stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
MILLERS BLOCK 5 KEY TO SUCCESS Flashcards | StudBud
Explore
/
MILLERS BLOCK 5 KEY TO SUCCESS
MILLERS BLOCK 5 KEY TO SUCCESS
99 terms
·
StudBud Administration
·
25 plays
YE YE 100% TOP GRAD STATUS YEAH
Flashcards
99 cards
F
Practice quiz
P
Host live
L
Questions
99
Answers
1
The second step of building and securing a new server.
Employ secure administration and maintenance processes
Install configure and secure the OS
Employ appropriate network protection mechanisms
Install, configure, and secure the server software.
2
This type of Application Security Testing analyzes code at fixed points during its development.
Dynamic Testing
Static Testing
IDE testing
Fuzzing
3
This type of app security is implemented after a user has been authenticated,and is given access to use an application.
Authorization
Secure Sign On
Authentication
Accounting
4
A CCRI evaluates three overall Information Assurance areas: Culture, Capability, and Conduct.
True
False
5
This type of Application Security Testing is designed specifically for the mobile environments.
Mobile Testing
Phone Probing
Cellular Application Testing (CAT)
Mobile OS Testing
6
The term ______ refers to a connection for ongoing data exchange between two parties (client and server).
Client
Session
Network
Session ID
7
A too-narrow of a boundary could exclude system resources from the level of protection required by the system owner.
False
True
8
___ is an internet standard that enables a LAN to use one set of IPs for internal traffic and a second set for external.
Proxy Server
Network Address Translation (NAT)
Firewall
NAC
9
When it comes to web application security BEST practices you need to ensure you're using the strongest _____ algorithms.
IP
Hashing
Encryption
NAT
10
________ will generally entail installation of software patches & removal of files or tools used for malicious purposes.
Error Remediation
Preventative Measures
Countermeasures
Patching
11
If an attacker gained _______ ________ to a victim’s device they could steal a user’s authentication tokens.
Remote Access
Prolonged Access
Computer Access
Physical Access
12
This Server Security Principle states that security mechanisms should be as simple as possible.
Simplicity
SMSC
“Less the Better”
PSS
13
This Server Security Principle states that each user is granted the minimum rights required to perform its job.
Most Privilege
Least Privilege
14
The third step of building and securing a new server.
Implement the solution
Update the operating System
Build a plan
Install configure and secure the servers software
15
The sixth step of building and securing a new server.
Plan the installation
Configuration of the OS
app patching & upgrading, log monitoring, security testing, OS backups
Configuration of the software
16
__ steps are required to ensure the security of any new server.
4
3
5
6
17
is the monitoring and control of comms at the external boundary of an info system to prevent and detect malicious comms.
Boundry Scanning
Pertimiter Control
Firewall Rule Management
Boundary Protection
18
A _________ _______ is a physical or logical subnet that separates an internal network from the internet.
TLS Tunnel
Network Gap
Demilitarized Zone
Firewall Container
19
The key to boundary defense is a multi-layered approach segmenting your networks and controlling the flow of your data.
True
False
20
Its important to ____ ____ & records so that if a attack does occur evidence is available to the organization.
Maintain Logs
Encrypt Logs
Secure-wipe Logs
Destroy Logs
21
The first step of building and securing a new server.
Employ secure administration and maintenance processes
Plan the installation
Ensure that the content is properly secured
Install, configure, and secure the underlying OS
22
______ ________ is the control of traffic coming into or leaving a network.
Traffic Filtering
Boundary protection
Network Scoping
LogicBased- Firewall
23
Monitors the network in real-time, continuously looking for new hosts, applications and new vulnerabilities.
ESS
CFP
Vulnerabilities Management System (VMS)
Passive vulnerability Scanner (PVS)
24
In this session attack a bad actor can maliciously inject JavaScript into an application running on the victims browser.
Session ID Manipulation
Session Hijacking
XSRF
XSS (Cross-Site Scripting)
25
A _ __ is a set of algorithms that hold details such as shared encryption or session keys, will be used in THAT session.
Public and Private Key Repository
Cipher Selection
Certificate-Authentication Library (CAL)
Cipher Suite
26
A _____ is a flaw in systems security design or internal controls that could be used by an adversary to breach the AFIN.
Threat
Exploit
Vulnerability
Risk
27
Which of the following is an example of a firewall function?
All of These are Examples
packet & content filtering
proxy services
Network Address Translation
28
_____ are responsible for remediating assets that are supported by a weapons system.
Program Management Offices (PMOs)
Vulnerability Remedial Operations (VROs)
Network Operations Squadron (NOS)
Communications Focal Point (CFPs)
29
_____ will manage vulnerabilities identified on devices that cannot be managed by NOSs.
PMO
VMO
CFPs
VRO
30
To identify an infosystems boundary you must know where data is stored, where system data flows & critical dependencies.
True
False
31
In this attack the attacker piggybacks on sessions with goal of “forging” a fake request to get you to click on it.
Session Hijacking
XSRF (Cross Site Request Forgery)
XSS
Brute Force
32
A ___ ___ ___ is a system that scans, audits, and monitors the security infrastructure for signs of attacks in progress.
Network-based Intrusion detection system (NIPS)
Intrusion prevention system (IPS)
Host-based intrusion detection system (HIPS)
Intrusion detection system (IDS)
33
Which of the following is not a component of TLS?
Accounting
Encryption
Authentication
Integrity
34
This type of Application Security Testing analyzes running code while simulating outside, or “black box” attacks.
Hybrid Testing
Interactive Testing
Dynamic Testing
Static Testing
35
The most common method of tracking a customer accessing an organization’s website is by assigning a unique _____ __.
Session-ID
Identification Number
Logon Cache
Site-specific Cookie
36
The ___ __ will task NOSs with Priority and Emergency vulnerability remediation actions.
691st NOS
690 NSS
616th OC
561st NOS
37
The DoD uses an application called _______ to support Info Assurance and automate the Risk Management Framework process.
AFINC
VMS
eMASS
ESS
38
Installing software updates and patches is one of the most effective ways to keep your software secure.
False
True
39
A ______ ______ aims to detect security holes from day 1 in order to prevent security issues and to resolve them ASAP.
DevSecOps Approach
IDS & IPS
ZERODAY DESTROYER
Firewalls & Boundry Protection
40
The fourth step of building and securing a new server.
Update OS
Update Software
Implement a plan
Server specific but ensure content is secured
41
The _ tool automatically identifies configuration vulnerabilities threatening the security of the DoDs computer systems.
IDS
ACAS
SEM
Solar winds
42
This VR tasking requires the patch to be tested for 48 hours. PMO's have 24 hours to deploy it w/ a min 80% compliance
Available
Emergency
Priority
Mandatory
43
All simple tasks should be _______ in order to allow teams to focus on more challenging undertakings.
Marked as top priority
Marked as low priority
Completed Manually
Automated
44
Once data is encrypted and authenticated, it is then signed with a ______ _________ _____.
Mandatory access control (MAC)
Message authentication code (MAC)
Certificate sign off (CSO)
Media Access Control (MAC)
45
________ attacks involve someone intercepting data being sent between two parties.
Bluejacking
BlueSnarfing
(MITM) Man in the middle
Evesdroping
46
______ _____ are encryption keys that use one-way encryption.
SHA256 Keys
Private Keys
AES keys
Public keys
47
A DoD info system used to record and disseminate critical vulnerability info throughout the DoD Enterprise network.
ESS
VATs
VSM
Vulnerability Management System (VMS)
48
_____ creates pre-configured operating system images that are compliant with all applicable TCNOs and STIGs.
ARAD
AFCEDS
TCNO
AFECMO
49
Single console access. Provides real-time detection of network anomalies and is scalable.
Application Center
Security Center
SEM
VMS
50
In what attack will a hacker obtain a users Session ID info and then use it to hijack and manipulate the active session?
XSRF
XSS
Session Hijacking
Session ID Manipulation
51
Risk Management Framework (RMF) consists of 5 steps: Prepare, Categorize, Assess, Authorize, and Monitor.
False
True
52
_ is designed to support a faster pace of system updating & patch management for our network connected Windows devices.
AFECMO
RDP
ACAS
MECM
53
To secure a server, it is essential to define the threats that must be mitigated.
False
True
54
The fifth step of building and securing a new server.
Implement a plan
Update the OS
Update security measures
employ network protection mechanisms
55
Many threats against data and resources are possible because of mistakes.
True
False
56
A __ ___ says organizations should understand what it would take to break their system or network’s security features.
Threat Factor
Work Factor
Disaster Plan
Intrusion Plan
57
A ________ is a network device or software acting on behalf of clients to retrieve requested content from the internet.
Hypervisor
Proxy
Web Server
NAT
58
The ______ ____ are responsible for monitoring client health and assisting the NOSs with remediation of vulnerabilities.
616th and 690th
NOS & COS
VROs and PMOs
Base CFPs
59
A _____ is a DISA-led formal inspection designed to increase the security posture of DoD Information Networks.
ACAS
NOS
CCRI
AFECMO
60
Performing __________ and mitigation helps organizations better understand their network's security posture.
Analysis
risk assessments
Vulnerability Scanning
Vulnerability assessments
61
___ is a security protocol designed to facilitate privacy and data security for communications over the Internet.
TLS
SSH
TCP
SSL
62
NOSs will implement a goal of ___ compliance of vulnerability remediation actions using enterprise remediation tools.
85%
99%
95%
98%
63
Which of the following is an example of a “common attack” on sessions?
MITM
ALL OF THESE ARE COMMON ATTACKS
SOCIAL ENGINEERING/ PHYSICAL ACCESS
XSS & XSRF
64
The ______ ________ is the point where data transfers from the intranet to the internet and vice versa.
Transfer Point
System Perimeter
Data Bridge
System Boundary
65
A boundary that is too large could inherit risk from systems that are outside the administrative and technical controls.
True
False
66
This VR tasking requires an enterprise patch within 24 hours, with a mandated minimum 70% compliance amongst machines.
Emergency
Normal
Priority
Urgent
67
_ is when devs test the results of unexpected values or inputs to discover which ones cause the application to "act up".
Stress Testing
Fuzzing
Interactive Testing
Dynamic Testing
68
Since devs are responsible for pushing code into production, it is critical that they receive proper security training.
True
False
69
________ is used to control network access by monitoring outgoing and incoming packets and then allowing/ blocking them.
Content Filter
Demilitarized Zone
Packet filtering
Proxy Server
70
In this attack a bad actor w/ resources can endlessly ‘guess’ auth tokens until one of the attempts proves successful.
Man In The Middle
XSRF (Cross-Site Request Forgery)
XSS (Cross-Site Scripting)
Brute Force Attack
71
__ are hired to break into an app in order to detect vulnerabilities and find potential attack vectors for a company.
Pen-Testers
Black-Box Testers
WhiteHat Hackers
Ethical Hackers
72
- is a suite of centrally managed Defensive Cyber Operations tools that allow for the denial of adversary actions.
Network security tools
Endpoint Security (ESS)
Network vulnerability scanning tools
Network defense tools
73
Once the _ threshold is met by the NOS, remediation of the remaining clients are the responsibility of the local base.
5%
95%
70%
90%
74
This Server Security Principle states that job roles/functions should be as separate as possible.
Least Privilege
Separation of Privilege
Role Segregation
Need to Know
75
Small files stored on your computer from a website within a web browser that the website can retrieve at a later time.
Cookies
HTTP bits
Session Tokens
Session Cache
76
_________ deployments target all systems, unless stated otherwise by the tasking authority.
Emergency
Mandatory
Priority
Available
77
This Server Security Principle states that users should understand the necessity of security.
User Education
RTK (Right to Know)
Mandatory Developer Education
End User College
78
The easiest way to protect against Man in the Middle attacks is to use HTTPS and secure cookies throughout your apps.
False
True
79
_ _ _are techniques to enhance the security of an application at the coding level, making it less vulnerable to threats.
Security and Testing
Application Security Controls
Secure code implementation
Mobile Security Improvements
80
This Server Security Principle states that critical data backups should be maintained in the event of system failure.
SRP
Critical Data Protection
Backups
DLP
81
is implemented if there is a security breach in an app, logging can help identify who got access to the data and how.
Accounting
System Event Management
IPS Logging
Log Monitoring
82
This type of application security is implemented to protect sensitive data from being seen or even used by a bad actor.
Secure Data Transfer
Data Masking
Encryption
TLS Transport
83
The _____ create patch packages for all vulnerabilities impacting the AFIN using enterprise remediation capabilities.
Project Management Offices (PMOs)
Cyberspace Operations Squadron (COS)
Vulnerability Remediation Operators (VROs)
Network Operations Squadron (NOS)
84
is the process of developing, testing, and adding security features to applications to prevent security vulnerabilities.
Application security
Program Security
System Security
Software Security
85
_____ are software packages used on info systems or networks to scan looking for weaknesses like open ports.
COTS
VMSs
Vulnerability Assessment Tools (VATS)
IDS
86
A _____-____ is a software- or hardware-based network security system controlling incoming and outgoing network traffic.
Demilitarized-Zone
Fire-wall
Proxy-Server
Reverse-Proxy
87
This Server Security Principle states that if a failure occurs, the system should fail in a secure manner.
Contingency Plan
Safe Server Automation
Fail plan
Fail Safe
88
For a website or application to use TLS, it must have a TLS Certificate installed on its origin server.
True
False
89
The 690th will direct base CFPs & PMOs to implement __________ a VR tasking. These actions will take 11 days to rectify.
A VMS system
Emergency
Normal
Priority
90
__ _ ____ utilizes multiple independent layers of security controls so that if one fails another will be operational.
Strong Security Posture
Untouchable Gigachad Security
The DoD always
Defense in Depth
91
_ is a comprehensive vulnerability scanner. It performs config scans of servers, network devices and databases.
NMap
ZEEK
Nessus®
tcpdump
92
The entry to the boundary on a network is the first point that you control (usually the external router).
False
True
93
A TLS connection is initiated using a sequence known as the ___ ___________.
TLS Handshake
SSL Bridge
TCP Handshake
TLS Milkshake
94
This type of Application Security Testing combines elements of both static and dynamic testing.
Static Testing
Dynamic Testing
Hybrid Testing
Interactive Testing
95
__ deployments target all machines that require an update, are not a part of an exemption, and are not designated a PMO.
Necessary
Priority
Available
Mandatory
96
Base NCCs/ CFPs are required to populate NOS patch testing groups with at least 3% of the base's total assets.
True
False
97
A primary use of TLS is encrypting the communication between web apps and servers, such as web browsers loading a site.
False
True
98
SSL is now depreciated and has been replaced by ________ ______ _________.
User datagram packets (UDP)
Secure Shell (SSH)
Transmission Control Protocol (TCP)
Transport Layer Security (TLS)
99
____ is implemented into an application to ensure that only authorized users gain access to it.
Authentication
Authorization
Accounting
ACS
