Module 5

Test patch for 48 hours

Which port is Secure Shell (SSH)?

Assessment of critical servers, which may be vulnerable to attacks if not adequately tested.

___ automatically identifies configuration vulnerabilities threatening the security of the DoD’s computer systems.

Improves situational awareness of DISA STIG compliance requirements.

Last rule of any Access Control List (ACL) is …

Definition-based detection that uses a database of known vulnerabilities or attack patterns.

Designed to act as a comprehensive STIG compliance tool that provides security monitoring and event monitoring.

What are the forms of applications testing.

This protects a user’s sensitive data from being seen/used by a cyber criminal.

A type of code that is inserted into the code of an existing software program.

Designed to support a faster pace of system updating and patch management for our network connected Windows devices.

Type of application security that validates who someone says they are.

Heuristic-based detection that first identifies normal operations and creates a performance baseline from weird behavior

A DoD info system used to record, track and disseminate critical vulnerability info through the DoD Enterprise network.

This tool can be used to conduct both local and remote scans.

The MECM Hierarchy consists of which 3 tiers?

The Vulnerability Remediation Process includes which three phases.

Analyzes running code while simulating outside, or “black box” attacks.

Target all systems, unless stated otherwise by the tasking authority.

Comprehensive vulnerability scanner.

The configuration standards for DOD IA and IA enabled devices/systems.

Successful identification of an attack.

Base communications squadrons ensure McAfee Endpoint Products are applied to client systems.

____ & ____ are intended for cybersecurity professionals responsible for auditing computer attacks.

What are the types of vulnerability assessments?

Identifying of security vulnerabilities in web applications and their source code.

Are responsible for identifying the information systems controlled by a Program Management Office (PMO) within their AOR

Valid on any computer in the domain for which the account was created.

Analyzes code at fixed points in development.

Single console access used by the ACAS managing Nessus scans at the enterprise network level.

Responsible for maintaining the security posture of the Department of Defense Information Network (DODIN).

DoD information system used to record and track critical vulnerability info throughout the DoD enterprise.

C.I.A Triad includes all the following…

Assessment of policies and practices to prevent unauthorized access to private or public networks.

Secondary sites that connect to primary site.

Contains elements of both Dynamic and Static testing

Successfully ignoring acceptance behavior.

The contributing factors are designed to assist in evaluating the commands emphasis on compliance of the IA controls.

Application security that validates what a user has permissions to do.

Tool used as an analytical utility to process data collected by Snort.

Some password requirements are:

Designed specifically for mobile environments and can examine how an attacker can leverage mobile OS and apps.

A software or hardware-based network security system controlling incoming and outgoing network traffic.

Process that occurs between server and client. Encrypted and authenticated data is signed by the Message Auth Code.

A comprehensive security management solution that runs on network computers to identify and stop threats automatically.

Forgo all testing and release patch within 24 hours with a mandated minimum of 70% of machines.

What is a Secure Technical Implementation Guide (STIG)?

Primarily utilized to protect the endpoint from unauthorized device insertions.

Tools used for scanning network traffic.

Assessment of databases or big data systems for vulnerabilities and misconfigurations

The most common method of tracking a customer accessing an organization’s website is be assigning a unique ________.

Which are common Intrusion Detection Tools (IDS)

Mitigation factors that have been implemented and a fix date when the vulnerability will be remediated.

This should be setup between your internal network and the internet.

___% is the compliance threshold that the base CFP needs to meet assisted by the NOS. NOS sets the compliance threshold.

Central Administration Site (CAS) @ Wright Patterson is used for large-scale deployments and provides a central point.

Attacker with sufficient resources can incessantly ‘guess’ auth tokens until one of the attempts proves successful.

Logs events to determine who did what, when they did it, and how.

Suite of centrally managed Defense Cyber Operation tools that provide a means of denial of adversary action of the DoDIN

Internet standard that enables LAN to use one set of IP addresses for internal traffic and a 2nd set of external traffic

A java-based application that can be used to conduct a manual audit of information system security controls.

Process of developing, adding, and testing security features within applications. (Increased exposure=increased risk)

Fuzzing is NOT testing the results of unexpected values or inputs.

Provides a secure encryption communication method for TCP connections, especially for HTTP.

Techniques to enhance security at the coding level.

Involves someone intercepting data being sent between two parties.

Which of the following are boundary interaction best practices.

Network device or software acting on behalf of clients to retrieve requested content from an origin content server (OCS)

These make Information Assurance (IA) easier to implement providing security for IT systems.

A piece of software within ESS that can be utilized for scanning clients and returning info from currentstate to windows

Target all machines that require an update, are not part of an exemption, and are not designated a PMA/medical.

An attacker can maliciously inject JavaScript into an application running on the victim’s browser.

Three overall IA areas being evaluated during a Command Cyber Readiness Inspection (CCRI).

The goal of vulnerability remediation/mitigation process is to mitigate risk to the _____.

Two-phased patch testing approach

Monitors the network in real-team, continuously looking for new vulnerabilities without a need for active scanning.

3 managing Units provide ESS configurations, updates, and master sources repository and serves as POC for ESS PMO.

Activity is actually an attacker (most dangerous).

Open source HIDS that performs log analysis, file integrity checking, policy monitoring, and active response.

Allow the user to log into a specific machine and all them to access resources on that machine only.

Widely adopted security protocol designed to facilitate privacy an data security for communication over the internet.

This attack is not used to steal auth tokens, instead, it allows an attacker to piggyback on existing active sessions.

Developed by Sourcefire; combining the benefits of signature-based protocol and anomaly-based inspection.

False alarm

Consists of primary sites that house MECM database, data for its connected sites, and distribute global data between

Open Source, Unix based Network IDS that passively monitors network traffic and looks for suspicious activity.

Minimizes network-based attacks and prevent system access, maintenance processes, and network design and requirements.

Administrators should maintain the security of the IDS components on an ongoing basis.

The USAF ESS Organization Tier Structure has how many tiers?

5 operational units support daily operations of the ESS service and monitors/maintains health and operations of ESS

Automated compliance scanning tool that leverages the STIGs and OS-specific baselines to analyze and report.

Intrusion control specific to a host

An attacker with physical access to a victim’s device can steal auth tokens in multiple ways

Platform used by the Air Force to monitor and maintain the thousands of systems across the network.

What are application security tools? (Choose Two)

A vulnerability assessment is a systematic review of security weaknesses in a information system.

This account type is very powerful and can execute any command.

Technique used to control network access by monitoring outgoing and incoming packets, either by allowing or blocking.

If a hacker obtains a customer’s sessions ID information, the attacker is then able to hijack and manipulate the session