How can fuzzy hashing help in cybersecurity?

By matching similar files based on content

What information can IP history tools provide about a domain name?

A historical list of IP addresses that the domain has been hosted on.

What role do logs play in incident identification?

They provide data for analysis of suspicious activities

What is the role of Integrity in the CIA triad?

Detects and prevents unauthorized data alterations

A Windows scripting language and shell

What is a Risk in cybersecurity?

Likelihood and impact of a threat

What is a potential indicator of malicious activity in log files?

Unusual use of elevated privileges.

A packet capture shows email addresses and passwords in plain text. What vulnerability does this indicate?

Use of unsafe communication protocols

How is an Ethical Hacker best described?

Someone authorized to test security systems for vulnerabilities

How can fileless malware be executed on a Windows system?

It can be run through Windows PowerShell

What does the "deny" keyword in a firewall rule do?

Blocks traffic that matches the rule

What does the auxiliary module in Metasploit do?

Provides additional functionality

What is the primary purpose of information security governance?

To manage, direct, and protect information assets

What does Gobuster rely on to discover hidden directories or pages?

Using a list of potential page names

How does Gartner assist in cybersecurity decision-making?

By providing expert research and strategic advice

Why is segmenting networks effective in limiting the spread of malicious software?

It reduces the ability of any malware to propagate

What does the | operator do?

Passes the output of one command as input to another

What does the Containment phase focus on?

Stopping the incident from spreading

studbud

Final review 1

86 termsStudBud Administration18 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
How can fuzzy hashing help in cybersecurity?
By matching similar files based on content
By generating new domain names
By encrypting User-Agent strings
By detecting phishing campaigns
2
What is an example of a secure protocol?
Telnet
HTTP
FTP
SSH
3
When securely transmitting files over a network, which protocol is ideal?
HTTP
SCP
FTP
Telnet
4
Which type of encryption uses one shared key for securing and unlocking data?
Hybrid Encryption
Quantum Encryption
Asymmetric Encryption
Symmetric Encryption
5
Which Nmap switch is used to detect the version of a running service?
-sV
-v
-vV
-O
6
What information can IP history tools provide about a domain name?
Only a list of current IP addresses used by the domain.
A detailed report of DNS server configurations for the domain.
A historical list of IP addresses that the domain has been hosted on.
A real-time list of active subdomains under the domain.
7
What role do logs play in incident identification?
They are used only after incidents are resolved
They replace the need for an Asset Inventory
They prevent unauthorized access
They provide data for analysis of suspicious activities
8
What type of data does PCI DSS primarily protect?
Cardholder data (CHD)
Intellectual property
Personal identifiable information
Healthcare records
9
What is the role of Integrity in the CIA triad?
Ensures only authorized people access data
Detects and prevents unauthorized data alterations
Ensures services are accessible when needed
Blocks all access to sensitive data
10
Which phase of the CTI lifecycle involves providing insights to stakeholders?
Direction
Analysis
Dissemination
Feedback
11
What is the name for a malicious script planted on a web server to maintain access?
Rootkit
Worm
Web shell
Trojan
12
Which threat actor is ideologically motivated?
Hacktivists
Thrill-seekers
Cybercriminals
Insider threats
13
What is PowerShell?
A Linux shell
A network monitoring tool
A programming framework for Java
A Windows scripting language and shell
14
Which team uses malware analysis to hunt for Indicators of Compromise (IOCs)?
Security Operations Team
Threat Hunt Team
Incident Response
Threat Research Team
15
What tool is often used to create and manage reverse shells?
Nmap
OpenSSH
Socat
Fuff
16
What is a Risk in cybersecurity?
Likelihood and impact of a threat
A potential vulnerability in a system
Any possible danger, regardless of likelihood
Weakness in hardware or software
17
What type of account is NOT recommended due to increased security risks?
Privileged accounts
Tier 0 admin accounts
Shared accounts
User accounts
18
What activity involves analysing malware's assembler code with tools like debuggers?
Malware creation
Social engineering
Decryption
Reverse engineering
19
Which section in a PE file contains executable code?
.reloc
.data
.text
.rsrc
20
What is a potential indicator of malicious activity in log files?
High CPU usage.
Installation of a new printer.
Unusual use of elevated privileges.
Frequent use of backup commands.
21
The -T5 switch in Nmap sets the fastest timing template.
True
False
22
Which hashing algorithm is NOT cryptographically secure?
SHA-256
MD5
SHA-512
SHA-3
23
What tactic involves impersonating employees to gain sensitive information?
Exploitation
Credential Dumping
Weaponization
Social Engineering
24
What additional capability does an Intrusion Prevention System (IPS) have compared to an IDS?
Analyses encrypted communications
Encrypts all traffic
Blocks malicious activity
Detects suspicious activity
25
A packet capture shows email addresses and passwords in plain text. What vulnerability does this indicate?
Insufficient encryption standards.
Misconfigured open ports
Outdated software patches.
Use of unsafe communication protocols
26
How is an Ethical Hacker best described?
A hacker who avoids legal consequences but breaks cybersecurity laws
An individual claiming good intentions while hacking illegally
Someone authorized to test security systems for vulnerabilities
A person who repairs hardware without engaging in hacking
27
How can fileless malware be executed on a Windows system?
It requires physical access to the target machine
It cannot be executed on Windows systems
It can be run through Windows PowerShell
It requires downloading a malicious executable
28
What does the "deny" keyword in a firewall rule do?
Ignores the rule completely
Blocks traffic that matches the rule
Logs unauthorized access attempts
Blocks traffic coming from untrusted sources
29
What does the auxiliary module in Metasploit do?
Provides additional functionality
Encodes payloads
Generates shell scripts
Exploits vulnerabilities
30
What is the primary purpose of information security governance?
To handle cyber incident responses exclusively
To manage, direct, and protect information assets
To replace existing policies with new ones regularly
To enforce industry compliance laws
31
What is the term for hard-coded sensitive data in applications?
Obfuscation
Encryption
Sandbox
Static information
32
Deleting accounts that are no longer active or needed helps address the broken access control OWASP vulnerability.
False
True
33
What does CTI stand for?
Cyber Threat Investigation
Cyber Threat Intelligence
Critical Threat Indicators
Cyber Tactical Insights
34
What format is used for modern Windows authentication hashes?
NTLM
Whirlpool
SHA-256
MD5
35
Gathering public information about an organization on online forums is an example of OSINT
True
False
36
What does Gobuster rely on to discover hidden directories or pages?
Guessing user credentials
Using a list of potential page names
Analysing website traffic
Scanning for vulnerabilities
37
What is the first step in ensuring an organization's cybersecurity?
Disabling the internet
Upgrading all computers
Maintaining an asset inventory
Monitoring employee emails
38
How does Gartner assist in cybersecurity decision-making?
By developing security platforms
By providing expert research and strategic advice
By offering tools for risk management
By running penetration tests
39
GRUB passwords prevent resetting root passwords from bootloader menus.
False
True
40
What technique allows malware to evade static analysis?
File hashing
Sandbox detection
Long sleep calls
Obfuscation
41
Which tool is commonly used for advanced static analysis?
Metasploit
Nessus
Wireshark
Ghidra
42
What is the last phase of the Incident Response process?
Eradication
Recovery
Containment
Post-Incident Activity
43
Static Analysis involves analysing malware without executing it.
True
False
44
What type of malware attack targets as many devices as possible?
Targeted Campaign
Mass Campaign
Host-Based Campaign
Network-Based Campaign
45
Why is segmenting networks effective in limiting the spread of malicious software?
It reduces the ability of any malware to propagate
It prevents spyware from gaining access
It isolates ransomware to specific segments
A)It blocks unauthorized software downloads
46
What does DNS stand for?
Domain Network Service
Domain Navigation System
Domain Name Service
Domain Name System
47
Which type of IPS detects and blocks traffic by identifying deviations from normal behavior?
Anomaly-based
Signature-based
Behaviour-based
Heuristic
48
What does the | operator do?
Passes the output of one command as input to another
Loops through output
Combines two commands into one
Ends a script
49
What does the Containment phase focus on?
Removing the threat actor
Recovering from the incident
Analysing logs to set the scope
Stopping the incident from spreading
50
What does the strings command do?
Lists readable text in a file
Compresses malware
Detects malicious behaviour
Runs malware
51
Confidentiality ensures data is accessible during emergencies.
True
False
52
What type of account should be used for daily tasks on a Windows machine?
Administrator
Standard Account
Guest Account
Developer Account
53
What is the primary focus of technical Threat Intelligence?
Analysing business risk
Assessing attack artefacts
Examining adversary tactics
Understanding attacker motives
54
What is the primary objective of performing a port scan?
To identify weaknesses in firewall configurations
To determine active services and open ports on a target system
To replicate denial-of-service conditions
To circumvent security measures
55
What is Process Explorer primarily used for?
Encrypting malicious files
Monitoring running processes
Deleting registry keys
Debugging network connections
56
Why is a virtual machine recommended for malware analysis?
It provides internet access for malware
It isolates the malware from live systems
It encrypts malware samples
It speeds up malware execution
57
What is NOT a common PE file section?
.exe
.text
.rsrc
.rdata
58
What does a SQL injection attack aim to achieve?
To install database patches
Unauthorized access to sensitive database data
To make databases run faster
To fix errors in the database schema
59
What is the purpose of packing in malware?
To encrypt the payload
To make analysis difficult
To simplify the code
To increase propagation speed
60
What is the primary purpose of the Cyber Kill Chain framework?
To identify and eliminate insider threats
To replace antivirus software with detailed Yara rules
To develop and spread ransomware
To understand and defend against cyberattacks
61
What is the main goal of Incident Management (IM)?
Investigate malware behaviour
Monitor live network traffic
Determine the technical details of an incident
Respond effectively to the incident's scope
62
Which of these methods is effective for identifying malicious activity executed via PsExec?
Binary metadata, Registry modifications, Named pipes
Dynamic scans, Network traffic capture, Anti-debugging
Analysing packets, Crafting signatures, Performing reverse engineering
Hash comparisons, Detecting malware obfuscation, Verifying file integrity
63
What tool can help investigate privileged commands on a Linux system?
syslog
netcat
top
curl
64
How do developers sometimes inadvertently expose vulnerabilities in web applications?
) By leaving sensitive comments in the code
By using outdated software
By creating weak encryption
By hosting applications on unsecured servers
65
What is Python primarily used for in cybersecurity?
Hacking wireless networks
Running firewalls
Scripting tools and automating tasks
Replacing antivirus software
66
Which of the following accurately describes the purpose of a "dropper" in cybersecurity?
A security protocol that is no longer effective in protecting systems
An email attachment to deceive users into opening malicious content
A type of software used to download and install malicious programs
An exploit designed to take advantage of vulnerabilities in web browsers
67
Which of the following is unrelated to a cybersecurity education and awareness program for users?
Hosting periodic security training sessions for employees
Setting up an automated system to back up user files
Educating users on how to identify phishing attacks
Offering instructions on creating secure passwords
68
What is an example of Defence-in-Depth?
Keeping sensitive documents offline
Combining firewalls, encryption, and user training
Only securing your email server
Using a single strong password
69
What is the primary purpose of LUKS encryption?
Restrict access to specific applications
Encrypt data for protection against physical theft
Prevent unauthorized software installation
Speed up disk read/write performance
70
What is John the Ripper primarily used for?
Encrypting files
Scanning networks
Analysing malware
Cracking hashes
71
What should be done to detect bandwidth bottlenecks?
Monitor real-time traffic statistics
Disable all non-essential services
Change the router’s default credentials
Enable port forwarding
72
What kind of malware manages a network of infected devices and executes tasks from a central server?
Worm
Adware
Rootkit
Botnet
73
What is the primary purpose of the Tor network?
To enable fast downloads
To enable anonymous communication
To enhance web search results
To host public servers
74
What is a process in Windows?
A stolen thread in execution
A file stored in the NTFS
A DLL loaded into memory
Execution of a program with its resources
75
What is the main goal of nation-state cyber threat actors?
Financial gain
Personal satisfaction
Random mischief
Geopolitical objectives
76
What does Threat Intelligence aim to understand?
Network bandwidth issues
The cost of cybersecurity solutions
Internet browsing behaviours
Adversaries and their tactics
77
Which three elements form the triad of identification?
Tools, Tactics, and People
Incident Managers, Analysts, and Tools
People, Processes, and Technology
Alerts, Logs, and Evidence
78
Which tool is best for inspecting auto-start programs on a system?
ProcDump
Process Monitor
Autoruns
PsExec
79
What does "CVE-2019-6499" refer to?
A malware type
A vulnerability
A bug bounty program
An anti-malware tool
80
What compliance standard might apply to a healthcare organization?
PCI-DSS
SOC2
ISO27001
HIPAA
81
In STRIDE, what principle focuses on logging activity for accountability?
Repudiation
Tampering
Denial of Service
Elevation of Privileges
82
What kind of Cyber Threat Intelligence (CTI) supports creating defence strategies and automated tools?
Strategic
Tactical
Technical
Operational
83
Which framework maps adversary tactics and techniques?
DREAD
PASTA
MITRE ATT&CK
STRIDE
84
Which step is NOT part of the phishing analysis phase?
Identifying sender and recipient
Reimaging infected machines
Extracting URLs and attachments from emails
Checking email metadata
85
What is an imphash used for in malware analysis?
To encrypt data with the most important hash
To analyse similar file permissions
To identify exact file duplicates regardless filename
To compare malware imports for similarity
86
What is a common limitation of signature-based IDS?
It cannot handle encrypted traffic.
It cannot detect unknown attacks.
It cannot monitor host activities.
It is resource-intensive.

Final review 1 Flashcards | StudBud