on an ongoing basis.

Assessment of critical servers, which may be vulnerable to attacks if not adequately tested.

Designed specifically for mobile environments and can examine how an attacker can leverage mobile OS and apps.

What are the forms of applications testing.

Which port is Secure Shell (SSH)?

This attack is not used to steal auth tokens, instead, it allows an attacker to piggyback on existing active sessions.

A vulnerability assessment is a systematic review of security weaknesses in a information system.

Involves someone intercepting data being sent between two parties.

Allow the user to log into a specific machine and all them to access resources on that machine only.

Successful identification of an attack.

Automated compliance scanning tool that leverages the STIGs and OS-specific baselines to analyze and report.

Logs events to determine who did what, when they did it, and how.

The configuration standards for DOD IA and IA enabled devices/systems.

Intrusion control specific to a host

C.I.A Triad includes all the following…

Single console access used by the ACAS managing Nessus scans at the enterprise network level.

Process that occurs between server and client. Encrypted and authenticated data is signed by the Message Auth Code.

Valid on any computer in the domain for which the account was created.

This tool can be used to conduct both local and remote scans.

Comprehensive vulnerability scanner.

The most common method of tracking a customer accessing an organization’s website is be assigning a unique ________.

Target all systems, unless stated otherwise by the tasking authority.

Some password requirements are:

False alarm

Last rule of any Access Control List (ACL) is …

Base communications squadrons ensure McAfee Endpoint Products are applied to client systems.

Central Administration Site (CAS) @ Wright Patterson is used for large-scale deployments and provides a central point.

Two-phased patch testing approach

Tools used for scanning network traffic.

Heuristic-based detection that first identifies normal operations and creates a performance baseline from weird behavior

Designed to act as a comprehensive STIG compliance tool that provides security monitoring and event monitoring.

Definition-based detection that uses a database of known vulnerabilities or attack patterns.

Responsible for maintaining the security posture of the Department of Defense Information Network (DODIN).

Assessment of databases or big data systems for vulnerabilities and misconfigurations

A type of code that is inserted into the code of an existing software program.

Open source HIDS that performs log analysis, file integrity checking, policy monitoring, and active response.

3 managing Units provide ESS configurations, updates, and master sources repository and serves as POC for ESS PMO.

This account type is very powerful and can execute any command.

Test patch for 48 hours

Developed by Sourcefire; combining the benefits of signature-based protocol and anomaly-based inspection.

Internet standard that enables LAN to use one set of IP addresses for internal traffic and a 2nd set of external traffic

Improves situational awareness of DISA STIG compliance requirements.

___ automatically identifies configuration vulnerabilities threatening the security of the DoD’s computer systems.

The USAF ESS Organization Tier Structure has how many tiers?

A java-based application that can be used to conduct a manual audit of information system security controls.

A piece of software within ESS that can be utilized for scanning clients and returning info from currentstate to windows

The MECM Hierarchy consists of which 3 tiers?

This protects a user’s sensitive data from being seen/used by a cyber criminal.

A software or hardware-based network security system controlling incoming and outgoing network traffic.

Mitigation factors that have been implemented and a fix date when the vulnerability will be remediated.

Suite of centrally managed Defense Cyber Operation tools that provide a means of denial of adversary action of the DoDIN

The goal of vulnerability remediation/mitigation process is to mitigate risk to the _____.

The contributing factors are designed to assist in evaluating the commands emphasis on compliance of the IA controls.

Open Source, Unix based Network IDS that passively monitors network traffic and looks for suspicious activity.

Three overall IA areas being evaluated during a Command Cyber Readiness Inspection (CCRI).

Which of the following are boundary interaction best practices.

DoD information system used to record and track critical vulnerability info throughout the DoD enterprise.

Analyzes code at fixed points in development.

Minimizes network-based attacks and prevent system access, maintenance processes, and network design and requirements.

Process of developing, adding, and testing security features within applications. (Increased exposure=increased risk)

If a hacker obtains a customer’s sessions ID information, the attacker is then able to hijack and manipulate the session

This should be setup between your internal network and the internet.

Fuzzing is NOT testing the results of unexpected values or inputs.

Techniques to enhance security at the coding level.