stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CIT Exam Review Flashcards | StudBud
Explore
/
CIT Exam Review
CIT Exam Review
23 terms
·
StudBud Administration
·
29 plays
Imported from external platform
Flashcards
23 cards
F
Practice quiz
P
Host live
L
Questions
23
Answers
1
PfSense is a firewall
False
True
2
Which of these do AVs search for? (more than 1)
Processes
Heuristics
Strings
Hashes
3
/var/log/auth.log is the location of what?
Windows event logs
UNIX/Linux authorization logs
Windows authorization logs
UNIX/Linux event logs
4
What kind of access controls are these: Fences, cameras, and motion detectors.
Deterrent
Corrective
Detective
Compensating
5
What is the weakest link in cybersecurity?
Poor patch maintenance
Zero-days
People
Unsufficient password policies
6
What does PPT stand for?
People, processes, and technology
Public and private technology
Permanent and portable technology
Procedures, packets, and topography
7
PfSense is open-source
True
False
8
Firmware is fixed data that is part of a hardware device and determines how it functions and communicates
False
True
9
Which of these requires DLP protection? (more than 1)
Web Pages
PHI
PII
Intellectual Property
10
Which is an email validation technique?
DKIM
MailSec
DNSSec
MIDS
11
What is log parsing?
Updating and old log with a new capture
Creating a summary of logs for faster analysis
Converting logs into human-readable text
Separating data into parts that are easier to read/handle
12
Which is most dangerous?
True Negative
True Positive
False Negative
False Positive
13
What is the purpose of a log query?
To confirm that a log has been collected
To retreive information from SIEM
To compare a new log with existing stored logs
To gain additional information about an unknown event
14
Why should companies use SIEM tools?
Replaces HIDS/HIPS
To prevent RAT attacks
Acts as an email firewall
Incident detection
15
Which of the following should be used to analyze network traffic in real time?
Splunk
PacketTracer
Snort
Demisto
16
An SIEM alert is a notification of an event occuring in an organization.
False
True
17
What makes a Zero-day different from other vulnerabilities?
An attack would be ineffective and cause zero days of disruption
Only sophisticated attackers could exploit it
There is no solution
They have not been identified or reported on before
18
What is log aggregation?
The real-time filtering of logs to reduce the size of what is saved/stored
An attack technique that overwrites logs to prevent detection
Collecting logs without informing users
Collecting of logs with similar structures
19
This command would cause a mail spoofing attack: EHLO server, MAIL FROM:
[email protected]
, RCPT TO:
[email protected]
False
True
20
Which is NOT true about protecting an organization against malicious emails?
All emails should be encrypted
Email attachments should be opened and checked for validity
Strong password policies should be in place
Spam filters and malware scanners should be used
21
To identify new methods of attack, what should a company use?
OSINT
Pentesting
NIDS
Honeypots
22
Which is more restrictive?
Allow Lists
Block Lists
23
What is a canary trap?
Intentionally vulnerable data stolen first in a data mining attack
A honeypot for twitter
A method of disguising a production device as a honeytrap
Exposing data leaks by giving out different versions of sensative data
