Module 5

Assessment of critical servers, which may be vulnerable to attacks if not adequately tested.

Application security that validates what a user has permissions to do.

Administrators should maintain the security of the IDS components on an ongoing basis.

Process of developing, adding, and testing security features within applications. (Increased exposure=increased risk)

Valid on any computer in the domain for which the account was created.

Allow the user to log into a specific machine and all them to access resources on that machine only.

___ automatically identifies configuration vulnerabilities threatening the security of the DoD’s computer systems.

The MECM Hierarchy consists of which 3 tiers?

3 managing Units provide ESS configurations, updates, and master sources repository and serves as POC for ESS PMO.

Tools used for scanning network traffic.

Platform used by the Air Force to monitor and maintain the thousands of systems across the network.

Some password requirements are:

Automated compliance scanning tool that leverages the STIGs and OS-specific baselines to analyze and report.

DoD information system used to record and track critical vulnerability info throughout the DoD enterprise.

Which port is Secure Shell (SSH)?

Suite of centrally managed Defense Cyber Operation tools that provide a means of denial of adversary action of the DoDIN

What is a Secure Technical Implementation Guide (STIG)?

Designed to act as a comprehensive STIG compliance tool that provides security monitoring and event monitoring.

Secondary sites that connect to primary site.

False alarm

___% is the compliance threshold that the base CFP needs to meet assisted by the NOS. NOS sets the compliance threshold.

Identifying of security vulnerabilities in web applications and their source code.

Are responsible for identifying the information systems controlled by a Program Management Office (PMO) within their AOR

What are application security tools? (Choose Two)

A piece of software within ESS that can be utilized for scanning clients and returning info from currentstate to windows

This account type is very powerful and can execute any command.

The goal of vulnerability remediation/mitigation process is to mitigate risk to the _____.

Primarily utilized to protect the endpoint from unauthorized device insertions.

Heuristic-based detection that first identifies normal operations and creates a performance baseline from weird behavior

Which of the following are boundary interaction best practices.

Open source HIDS that performs log analysis, file integrity checking, policy monitoring, and active response.

The configuration standards for DOD IA and IA enabled devices/systems.

Comprehensive vulnerability scanner.

The most common method of tracking a customer accessing an organization’s website is be assigning a unique ________.

Assessment of policies and practices to prevent unauthorized access to private or public networks.

Technique used to control network access by monitoring outgoing and incoming packets, either by allowing or blocking.

Process that occurs between server and client. Encrypted and authenticated data is signed by the Message Auth Code.

Target all machines that require an update, are not part of an exemption, and are not designated a PMA/medical.

Definition-based detection that uses a database of known vulnerabilities or attack patterns.

Designed to support a faster pace of system updating and patch management for our network connected Windows devices.

A comprehensive security management solution that runs on network computers to identify and stop threats automatically.

Two-phased patch testing approach

Internet standard that enables LAN to use one set of IP addresses for internal traffic and a 2nd set of external traffic

Consists of primary sites that house MECM database, data for its connected sites, and distribute global data between

A DoD info system used to record, track and disseminate critical vulnerability info through the DoD Enterprise network.

Analyzes running code while simulating outside, or “black box” attacks.

Which are common Intrusion Detection Tools (IDS)

A type of code that is inserted into the code of an existing software program.

Base communications squadrons ensure McAfee Endpoint Products are applied to client systems.

If a hacker obtains a customer’s sessions ID information, the attacker is then able to hijack and manipulate the session

Minimizes network-based attacks and prevent system access, maintenance processes, and network design and requirements.

Provides a secure encryption communication method for TCP connections, especially for HTTP.

A java-based application that can be used to conduct a manual audit of information system security controls.

Fuzzing is NOT testing the results of unexpected values or inputs.

Mitigation factors that have been implemented and a fix date when the vulnerability will be remediated.

This protects a user’s sensitive data from being seen/used by a cyber criminal.

Monitors the network in real-team, continuously looking for new vulnerabilities without a need for active scanning.

Attacker with sufficient resources can incessantly ‘guess’ auth tokens until one of the attempts proves successful.

A vulnerability assessment is a systematic review of security weaknesses in a information system.

The Vulnerability Remediation Process includes which three phases.

Involves someone intercepting data being sent between two parties.

5 operational units support daily operations of the ESS service and monitors/maintains health and operations of ESS

Tool used as an analytical utility to process data collected by Snort.

Developed by Sourcefire; combining the benefits of signature-based protocol and anomaly-based inspection.

Test patch for 48 hours

The contributing factors are designed to assist in evaluating the commands emphasis on compliance of the IA controls.

Logs events to determine who did what, when they did it, and how.

Intrusion control specific to a host

Analyzes code at fixed points in development.

Network device or software acting on behalf of clients to retrieve requested content from an origin content server (OCS)

This tool can be used to conduct both local and remote scans.

Three overall IA areas being evaluated during a Command Cyber Readiness Inspection (CCRI).

Designed specifically for mobile environments and can examine how an attacker can leverage mobile OS and apps.

Central Administration Site (CAS) @ Wright Patterson is used for large-scale deployments and provides a central point.

These make Information Assurance (IA) easier to implement providing security for IT systems.

Contains elements of both Dynamic and Static testing

Widely adopted security protocol designed to facilitate privacy an data security for communication over the internet.

This attack is not used to steal auth tokens, instead, it allows an attacker to piggyback on existing active sessions.

Responsible for maintaining the security posture of the Department of Defense Information Network (DODIN).

C.I.A Triad includes all the following…

Forgo all testing and release patch within 24 hours with a mandated minimum of 70% of machines.

Open Source, Unix based Network IDS that passively monitors network traffic and looks for suspicious activity.

Target all systems, unless stated otherwise by the tasking authority.

Successful identification of an attack.

Assessment of databases or big data systems for vulnerabilities and misconfigurations

Improves situational awareness of DISA STIG compliance requirements.

The USAF ESS Organization Tier Structure has how many tiers?

What are the forms of applications testing.

Last rule of any Access Control List (ACL) is …

A software or hardware-based network security system controlling incoming and outgoing network traffic.

Activity is actually an attacker (most dangerous).

Single console access used by the ACAS managing Nessus scans at the enterprise network level.

Techniques to enhance security at the coding level.

An attacker with physical access to a victim’s device can steal auth tokens in multiple ways

Successfully ignoring acceptance behavior.

Type of application security that validates who someone says they are.

An attacker can maliciously inject JavaScript into an application running on the victim’s browser.

____ & ____ are intended for cybersecurity professionals responsible for auditing computer attacks.

This should be setup between your internal network and the internet.

What are the types of vulnerability assessments?