cysa

What does NGFW stand for?

Within a IR team, communication needs to be:

Which tool can be used on wired and wireless environments to crack passwords? 

Which of the following is included in the development phase of the SDLC?

Which early remote service call method uses XML over HTTP? 

Logins from various locations around the world that don't match with a company's internal policies are an IOC because:

What type of threat research can you carry out using VirusTotal?

Which of the following is a principle of forensics?

Amazon Lambda is an example of what architecture? 

What is the best way to keep SIEM and EDR rules and configurations up to date?

When controlling a crime scene, it is important to consider:

Communication between a host that might be compromised on the network & an external controller is called:

What threat modeling technique was developed by Microsoft? 

What are the two most popular types of attacks on physical access systems? 

Which application software layer most likely interacts directly with an enterprise database to create summary reports? 

Which approach to scanning reduces network traffic?

What are some of the key elements to a good incident response plan?

What is the most common data query language? 

What agreement with your cloud service provider may prohibit you from scanning your cloud assets? 

The risk evaluation process is a review process of which of the following:

What is a common method used to limit malicious data leakage? 

What is hashcat used for?

Geoblocking is one approach to which type of access control? 

A framework is often described as which of the following:

Which of the Web application scanners in this section requires the most manual intervention? 

Why should default user accounts be deleted after installing software? 

What policy specifies whether it is okay to access Facebook from a work computer? 

What does the default /var/log directory hold?

After securing the crime scene, why is seizure the first step in a forensic investigation?

Which European Union regulation protects individual data privacy? 

Which type of threat actor commonly has access to the greatest funding and uses the most sophisticated attacks?

Which hardware tampering technique can be thwarted by random signals resulting in voltage applied to chips

Which of the following is a network-related symptom of compromise?

What common data structure makes it easy to define permissions in the Windows operating system? 

Which of the following is true about Advanced Persistent Threats?

What technique uses anonymized responses from subject matter experts to assess risk? 

Which cloud service model provides the operating system and even databases, but no applications? 

Allowing access to a record that bypasses authentication by using a direct record ID is what type of vulnerability?  

Which of the following are examples of circle of trust members for an Incident Response:

What is the first step in the Intelligence Cycle? 

What are the 3 categories of controls?

What does OWASP stand for?

Unexpected outbound transmissions are difficult to detect because:

Which cryptographic technique uses a pair of keys, one to encrypt data and the other to decrypt data? 

Which access method defines object classifications and user clearances? 

A Cisco firewall is what type of firewall? 

Out of memory alerts are symptoms of compromise in which type of attack?

What term refers to a programmable chip that supports the ability to be modified in the field?  

What resource is a community-driven effort that provides a wide variety of hardening guides and configuration baselines?

When code is in development, what is done in the vulnerablity review?

Which type of threat hunting hypothesis is based on lessons learned from previous hunts? 

Unauthorized access is a symptom of compromise in what type of threat?

What is a common command-line utility used to build HTTP requests to invoke remote functions via APIs? 

Which response category describes a reported insecure Web server that wasn’t actually present in your network?

What is a common open source IPS that makes it easy to build rules to detect and prevent intrusions? 

How do you determine which vulnerability to mitigate first? 

What term describes intelligence sources that are only available to an organization’s internal personnel?

Which cloud assessment tool would be the best choice for a Google Cloud environment? 

What is the main purpose of impact analysis? 

When executing a scan, which of the following is considered a best practice:

Which logical network architecture provides a secure tunnel between two endpoints? 

What term refers to the feature that avoids firmware overwrite failures that result in unbootable devices? 

What report results in a prioritized list of the most important and vulnerable critical business functions? 

Which of the following is an indicator of compromise?

What is an effective way to prevent a mobile device held as evidence from being remotely wiped? 

Which of the following is an appropriate method to protect your network assets:

What does the security of encrypted data most depend on? 

Splunk Phantom is what type of security tool? 

Which type of system may contain vulnerabilities due to the autonomous operation of remote facilities? 

Which risks should get the most attention? 

Which attack framework is based on the military’s F2T2EA? 

How does an attacker attempt to carry out an integer buffer overflow attack?

How does threat hunting differ from most other security activities? 

What is a botnet? 

A SIEM is useful because provides which of the following:

Which term refers to malware that operates exclusively in memory? 

In the verification phase, an audit is used to do what?

Which authentication attack type spreads out repeated login attempts across different computers on a network? 

What tool is commonly used in mapping and enumeration?

What is the origin of the encryption key for SED? 

What is Little Snitch?

Which active scanner is a supercharged version of a simple network utility that allows you to craft custom packets? 

How does a machine learning algorithm “learn”? 

ArcSight, Qradar, Splunk, Alienvault, OSSIMKiwi Syslog, & ELK are all examples of:

A well-defined scan will help with determining which of the following:

What policy defines when data should be deleted? 

What NIST protocol defines modules that dictate compliance requirements and settings? 

What e-mail attack attempts to trick users into clicking links that refer to an attacker’s resource? 

Which of the following best describes hacktivism?