What is the focus of the "Availability" element in the CIA Triad?

Making data accessible to authorized users when needed

What does TTP stand for in cybersecurity?

Tactics, Techniques, Procedures

Which of the following best describes "vulnerability"?

A weakness or flaw that can be exploited by a threat

What is the importance of MD5 checksums in malware analysis?

They identify unique file fingerprints.

What does credentials harvesting mean in the context of cybersecurity?

Collecting stolen usernames, passwords, and tokens for malicious use

What is the primary purpose of the tool "sqlmap"?

To automate the detection and exploitation of SQL injection vulnerabilities

What is a dictionary attack?

Hashing a list of words to compare with a target hash

What is Shodan primarily designed to search?

Internet-connected devices and services

What could suggest that a cybersecurity incident is occurring?

High scanner activity and malware alerts.

What is process hollowing?

Injecting malicious code into a legitimate process

How do phishing and spear phishing differ?

Phishing targets many users; spear phishing targets specific individuals.

What is the primary purpose of port forwarding?

To route inbound traffic to internal devices

What does the "Zero Trust" principle advocate?

Assume all entities are threats until verified

What is the main function of Sysmon?

Monitoring and logging system activity

What does the crontab file do in Linux?

Schedules tasks to run automatically.

What does Regshot compare to identify changes?

Snapshots of the system registry

What actions help reduce the likelihood of insider threats?

Monitor for unusual activity and report concerns promptly.

studbud

Final review 4

86 termsStudBud Administration14 plays

Imported from external platform

Flashcards86 cardsFPractice quizPHost liveL

Questions 86

Answers

1
All ports on a network-enabled device are well-known and standardized.
False
True
2
What is the focus of the "Availability" element in the CIA Triad?
Encrypting data for security
Ensuring only authorized users can access data
Making data accessible to authorized users when needed
Preventing unauthorized data alterations
3
Which online sandbox is widely used in the malware analysis community?
Cuckoo
API Logger
Total Analysis
Wireshark
4
The sudoers file contains system logs.
True
False
5
What is a common anti-sandbox technique?
Running instantly
Long sleep calls
Obfuscating sections
Importing DLLs
6
What is an example of a method used for persistence?
Phishing
Startup scripts
Fake cookies
File sharing
7
What does requiring a username/password and smart card for access represent?
Authorization
Availability
Accounting
Authentication
8
What does TTP stand for in cybersecurity?
Threat Tracking Process
Technical Testing Protocol
Tools, Trends, Patterns
Tactics, Techniques, Procedures
9
Which of the following best describes "vulnerability"?
The severity of potential damage from a cyber attack
A weakness or flaw that can be exploited by a threat
A system's potential exposure to cyber-attacks
The likelihood of a threat occurring
10
Which phase of the CTI lifecycle involves sorting, organizing, and presenting data?
Direction
Collection
Processing
Analysis
11
What is the importance of MD5 checksums in malware analysis?
They debug malware.
They execute malware samples..
They identify unique file fingerprints.
They encrypt malware data.
12
Which threat involves intercepting data between two parties by masquerading as each other?
Man-in-the-Middle Attack
Bandwidth Theft
Privilege Escalation
Denial of Service
13
What does credentials harvesting mean in the context of cybersecurity?
Backing up user accounts in a secure environment
Encrypting sensitive login data in transit
Storing user credentials safely against data breaches
Collecting stolen usernames, passwords, and tokens for malicious use
14
What type of phishing targets specific individuals or organizations?
Mass phishing
Vishing
Smishing
Spear-phishing
15
Risk probability is the key determinant in deciding prioritization levels.
False
True
16
Risk probability is the key determinant in deciding prioritization levels.
True
False
17
What does the ">" operator do in Linux?
Deletes files
Extracts strings
Pipes output to a file
Installs packages
18
What is the primary purpose of the tool "sqlmap"?
To encrypt database communication for added security.
To automate the detection and exploitation of SQL injection vulnerabilities
To scan for open ports on database servers.
To detect SQL servers with default credentials.
19
What command checks the type of a file in Linux?
file
md5sum
VirusTotal
strings
20
Which command updates package information in Debian-based distributions?
yum update
dnf update
dpkg upgrade
apt update
21
What is a dictionary attack?
Compiling a list of words from a website
Using brute force to find words in a dictionary
Encrypting a dictionary file
Hashing a list of words to compare with a target hash
22
What is Shodan primarily designed to search?
Firewall configurations
Encrypted email servers
Internet-connected devices and services
Private company networks
23
What is the process of gathering publicly available email addresses for phishing attacks called?
Social engineering
Email harvesting
Email scraping
Spam collection
24
What phase defines goals and objectives for threat intelligence?
Dissemination
Feedback
Direction
Collection
25
What is Metasploit primarily used for?
Exploitation framework
Network defence
File encryption
System backup
26
What could suggest that a cybersecurity incident is occurring?
Normal app usage and no antivirus issues.
High scanner activity and malware alerts.
Spam reported but no suspicious links clicked.
Routine VPN logins and scheduled updates.
27
What is process hollowing?
Debugging malware
Running malware in a sandbox.
Injecting malicious code into a legitimate process
Encrypting files on a system
28
How do phishing and spear phishing differ?
There’s no distinction; both terms mean the same thing.
Phishing occurs on social media, whereas spear phishing happens via email.
Phishing targets many users; spear phishing targets specific individuals.
Spear phishing targets many; phishing is for specific individuals.
29
What is the primary purpose of port forwarding?
To encrypt outgoing traffic
To route inbound traffic to internal devices
To block all traffic from entering a network
To monitor internal user activity
30
The Containment phase should always precede Eradication.
False
True
31
What does the "Zero Trust" principle advocate?
Trust external devices but verify regularly
Always trust internal users
Assume all entities are threats until verified
Grant unlimited access to trusted users
32
What is the main function of Sysmon?
Deleting system logs
Managing NTFS permissions
Inspecting alternate data streams
Monitoring and logging system activity
33
What type of Indicator of Compromise (IoC) includes email addresses used in phishing?
Spoofed Email
File Hash
IP Address
Domain
34
What is the size of an IPv4 address in bytes?
8 bytes
6 bytes
2 bytes
4 bytes
35
What does the crontab file do in Linux?
Logs system errors.
Stores user data and then deletes it.
Schedules tasks to run automatically.
Monitors network traffic when SOC closes.
36
What is the first stage of the Incident Response process?
Containment
Detection and Analysis
Post-Incident Activity
Preparation
37
What kind of malware can turn a workstation into a part of a DDoS attack?
Botnet
Trojan Horse
Ransomware
Spyware
38
Who is responsible for maintaining security awareness?
Leadership teams exclusively
Security officers
The IT department only
Everyone in the organization
39
What does Regshot compare to identify changes?
Snapshots of the system registry
Deleted running processes
API call sequences between 2 samples
Network activity logs from different tools
40
What prints the message "This program cannot be run in DOS mode"?
Import Table
PE Header
DOS Stub
Section Table
41
What tool did can use to find hidden pages in web applications?
Metasploit
Gobuster
Wireshark
Nessus
42
What is the opposite of Confidentiality in the DAD triad?
Integrity
Disclosure
Denial
Destruction
43
Which phase focuses on bypassing antivirus or firewalls?
Exfiltration
Privilege Escalation
Execution
Defense Evasion
44
What actions help reduce the likelihood of insider threats?
Rely solely on technical controls.
Assume all employees are equally trustworthy.
Restrict access to sensitive data based on job responsibilities.
Monitor for unusual activity and report concerns promptly.
45
What is created during the Weaponization phase?
A phishing email
A fake domain
A malicious payload
A list of vulnerabilities
46
Defence-in-Depth applies only to physical security.
True
False
47
Changing a file's name alters its hash value.
False
True
48
If a credit card number is exposed after a data breach which regulatory compliance will take effect?
PCI DSS
HIPPA
GUDP
GBLM
49
A sandbox allow testing of unknown software in a secure and isolated space.
False
True
50
Which resource best explains web server attack techniques?
Diamond model
MITRE ATT&CK
ISO 27701
Tabletop exercise
51
Which type of XSS attack is delivered through a URL?
HTTP Injection
Stored XSS
DOM-based XSS
Reflected XSS
52
Which tool in the FLARE VM identifies capabilities of a PE file?
Malware Bazaar
Strings
CyberChef
Capa
53
The Tor Browser is inherently faster than other browsers.
True
False
54
What is the primary objective of security awareness?
To educate users on reducing cyber risks
To eliminate all threats to organizational security
To implement IT policies in the workplace
To detect malware in real time
55
In Powershell, which command is used to get help about a specific cmdlet?
Get-Help
Get-Manual
Cmdlet-Info
Help-Command
56
The purpose of malware analysis is only to detect IOCs.
True
False
57
What does the tail -n command do?
Searches for specific strings
Opens a file for editing
Deletes temporary logs
Displays the last n lines of a file
58
Which privacy regulation specifically protects the personal data of EU citizens?
SOC 2
HIPAA
PCI DSS
GDPR
59
What is a principle of the Biba model?
No execute up
No read down
No write up
No delete down
60
What is the primary use of a PE header in malware analysis?
To understand file structure and imports
To identify malicious strings on the sample
To calculate hashes for further analysis
To execute files safely before sharing them
61
Which role focuses on investigating malware behaviour?
Threat Hunter
Malware Analyst
SOC Analyst
Forensic Analyst
62
What does Cisco Talos specialize in?
Designing antivirus software
Providing actionable threat intelligence
Monitoring internet speeds
Offering hardware solutions
63
1.What does "PIM" stand for in access management?
Protected Integrity Mechanism
Privileged Information Management
Privileged Identity Management
Personal Information Model
64
Which step in the Cyber Kill Chain involves designing a malicious payload for future use?
Privilege Escalation
Reconnaissance
Command and Control
Weaponization
65
What is the primary goal of the recovery stage in incident handling?
haring incident analysis and outcomes with stakeholders.
Developing strategies to prevent future incidents.
Returning systems and operations to normal functionality.
Analysing the root cause of the security breach.
66
Why is enumeration important before exploitation?
Verifies if exploits worked
Avoids triggering noisy scans.
Finds active devices on the network.
Maps services and finds vulnerabilities.
67
Why is it risky to leave default credentials unchanged?
It prevents authorized users from logging in
It disables encryption protocols
Hackers can easily guess them and gain access
It makes websites slower
68
Which password policy enforces using at least three character types, such as uppercase, lowercase, & special characters?
Password complexity requirements
Password age policy
Minimum password length
Enforce password history
69
What is the priority in crisis management?
Avoiding media attention
Keeping operations running
Stopping attackers
Punishing employees
70
What is the purpose of analysing malware strings?
To identify behaviours
To modify malware
To remove malware
To encrypt files
71
What does the acronym PBKDF2 stand for?
Password-Based Key Data Feature 2
Public-Based Key Distribution Framework 2
Password-Based Key Derivation Function 2
Partition-Based Kernel Data Framework 2
72
What is a Whois lookup used for?
Retrieving domain registration details
Identifying website vulnerabilities
Scanning ports of a website
Mapping a website’s internal structure
73
What is the expected response when a closed port is scanned with a SYN or TCP Connect scan?
SYN/ACK
RST (Reset)
ICMP unreachable
No response
74
What is the main goal of advanced static analysis?
Reverse engineer malware to understand its behaviour
Execute malware in a safe environment
Monitor live network activity in a safe environment
Decrypt malware files for dynamic analysis
75
How does an anomaly-based IDS identify malicious traffic?
By scanning all packets for known exploits using DPI
By encrypting network traffic once enters the network
By matching patterns in a signature database
By comparing traffic to a baseline of normal behaviour
76
What is the difference between HIDS and NIDS?
HIDS is for enterprises; NIDS is for individuals.
HIDS prevents attacks; NIDS detects intrusions.
HIDS monitors host activity; NIDS monitors network traffic.
HIDS monitors network traffic; NIDS monitors host activity.
77
What is the common format for PowerShell cmdlets?
Verb-Noun
Verb-Verb
Noun-Verb
Command-Action
78
What does the term "pivoting" refer to in cyber attacks?
Hiding malware within files
Moving laterally within a network to access other systems
Encrypting stolen data
Switching attack methods
79
What are Sysinternals tools primarily used for?
Developing portable Windows applications.
Managing Linux processes on Windows.
Replacing Windows kernel drivers.
Troubleshooting and analysing Windows systems.
80
Which system is designed to recognize malware through signature matching and block it?
SIEM
Firewall
Antivirus
IDS
81
Which framework focuses on adversary behaviour and tactics?
STIX
Cyber Kill Chain
TAXII
MITRE ATT&CK
82
How does a security engineer handle exceptions to policies for business needs?
Disabling security measures
Implementing mitigations
Ignoring the policies
Delaying business processes
83
What does Static Analysis involve?
Analysing malware without executing it
Removing the malware from the system
Monitoring network traffic to find the C2
Running the malware to observe behaviour
84
What does a 200 HTTP status code indicate in directory enumeration results?
The server redirected the request
The directory or file is inaccessible
The request was successful, and the resource exists
The resource is forbidden, but exists
85
What type of security professional simulates adversary attacks to test an organization?
SOC Analyst
Blue Teamer
Penetration Tester
Security Analyst
86
What email subject is likely to grab attention in a phishing attack?
“Your account has been compromised!”
“Company update”
“Annual sales report”
“Weekly newsletter”

Final review 4 Flashcards | StudBud