What should analysts do if a triggered alert is identified as a False Positive?

Send the use case for fine-tuning

Why do malware authors often use hard-coded strings?

To store critical information like IP addresses

Why is it important to understand insider threats?

They can cause serious reputational and financial harm to the company.

What is the main purpose of Process Explorer?

Detailed inspection of processes

Which OWASP vulnerability is associated with applications relying on unreliable plugins or extensions?

Software and data integrity failures

What distinguishes a dictionary attack from a brute-force attack?

Dictionary uses wordlists; brute-force tries all combinations

What is the purpose of hashing in malware analysis?

To uniquely identify malware samples

What is the primary goal of the Delivery phase in the Cyber Kill Chain?

Transmitting the payload or malware

Why are brute force attacks often slow for attackers?

They guess passwords one at a time from a large set

What functionality does the Metasploit command use auxiliary/scanner/ftp/anonymous provide?

Checking FTP servers for open anonymous access

A penetration tester found weak file permissions and misconfigured SSL on a web server. How should this be fixed?

Apply server hardening techniques

1.What is the primary challenge of using hash values as indicators?

They can be easily modified by altering a file’s content

What is the primary purpose of a Domain Controller in Active Directory (AD)?

To supervise the network and authenticate users

What aspect of the MITRE ATT&CK framework helps prioritise vulnerability remediation?

Real-world adversary tactics and examples

What is the primary purpose of an Intrusion Detection System (IDS)?

Detect malicious activity and alert

What is an example of Availability in the CIA triad?

Ensuring servers are operational during business hours

Why is the sudoers file important in Linux?

It manages user permissions for elevated commands

What is Kerberoasting in the context of AD attacks?

Cracking encrypted passwords offline

What is ProcMon used for?

Observing real-time malware activities

studbud

Final review 2

86 termsStudBud Administration16 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
Which malware used the Eternalblue exploit in a Mass Campaign?
DarkHotel
Cerber
Stuxnet
Wannacry
2
What should analysts do if a triggered alert is identified as a False Positive?
Block the associated IP address
Ignore the incident
Escalate the incident
Send the use case for fine-tuning
3
Why do malware authors often use hard-coded strings?
To store critical information like IP addresses
To avoid firewall and IPS detection
To improve encryption during execution
To increase execution speed on sandboxes
4
What is the term for registering domain names with minor spelling errors?
Spelling attack
Typosquatting
Social spoofing
Domain mirroring
5
Which type of analysis involves executing malware in a controlled environment?
Advanced Dynamic Analysis
Basic Dynamic Analysis
Advanced Static Analysis
Basic Static Analysis
6
Which IPS detects and blocks traffic deviating from normal baselines?
Heuristic
Pattern-matching
Anomaly-based
Signature-based
7
Why is it important to understand insider threats?
Only large businesses that have intellectual property are affected by them
Insiders are always reliable and trustworthy and do not pose a threat.
They rarely happen, so they can be disregarded.
They can cause serious reputational and financial harm to the company.
8
Which of the following is NOT a classification of threat intelligence?
Incident Intel
Tactical Intel
Operational Intel
Strategic Intel
9
Which cyber threat actor is motivated by financial gain?
Thrill-seekers
Terrorist groups
Cybercriminals
Hacktivists
10
What is the main purpose of Process Explorer?
Detailed inspection of processes
Securing alternate data streams
Analysing TCP connections
Deleting malicious files
11
What type of IDS monitors traffic to and from a single host?
Network-based IDS
Application-based IDS
Host-based IDS
Inline IDS
12
Which OWASP vulnerability is associated with applications relying on unreliable plugins or extensions?
Security misconfiguration
Software and data integrity failures
Injection
Cross-Site Scripting (XSS)
13
What is a classification of Threat Intelligence that focuses on high-level risk areas?
Operational Intel
Tactical Intel
Strategic Intel
Technical Intel
14
What distinguishes a dictionary attack from a brute-force attack?
Dictionary is for online forms; brute-force for offline cracking
Brute-force targets usernames; dictionary targets passwords
Dictionary uses wordlists; brute-force tries all combinations
Dictionary and brute-force attacks follow the method to guess credentials
15
What is the purpose of hashing in malware analysis?
To execute known malware
To uniquely identify malware samples
To encrypt the malware code from the samples
To create encrypted virtual environments
16
What is the primary goal of the Delivery phase in the Cyber Kill Chain?
Performing privilege escalation
Gaining unauthorized access
Transmitting the payload or malware
Destroying the target's system
17
Why are brute force attacks often slow for attackers?
They depend on analysing system vulnerabilities first
They rely on weak encryption algorithms to succeed
They guess passwords one at a time from a large set
They require specialized hardware to execute quickly
18
What tool is most commonly used to investigate malware persistence mechanisms on Windows?
Wireshark
Autoruns
Task Manager
Regedit
19
What functionality does the Metasploit command use auxiliary/scanner/ftp/anonymous provide?
Identifying SQL injection points
Launching a brute-force attack
Checking FTP servers for open anonymous access
Setting up a malicious listener for FTP traffic
20
Which phase involves removing or stealing sensitive data?
Defense Evasion
Reconnaissance
Exploitation
Exfiltration
21
Which incident response phase involves removing the active threat?
Identification
Containment
Recovery
Eradication
22
What kind of XSS occurs when an attacker places html code affecting all users viewing the page?
Immediate XSS
Reflected XSS
Stored XSS
Dynamic XSS
23
Which of the following is an example of information security regulation?
Penetration Testing
Incident Response Playbook
ISO 27001
PCI DSS
24
If you suspect your credentials have been exposed in a data breach, what tool should you use to confirm this?
Shodan
Wireshark
Metasploit
Haveibeenpwned
25
A penetration tester found weak file permissions and misconfigured SSL on a web server. How should this be fixed?
Apply server hardening techniques
Install the latest operating system updates
Implement HTTPS for all connections.
Enforce multi-factor authentication.
26
A "filtered" port means the service is open and accessible.
False
True
27
Which of the following is a common location for Linux system logs?
/usr/log
/sys/logs
/etc/log
/var/log
28
1.What is the primary challenge of using hash values as indicators?
They are time-consuming and resource intensive to generate
They are unreliable in identifying Windows files
They cannot identify malware, only APIs and DLLs
They can be easily modified by altering a file’s content
29
What is the primary purpose of a Domain Controller in Active Directory (AD)?
To supervise the network and authenticate users
To store files and applications
To manage email servers
To host websites
30
Which command is used to list parameters for a Metasploit module?
show parameters
list config
display settings
show options
31
Threat intelligence focuses solely on external threats
False
True
32
Which Windows API function indicates that malware interacts with the internet?
RegOpenKeyExW
CloseHandle
TerminateProcess
InternetOpen
33
What is the first step when using Gobuster?
Download website data
Provide a URL to scan
Input credentials
Disable firewalls
34
What aspect of the MITRE ATT&CK framework helps prioritise vulnerability remediation?
Real-world adversary tactics and examples
Detailed user feedback
Risk scoring systems
Checklist tables for system decomposition
35
What is the primary purpose of an Intrusion Detection System (IDS)?
Encrypt network traffic
Block unauthorized IP addresses
Detect and prevent malicious activity
Detect malicious activity and alert
36
Which of the following qualifies as multi-factor authentication (MFA)?
A username and a password
A fingerprint and a retina scan
A PIN and a security token
A smart card and a USB key
37
What is the purpose of a User-Agent string in network communications?
To generate IP addresses
To bypass firewalls
To identify the requester
To log user activities
38
What is an example of Availability in the CIA triad?
Using encryption to protect sensitive data
Ensuring servers are operational during business hours
Detecting unauthorized changes to records
Blocking unverified users from accessing systems
39
Which phase of the Cyber Kill Chain is often called the "final stage" for an attacker?
Actions on Objectives
Exploitation
Reconnaissance
Weaponization
40
What type of hash helps identify similar malware samples based on file chunks?
SHA1
SHA256
MD5
SSDEEP
41
Which Python function is used to print text to the screen?
output()
show()
print()
display()
42
Why is the sudoers file important in Linux?
It tracks successful and failed login attempts
It lists all installed packages installed by root
It manages user permissions for elevated commands
It stores all user’s encrypted passwords
43
What ensures that network traffic reaches the correct application on a server?
IP Addresses
Subnets
MAC Addresses
Ports
44
In which phase of ethical hacking does Gobuster fall?
Post-exploitation
Exploitation
Reconnaissance
Reporting
45
What is a common malware technique that manipulates the stack?
Stack Buffer Overflow
Heap Allocation
Instruction Reordering
Flag Modification
46
What part of the CIA triad is compromised during a denial-of-service attack?
Integrity
Confidentiality
Availability
Accountability
47
What is Kerberoasting in the context of AD attacks?
Brute-forcing Remote Desktop Protocol
Manipulating public shares
Cracking encrypted passwords offline
Intercepting SMB communication
48
Disabling internet access is the most effective way to secure an organization.
True
False
49
LUKS encryption ensures data is unreadable without the decryption key.
False
True
50
How would you search on Google to find PDF reports on cybersecurity?
cybersecurity document:type
cybersecurity file:doc
reports filetype:csv
filetype:pdf cybersecurity
51
What is ProcMon used for?
Encrypting malware samples
Monitoring malware API calls
Creating virtual machines for malware
Observing real-time malware activities
52
What is the purpose of inspecting a website's page source?
To find vulnerabilities and sensitive information
To change user credentials
To modify the website’s design
To check for firewall settings
53
What does the Principle of Least Privilege (POLP) mean?
Granting minimal access required to perform tasks
Granting all permissions by default
Using shared accounts for access within teams
Granting all users only guest privileges
54
What is the purpose of disabling unused services on the servers?
Improve boot time
Reduce potential attack vectors
Enable faster network speeds
Ensure better compatibility with updates
55
Implementing strong password policies can mitigate the broken access control OWASP vulnerability.
True
False
56
Recovery is the first step in the Incident Response process.
True
False
57
What is the primary purpose of a hash?
Execute programs securely
Encrypt data for secure communication
Store data in databases
Represent data in a fixed-length form
58
What is the main purpose of a Virtual Machine in malware analysis?
To enhance system performance for analysis
To automatically remove malware from USBs
To analyse malware in a live environment
To create a safe, revertible environment for analysis
59
What kind of server hosts Active Directory services?
Database Domain
Domain controller
Account Controller
System server
60
Which process is responsible for storing user credentials?
lsass
MsMpEng
wininit
explorer
61
What are "insider threats" typically motivated by?
Geopolitical goals
Ideological beliefs
Discontent
Financial gain
62
What is the primary function of scoping in incident response?
Reporting incidents to external authorities
Eradicating the threat actor
Determining the incident’s impact and extent
Containing malicious processes
63
How many total ports are available on a network-enabled device?
50000
65535
1024
Unlimited
64
Which protocol is often blocked by default on firewalls, requiring a workaround?
FTP
ICMP
TCP
UDP
65
What philosophy provides the most ROI in cybersecurity?
Reactive response
Minimal security measures
Secure by design
Avoiding technology
66
Hashes are designed to be easily reversible.
True
False
67
When buying stuff online, how would you search for a price range within a 200€-500€ range?
200€ ... 500€
200€-500€
200€ .. 500€
200€/500€
68
What is a common issue with insufficient logging?
Alerts are too frequent
Threat actors cannot remove logs
Logs are too detailed to analyse
Incidents cannot be detected promptly
69
What is a Portable Executable (PE) file?
A python script for Linux
A compressed archive
An encrypted text document
An executable file format for Windows
70
What is the main responsibility of C-level executives within a company?
Performing hands-on technical tasks
Monitoring day-to-day business activities
Overseeing departmental operations
Setting strategic objectives and major policies
71
What is the purpose of PowerShell ISE?
To compile scripts into executables
To manage remote servers
To debug scripts
To write and test PowerShell scripts
72
Security alerts automatically initiate the incident response process.
False
True
73
Which is NOT a common hashing algorithm?
SHA1
MD5
ZIP
SHA256
74
Dynamic analysis involves analysing malware without executing it.
True
False
75
What are Indicators of Compromise (IoCs)?
Tools for incident management
Alerts for unauthorized logins
Reports on resolved incidents
Signatures used to identify malicious activity
76
What is the purpose of the PE Header in an executable?
To allocate virtual memory
To define the file format and structure
To manage executable threads
To store data sections for analysis
77
What kind of logs are essential for detecting sinkholed domains?
DNS logs
Email gateway logs
Proxy logs
Firewall logs
78
Where is the Windows Hosts file located?
C:\Windows\System32\Drivers\etc\hosts
C:\System\Config\Hosts
C:\Drivers\System32\hosts
C:\Windows\Hosts
79
What is the hexadecimal header for an executable file?
4D 5A
1A 3C
FF EE
5C 7D
80
What is the main goal of "Confidentiality" in the CIA Triad?
Ensuring data is available when needed
Ensuring backups are created for critical systems
Ensuring data is not altered without authorization
Ensuring data is only accessible by authorized individuals
81
Process Hollowing involves replacing a legitimate process's memory with malicious code.
False
True
82
What principle ensures users only have access necessary for their role?
Least Privilege
Defence-in-Depth
Trust but Verify
Layering
83
How does Tor achieve user anonymity?
By using a private search engine
By routing traffic through volunteer-operated relays
By encrypting local files
By disabling cookies
84
Malware obfuscation hides malware within the file system
False
True
85
Which Windows tool is used to view and manage event logs?
msconfig
regedit
eventvwr
secpol.msc
86
What are "strings" in the context of programming?
Raw binary data
Graphical elements like icons
Malware functions only
Readable data such as text and numbers

Final review 2 Flashcards | StudBud