What aspect of the MITRE ATT&CK framework helps prioritise vulnerability remediation?

Real-world adversary tactics and examples

Why is it important to understand insider threats?

They can cause serious reputational and financial harm to the company.

What is the primary purpose of a hash?

Represent data in a fixed-length form

What is the primary purpose of a Domain Controller in Active Directory (AD)?

To supervise the network and authenticate users

What is a common issue with insufficient logging?

Incidents cannot be detected promptly

What is the purpose of disabling unused services on the servers?

Reduce potential attack vectors

What is the main responsibility of C-level executives within a company?

Setting strategic objectives and major policies

What is the main purpose of Process Explorer?

Detailed inspection of processes

1.What is the primary challenge of using hash values as indicators?

They can be easily modified by altering a file’s content

What is the purpose of PowerShell ISE?

To write and test PowerShell scripts

Why do malware authors often use hard-coded strings?

To store critical information like IP addresses

What is the primary function of scoping in incident response?

Determining the incident’s impact and extent

Where is the Windows Hosts file located?

C:\Windows\System32\Drivers\etc\hosts

What is ProcMon used for?

Observing real-time malware activities

How does Tor achieve user anonymity?

By routing traffic through volunteer-operated relays

Why are brute force attacks often slow for attackers?

They guess passwords one at a time from a large set

What is a Portable Executable (PE) file?

An executable file format for Windows

What is the purpose of inspecting a website's page source?

To find vulnerabilities and sensitive information

What is the purpose of the PE Header in an executable?

To define the file format and structure

What is the purpose of hashing in malware analysis?

To uniquely identify malware samples

What distinguishes a dictionary attack from a brute-force attack?

Dictionary uses wordlists; brute-force tries all combinations

What is the main purpose of a Virtual Machine in malware analysis?

To create a safe, revertible environment for analysis

What should analysts do if a triggered alert is identified as a False Positive?

Send the use case for fine-tuning

studbud

Final review 2

86 termsStudBud Administration16 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
What aspect of the MITRE ATT&CK framework helps prioritise vulnerability remediation?
Real-world adversary tactics and examples
Checklist tables for system decomposition
Risk scoring systems
Detailed user feedback
2
Which process is responsible for storing user credentials?
wininit
explorer
MsMpEng
lsass
3
Which malware used the Eternalblue exploit in a Mass Campaign?
Stuxnet
Wannacry
DarkHotel
Cerber
4
Why is it important to understand insider threats?
Only large businesses that have intellectual property are affected by them
They rarely happen, so they can be disregarded.
Insiders are always reliable and trustworthy and do not pose a threat.
They can cause serious reputational and financial harm to the company.
5
What is the primary purpose of a hash?
Execute programs securely
Store data in databases
Represent data in a fixed-length form
Encrypt data for secure communication
6
Which phase of the Cyber Kill Chain is often called the "final stage" for an attacker?
Reconnaissance
Actions on Objectives
Exploitation
Weaponization
7
How would you search on Google to find PDF reports on cybersecurity?
cybersecurity file:doc
reports filetype:csv
cybersecurity document:type
filetype:pdf cybersecurity
8
What is the primary purpose of a Domain Controller in Active Directory (AD)?
To host websites
To supervise the network and authenticate users
To manage email servers
To store files and applications
9
A "filtered" port means the service is open and accessible.
False
True
10
What is a common issue with insufficient logging?
Logs are too detailed to analyse
Incidents cannot be detected promptly
Alerts are too frequent
Threat actors cannot remove logs
11
Which protocol is often blocked by default on firewalls, requiring a workaround?
ICMP
TCP
FTP
UDP
12
What is the purpose of disabling unused services on the servers?
Improve boot time
Ensure better compatibility with updates
Enable faster network speeds
Reduce potential attack vectors
13
What kind of XSS occurs when an attacker places html code affecting all users viewing the page?
Reflected XSS
Dynamic XSS
Immediate XSS
Stored XSS
14
What is the main responsibility of C-level executives within a company?
Setting strategic objectives and major policies
Overseeing departmental operations
Monitoring day-to-day business activities
Performing hands-on technical tasks
15
What is the main purpose of Process Explorer?
Detailed inspection of processes
Deleting malicious files
Securing alternate data streams
Analysing TCP connections
16
1.What is the primary challenge of using hash values as indicators?
They cannot identify malware, only APIs and DLLs
They are time-consuming and resource intensive to generate
They can be easily modified by altering a file’s content
They are unreliable in identifying Windows files
17
What philosophy provides the most ROI in cybersecurity?
Reactive response
Minimal security measures
Secure by design
Avoiding technology
18
What part of the CIA triad is compromised during a denial-of-service attack?
Integrity
Availability
Accountability
Confidentiality
19
What tool is most commonly used to investigate malware persistence mechanisms on Windows?
Regedit
Wireshark
Task Manager
Autoruns
20
What are "insider threats" typically motivated by?
Ideological beliefs
Discontent
Financial gain
Geopolitical goals
21
Implementing strong password policies can mitigate the broken access control OWASP vulnerability.
False
True
22
What ensures that network traffic reaches the correct application on a server?
IP Addresses
MAC Addresses
Ports
Subnets
23
Which of the following is a common location for Linux system logs?
/etc/log
/usr/log
/var/log
/sys/logs
24
Hashes are designed to be easily reversible.
False
True
25
What is the purpose of PowerShell ISE?
To debug scripts
To write and test PowerShell scripts
To manage remote servers
To compile scripts into executables
26
Why do malware authors often use hard-coded strings?
To increase execution speed on sandboxes
To store critical information like IP addresses
To avoid firewall and IPS detection
To improve encryption during execution
27
If you suspect your credentials have been exposed in a data breach, what tool should you use to confirm this?
Haveibeenpwned
Wireshark
Metasploit
Shodan
28
What is the primary function of scoping in incident response?
Reporting incidents to external authorities
Eradicating the threat actor
Containing malicious processes
Determining the incident’s impact and extent
29
Which incident response phase involves removing the active threat?
Containment
Identification
Eradication
Recovery
30
Where is the Windows Hosts file located?
C:\Windows\System32\Drivers\etc\hosts
C:\Windows\Hosts
C:\System\Config\Hosts
C:\Drivers\System32\hosts
31
What is ProcMon used for?
Monitoring malware API calls
Creating virtual machines for malware
Encrypting malware samples
Observing real-time malware activities
32
How does Tor achieve user anonymity?
By routing traffic through volunteer-operated relays
By encrypting local files
By using a private search engine
By disabling cookies
33
Why are brute force attacks often slow for attackers?
They rely on weak encryption algorithms to succeed
They depend on analysing system vulnerabilities first
They require specialized hardware to execute quickly
They guess passwords one at a time from a large set
34
Which Windows tool is used to view and manage event logs?
eventvwr
msconfig
regedit
secpol.msc
35
What is a Portable Executable (PE) file?
An executable file format for Windows
A python script for Linux
A compressed archive
An encrypted text document
36
Which cyber threat actor is motivated by financial gain?
Terrorist groups
Thrill-seekers
Hacktivists
Cybercriminals
37
What is the purpose of inspecting a website's page source?
To change user credentials
To check for firewall settings
To find vulnerabilities and sensitive information
To modify the website’s design
38
Which Windows API function indicates that malware interacts with the internet?
CloseHandle
TerminateProcess
RegOpenKeyExW
InternetOpen
39
Which of the following is NOT a classification of threat intelligence?
Incident Intel
Strategic Intel
Operational Intel
Tactical Intel
40
What type of IDS monitors traffic to and from a single host?
Network-based IDS
Host-based IDS
Inline IDS
Application-based IDS
41
What is the purpose of the PE Header in an executable?
To store data sections for analysis
To allocate virtual memory
To manage executable threads
To define the file format and structure
42
Which is NOT a common hashing algorithm?
ZIP
SHA256
MD5
SHA1
43
Malware obfuscation hides malware within the file system
False
True
44
What is the purpose of hashing in malware analysis?
To create encrypted virtual environments
To uniquely identify malware samples
To encrypt the malware code from the samples
To execute known malware
45
What distinguishes a dictionary attack from a brute-force attack?
Dictionary uses wordlists; brute-force tries all combinations
Brute-force targets usernames; dictionary targets passwords
Dictionary is for online forms; brute-force for offline cracking
Dictionary and brute-force attacks follow the method to guess credentials
46
Which IPS detects and blocks traffic deviating from normal baselines?
Pattern-matching
Heuristic
Anomaly-based
Signature-based
47
What is the main purpose of a Virtual Machine in malware analysis?
To analyse malware in a live environment
To automatically remove malware from USBs
To enhance system performance for analysis
To create a safe, revertible environment for analysis
48
What is a classification of Threat Intelligence that focuses on high-level risk areas?
Operational Intel
Strategic Intel
Tactical Intel
Technical Intel
49
What should analysts do if a triggered alert is identified as a False Positive?
Escalate the incident
Ignore the incident
Block the associated IP address
Send the use case for fine-tuning
50
Recovery is the first step in the Incident Response process.
True
False
51
LUKS encryption ensures data is unreadable without the decryption key.
True
False
52
Which type of analysis involves executing malware in a controlled environment?
Advanced Static Analysis
Advanced Dynamic Analysis
Basic Static Analysis
Basic Dynamic Analysis
53
Disabling internet access is the most effective way to secure an organization.
True
False
54
What is the primary goal of the Delivery phase in the Cyber Kill Chain?
Destroying the target's system
Transmitting the payload or malware
Performing privilege escalation
Gaining unauthorized access
55
What is the first step when using Gobuster?
Provide a URL to scan
Input credentials
Download website data
Disable firewalls
56
What is Kerberoasting in the context of AD attacks?
Cracking encrypted passwords offline
Manipulating public shares
Brute-forcing Remote Desktop Protocol
Intercepting SMB communication
57
What is the main goal of "Confidentiality" in the CIA Triad?
Ensuring data is only accessible by authorized individuals
Ensuring data is not altered without authorization
Ensuring backups are created for critical systems
Ensuring data is available when needed
58
Which Python function is used to print text to the screen?
output()
display()
show()
print()
59
What kind of server hosts Active Directory services?
Account Controller
Domain controller
System server
Database Domain
60
In which phase of ethical hacking does Gobuster fall?
Post-exploitation
Reconnaissance
Exploitation
Reporting
61
What does the Principle of Least Privilege (POLP) mean?
Granting minimal access required to perform tasks
Using shared accounts for access within teams
Granting all users only guest privileges
Granting all permissions by default
62
What is the purpose of a User-Agent string in network communications?
To bypass firewalls
To generate IP addresses
To log user activities
To identify the requester
63
What is the term for registering domain names with minor spelling errors?
Social spoofing
Domain mirroring
Spelling attack
Typosquatting
64
What type of hash helps identify similar malware samples based on file chunks?
SSDEEP
SHA1
SHA256
MD5
65
When buying stuff online, how would you search for a price range within a 200€-500€ range?
200€/500€
200€-500€
200€ ... 500€
200€ .. 500€
66
What are Indicators of Compromise (IoCs)?
Alerts for unauthorized logins
Signatures used to identify malicious activity
Tools for incident management
Reports on resolved incidents
67
Which of the following is an example of information security regulation?
Incident Response Playbook
ISO 27001
Penetration Testing
PCI DSS
68
Why is the sudoers file important in Linux?
It tracks successful and failed login attempts
It lists all installed packages installed by root
It stores all user’s encrypted passwords
It manages user permissions for elevated commands
69
Which command is used to list parameters for a Metasploit module?
list config
show options
show parameters
display settings
70
Which of the following qualifies as multi-factor authentication (MFA)?
A fingerprint and a retina scan
A username and a password
A smart card and a USB key
A PIN and a security token
71
A penetration tester found weak file permissions and misconfigured SSL on a web server. How should this be fixed?
Install the latest operating system updates
Implement HTTPS for all connections.
Apply server hardening techniques
Enforce multi-factor authentication.
72
What is the hexadecimal header for an executable file?
5C 7D
1A 3C
FF EE
4D 5A
73
What is a common malware technique that manipulates the stack?
Instruction Reordering
Flag Modification
Stack Buffer Overflow
Heap Allocation
74
What are "strings" in the context of programming?
Raw binary data
Graphical elements like icons
Readable data such as text and numbers
Malware functions only
75
What is an example of Availability in the CIA triad?
Ensuring servers are operational during business hours
Blocking unverified users from accessing systems
Using encryption to protect sensitive data
Detecting unauthorized changes to records
76
What is the primary purpose of an Intrusion Detection System (IDS)?
Detect and prevent malicious activity
Detect malicious activity and alert
Encrypt network traffic
Block unauthorized IP addresses
77
Threat intelligence focuses solely on external threats
False
True
78
Dynamic analysis involves analysing malware without executing it.
False
True
79
Security alerts automatically initiate the incident response process.
True
False
80
Which phase involves removing or stealing sensitive data?
Reconnaissance
Exploitation
Exfiltration
Defense Evasion
81
Which OWASP vulnerability is associated with applications relying on unreliable plugins or extensions?
Injection
Security misconfiguration
Software and data integrity failures
Cross-Site Scripting (XSS)
82
What principle ensures users only have access necessary for their role?
Layering
Least Privilege
Defence-in-Depth
Trust but Verify
83
How many total ports are available on a network-enabled device?
50000
65535
Unlimited
1024
84
What functionality does the Metasploit command use auxiliary/scanner/ftp/anonymous provide?
Checking FTP servers for open anonymous access
Launching a brute-force attack
Identifying SQL injection points
Setting up a malicious listener for FTP traffic
85
Process Hollowing involves replacing a legitimate process's memory with malicious code.
False
True
86
What kind of logs are essential for detecting sinkholed domains?
Email gateway logs
Proxy logs
Firewall logs
DNS logs

Final review 2 Flashcards | StudBud