In the verification phase, an audit is used to do what?

See if you are complying with a policy

How does a machine learning algorithm “learn”?

Using historical data to make predictions and assessing its accuracy

What does the default /var/log directory hold?

System messages, login information, & application logs on Linux

Logins from various locations around the world that don't match with a company's internal policies are an IOC because:

They can signal unapproved access from unregistered locations

What is the main purpose of impact analysis?

Determine the tangible and intangible cost of attack to an organization

What is Little Snitch?

MacOS software that shows communicating processes & applications

A SIEM is useful because provides which of the following:

A correlation of information across the system

What is the best way to keep SIEM and EDR rules and configurations up to date?

Applying threat hunting results

What are the 3 categories of controls?

Administrative, logical/technical, physical

What are some of the key elements to a good incident response plan?

Identify who is involved & know the communication requirements

When executing a scan, which of the following is considered a best practice:

Let the scan run & notify you when complete

A well-defined scan will help with determining which of the following:

The number of areas that could be affected while the scan is taking place

Unexpected outbound transmissions are difficult to detect because:

Hard to tell what applications are doing on a network unless monitored 24/7

What does OWASP stand for?

The Open Web Application Security Project

studbud

CySa+ 003

89 termsStudBud Administration14 plays

Imported from external platform

Flashcards89 cardsFPractice quizPHost liveL

Questions 89

Answers

1
What is the first step in the Intelligence Cycle?
Requirements
Reconnaissance
Collection
prioritization
2
ArcSight, Qradar, Splunk, Alienvault, OSSIMKiwi Syslog, & ELK are all examples of:
Vulnerability scanning software
SIEMs
NGFWs
Anti-malware programs
3
In the verification phase, an audit is used to do what?
Define risk
See if you are complying with a policy
Conduct a vulnerability assessment
Define security policy across the organization
4
What is an effective way to prevent a mobile device held as evidence from being remotely wiped?
Forensic image
Snapshot
Faraday device
Legal hold
5
The risk evaluation process is a review process of which of the following:
Technical & operational processes
Technical & operational controls
All of the above
Patching & configuration changes
6
Within a IR team, communication needs to be:
Anonymous
Secure
Repetitive
Not able to be copied or forwarded
7
Which of the Web application scanners in this section requires the most manual intervention?
ZAP
Burp Suite
Arachni
Nikto
8
Which of the following is true about Advanced Persistent Threats?
Threats are carried out only by hacktivists
Threats are created by small, grassroots organizations
Threats are generally initiated during business hours
Threat actors are very focused
9
How does a machine learning algorithm “learn”?
Incorporating all available data to identify clusters of related data
Incorporating all available data to identify clusters of related data
Using historical data to make predictions and assessing its accuracy
Using real-time data to make predictions
10
What does the default /var/log directory hold?
Event Viewer logs
System messages, login information, & application logs on Linux
ACLs on Active Directory
Windows System logs
11
Which early remote service call method uses XML over HTTP?
DevOps
REST
SOAP
SAML
12
Which type of system may contain vulnerabilities due to the autonomous operation of remote facilities?
PLC
SCADA
SCM
SEIM
13
Logins from various locations around the world that don't match with a company's internal policies are an IOC because:
Geographically disparate logins are always an indicator of compromise
They can signal unapproved access from unregistered locations
A login from another country is always a sign of an APT
No one outside the company should be granted access to the network
14
What is the main purpose of impact analysis?
Determine the long-term cost of potential threats to an organization
Determine the immediate cost of potential threats to an organization
Determine the tangible and intangible cost of attack to an organization
Determine the immediate cost of an attack to an organization
15
What policy defines when data should be deleted?
Data sovereignity
Data ownership
Data classification
Data retention
16
Which cloud service model provides the operating system and even databases, but no applications?
SaaS
IaaS
FaaS
PaaS
17
What is Little Snitch?
A hardware device that prevents fake authentication on a network
A 3rd party software that disables rogue devices
Windows software designed to filter malicious inbound traffic
MacOS software that shows communicating processes & applications
18
What term refers to a programmable chip that supports the ability to be modified in the field?
Embedded systems
RTOS
FPGA
SoC
19
When code is in development, what is done in the vulnerablity review?
Static analysis & code review
Acceptance testing
Regression testing
End user testing
20
What agreement with your cloud service provider may prohibit you from scanning your cloud assets?
AUP
SLA
NDA
MOU
21
Which application software layer most likely interacts directly with an enterprise database to create summary reports?
Presentation
Communication
Storage
Business logic
22
A SIEM is useful because provides which of the following:
A correlation of information across the system
A single point in time view
A list of all the current logged-in users
Physical locations for all the IT assets
23
What is the best way to keep SIEM and EDR rules and configurations up to date?
Use both to hunt for threats
Applying threat hunting results
Review configurations daily
Schedule weekly signature database updates
24
What does the security of encrypted data most depend on?
Service model
Deployment model
Cloud service provider
Encryption key
25
What is hashcat used for?
Password cracking
Imaging a source
Hashing data
Password storage
26
What are the 3 categories of controls?
Acceptable, security, management
Administrative, security, accounting
Administrative, logical/technical, physical
Accounting, technical/logical, data
27
Which active scanner is a supercharged version of a simple network utility that allows you to craft custom packets?
Nmap
hping
netcat
Responder
28
Which term refers to malware that operates exclusively in memory?
Rootkit
Trojan horse
Fileless
APT
29
Geoblocking is one approach to which type of access control?
Masking
DRM
DLP
Encryption
30
What are some of the key elements to a good incident response plan?
Identify who is involved & know the communication requirements
Have policies 7to contact all system administrators prior to any action
Have a predetermined plan of action that you are required to follow
Immediately backup all machines & logout all users on the system
31
What does NGFW stand for?
Next Generation Firewall
Near Generation Firewall
Normal Grounded Firewall
Network-Generated Firewall
32
Communication between a host that might be compromised on the network & an external controller is called:
Beaconing
A rogue device
Unauthorized privileges
Podslurping
33
When executing a scan, which of the following is considered a best practice:
Only scan at night right after your nightly backups
Always have the scanning software running on the entire system
Only let the scan run for 20 mins & then stop it
Let the scan run & notify you when complete
34
Which attack framework is based on the military’s F2T2EA?
TTP
MITRE ATTACK
Diamond Method
Kill Chain
35
A Cisco firewall is what type of firewall?
Software firewall
Kernel-based firewall
Device firewall
Operating system firewall
36
Which of the following is an appropriate method to protect your network assets:
Only worrying about external intruders
Using one brand of equipment
Network segmentation
Turning off all your wireless routers at night
37
What technique uses anonymized responses from subject matter experts to assess risk?
Quantitative
Qualitative
Delphi
Hybrid
38
Which of the following is an indicator of compromise?
Attack surface analysis
File requests
Normal login traffic
Login irregularities
39
Splunk Phantom is what type of security tool?
SOAR
SIEMs
IDS
IPS
40
Which of the following is included in the development phase of the SDLC?
Active analysis
User acceptance testing
Code review
Fuzzing
41
A well-defined scan will help with determining which of the following:
The exact amount of time the scan will run
The number of areas that could be affected while the scan is taking place
The frequency of the scan
The particular areas of vulnerability an attacker might pursue
42
Which response category describes a reported insecure Web server that wasn’t actually present in your network?
True positive
True negative
False negative
False positive
43
Unexpected outbound transmissions are difficult to detect because:
There are so few outbound transmissions on a network
Anomalous activity only happens at the application layer
Network monitoring can only be done during normal business hours
Hard to tell what applications are doing on a network unless monitored 24/7
44
Which of the following best describes hacktivism?
Well-funded
Must be part of known hacktivist group
Decentralized
Severe & widespread scope of impact
45
What term refers to the feature that avoids firmware overwrite failures that result in unbootable devices?
Firmware attestation
Unified Extensible Firmware Interface
Trusted firmware updates
Measured boot
46
What term describes intelligence sources that are only available to an organization’s internal personnel?
Closed-source
Confidential classification
Open-source
Intellectual Property
47
What does OWASP stand for?
Open Web Application Software Program
Organization of Web Application Security & Protocols
The Open Web Application Security Project
Organization for Web Application Specialist Practices
48
Which tool can be used on wired and wireless environments to crack passwords?
Aircrack-ng
oclHashcat
Reaver
Prowler
49
Which of the following is a network-related symptom of compromise?
Unexpected error messages
Disk consumption
Out of memory alerts
Bandwidth consumption
50
Which cloud assessment tool would be the best choice for a Google Cloud environment?
Pacu
Prowler
Scout Suite
Reaver
51
What is a common open source IPS that makes it easy to build rules to detect and prevent intrusions?
Snort
Datadog
SolarWinds
Barracuda
52
Which cryptographic technique uses a pair of keys, one to encrypt data and the other to decrypt data?
Asymmetric encryption
Hashing
Digital signature
Symmetric encryption
53
Which of the following are examples of circle of trust members for an Incident Response:
Upper management & IT Staff only
Key staff, authorized internal & external partners
IT Staff & IR team only
Everyone involved in the incident
54
Allowing access to a record that bypasses authentication by using a direct record ID is what type of vulnerability?
Race condition
Object dereferencing
Insecure object reference
Improper error handling
55
How does an attacker attempt to carry out an integer buffer overflow attack?
Terminate a valid database query statement and add malicious ones
Embed a link to a malicious Web site that the user unknowingly follows
Provide input that causes a function to call itself over and over
Provide a value that is larger than the software can handle
56
What is the origin of the encryption key for SED?
User provides the password
TPM generates the key
Disk controller generates the key
HSM releases the key
57
What is a botnet?
The approved range of IPv6 addresses reserved for autonomous devices
A control network for autonomous robots, as in manufacturing environments
The wireless range for connection and communication between devices
A collection of compromised devices generally used to launch a DDoS attack
58
Why should default user accounts be deleted after installing software?
Default user accounts slow systems down
Too many user accounts make administration confusing
Default user accounts make it difficult to add new users
Most applications have default user accounts making it easy for attackers
59
How do you determine which vulnerability to mitigate first?
Choose the vulnerability with the least impact, but highest likelihood
Choose the vulnerability with the greatest impact and highest likelihood
Choose the vulnerability with the greatest impact, but lowest likelihood
Choose the vulnerability with the greatest impact or highest likelihood
60
Which risks should get the most attention?
Highest probability of occurrence and lowest impact
Highest probability of occurrence and highest impact
Lowest probability of occurrence and highest impact
Lowest probability of occurrence and highest impact
61
What resource is a community-driven effort that provides a wide variety of hardening guides and configuration baselines?
ARF
CVSS
OpenSCAP
OVAL
62
What report results in a prioritized list of the most important and vulnerable critical business functions?
DRP
RTO
BCP
BIA
63
Which European Union regulation protects individual data privacy?
HIPPA
GDPR
SOX
PCI DSS
64
A framework is often described as which of the following:
A government standard that applies only to the military
An industry standard that is needed for licensing
A certifying entity
An outline of best practices
65
What policy specifies whether it is okay to access Facebook from a work computer?
Acceptable Use Policy
Nondisclosure agreement
Password policy
Code of conduct
66
What threat modeling technique was developed by Microsoft?
Trike
PASTA
STRIDE
PyTM
67
What NIST protocol defines modules that dictate compliance requirements and settings?
NASL
IP
SCAP
Nessus
68
How does threat hunting differ from most other security activities?
Threat hunting is defensive
Threat hunters are external specialists
Threat hunting requires little preparation
Threat hunting is proactive
69
What common data structure makes it easy to define permissions in the Windows operating system?
User acceptance testing
Group
Group Policy Object
Permission string
70
What are the two most popular types of attacks on physical access systems?
Replay and DDoS
Cloning and teardrop
Replay and cloning
DDoS and replay
71
Which type of threat hunting hypothesis is based on lessons learned from previous hunts?
Analytics-driven
Experience-driven
Situation-driven
Intelligence-driven
72
What is the most common data query language?
KQL
SQL
SPL
grep
73
Which hardware tampering technique can be thwarted by random signals resulting in voltage applied to chips
Microprobing
Visual analysis
TOCTOU
Atomic execution
74
Amazon Lambda is an example of what architecture?
IaaS
IaC
FaaS
PaaS
75
What is a common command-line utility used to build HTTP requests to invoke remote functions via APIs?
Web browser
curl
YARA
Nmap
76
What tool is commonly used in mapping and enumeration?
SSH
Nmap
grep
Ncat
77
Which logical network architecture provides a secure tunnel between two endpoints?
Mesh
Function as a service
Virtual private network
Virtual private cloud
78
What e-mail attack attempts to trick users into clicking links that refer to an attacker’s resource?
Phishing
Trojan horse
Forwarding
Impersonation
79
What type of threat research can you carry out using VirusTotal?
Behavioral
Comprehensive
Persistent
Reputational
80
Out of memory alerts are symptoms of compromise in which type of attack?
Transport-based
Host-based
Application-based
Network-based
81
Which approach to scanning reduces network traffic?
Agent-based
Server-based
Non-credentialed
Credentialed
82
Which type of threat actor commonly has access to the greatest funding and uses the most sophisticated attacks?
Organized crime
Script kiddie
Nation-state
Hacktivist
83
When controlling a crime scene, it is important to consider:
Complete access restriction
Scrubbing the disks
Chain-of-custody
Scanning for vulnerabilities
84
Which access method defines object classifications and user clearances?
RBAC
GBAC
MAC
ABAC
85
Which of the following is a principle of forensics?
Do no harm
Keep a jump bag on hand
Check logs daily
Keep a close eye on employees
86
What is a common method used to limit malicious data leakage?
IPS
Web proxy
IDS
DLP
87
After securing the crime scene, why is seizure the first step in a forensic investigation?
Because forensic images can only be created off-site
So evidence can't be tampered with
Acquisition, analysis, & reporting are less important
Because employees can't be trusted
88
Unauthorized access is a symptom of compromise in what type of threat?
Host-based
Network-based
Application-based
Ethernet-based
89
Which authentication attack type spreads out repeated login attempts across different computers on a network?
Credential stuffing
Password spraying
Impersonation
Privelge escalation

CySa+ 003 Flashcards | StudBud