Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CFR-410 > 1.0 Identify > Flashcards

1.0 Identify Flashcards

1
Q

Active

A

Active fingerprinting is performed with a scanning tool that sends specifically crafted packets and examines their responses to determine the operating system version and service-related information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Passive

A

Passive fingerprinting attempts to learn more about a targeted service without the targeted service without the target knowing it. A form of packet sniffing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Nessus

A

Tenable Nessus is a comprehensive vulnerability scanner that provides high-speed discovery, configuration auditing, asset profiling, sensitive data discovery, and vulnerability analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Nmap

A

Nmap can help a pen tester by scanning the status of network ports, enumerating the host information like its operating system, and identifying the IP address of all active hosts on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Switch Port analyzer (SPAN) ports

A

SPAN is an approach in which a network appliance (switch or router) takes the network packets that flow to and from one main port (or VLAN) on the device, then copies those packets to another port (mirror port). The mirror port then forwards the copied packets to the network monitoring system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Test access point (TAP) devices

A

TAP is not a port on an existing device, but a dedicated device itself. The TAP device sits between network appliances, often between a switch and router, and forwards both incoming and outgoing packets between those appliances to a security monitoring system. Packets are also copied to separate monitoring ports on the TAP device (one for incoming traffic, one for outgoing).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

service-level agreements (SLAs)

A

Clearly defines what services are to be provided to the client, and what support, if any, will be provided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Common Vulnerability Scoring System (CVSS)

A

A risk management approach to quantifying vulnerability data and then taking into account the severity of harm to different types of systems or information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Common Vulnerabilities and Exposures (CVE)

A

A database of software-related vulnerabilities. Maintained by the MITRE Corporation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Common Weakness Enumeration (CWE)

A

Sponsored by MITRE, provides a catalog of software weaknesses and vulnerabilities, with the goal of reducing security-related software flaws and creating automated tools to identify, correct, and prevent such flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Common Attack Pattern Enumeration and Classification (CAPEC)

A

A database that classifies specific attack patterns. Maintained by the MITRE Corporation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Threat Modeling

A

The process of identifying and assessing the possible attack vectors that target systems.
1. Identify security objectives and requirements
2. Identify the architecture of the target system, including its components, roles, services, and dependencies
3.Decompose the system further to identify how it functions and how those functions can be vulnerable
4. Identify know threats to the target system
5. Determine ways to mitigate these threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Network topology and architecture information

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Collect artifacts and evidence based on volatility level

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Assets and underlying risks

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data collection

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data analysis and e-discovery

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Threat targets

A

Individuals
Non-profit associations
Corporations
Governments
Critical Infrastructure
Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Mobile

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IOT

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SCADA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ICS

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

PLC

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Threat actors

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Threat motives/reasons

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Threat intent

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Attack Phases

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Attack Vectors

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Technique criteria

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

GDPR

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

HIPAA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

COPPA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

GLBA

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

CAN-SPAM

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

National Privacy laws

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

NIST Privacy Framework

A
37
Q

ISO/IEC 27000 series

A
38
Q

ISO 29100

A
39
Q

AICPA/CICA Generally Accepted Privacy Principles (GAPP)

A
40
Q

Federal Trade Commission

A
41
Q

ANSI/ISA-62443

A
42
Q

NIST Special Publication 800 series

A
43
Q

Standard of Good Practice from ISF

A
44
Q

NERC 1300

A
45
Q

RFC 2196

A
46
Q

PCI DSS

A
47
Q

SSAE 18

A
48
Q

NIST Cybersecurity Framework

A
49
Q

CIS Critical Security Controls

A
50
Q

COBIT

A
51
Q

NIST Special Publication 800-61

A
52
Q

DOD Risk Management Framework (RMF)

A
53
Q

IT Assurance Framework (ITAF)

A
54
Q

OWASP

A
55
Q

MITRE

A
56
Q

CAPEC

A
57
Q

CSA

A
58
Q

Critical assets and data

A
59
Q

Establish scope

A
60
Q

Determine vulnerability assessment frequency

A
61
Q

Identify common areas of vulnerability

A
62
Q

Users

A
63
Q

Internal acceptable use policies

A
64
Q

Operating systems

A
65
Q

Networking software

A
66
Q

Network operations and management

A
67
Q

Firewall

A
68
Q

Database software

A
69
Q

Access points

A
70
Q

Routers

A
71
Q

Wireless Routers

A
72
Q

Switches

A
73
Q

Firewall

A
74
Q

Modems

A
75
Q

Network Address Translation (NAT)

A
76
Q

Network configurations

A
77
Q

Network services

A
78
Q

DSL

A
79
Q

Wireless protocols

A
80
Q

Ip addressing

A
81
Q

Configuration files

A
82
Q

IOC information

A
83
Q

Perform Vulnerability assessment

A

Determining scanning criteria
Utilize scanning tools
Identify and assess exposures
Generate reports

84
Q

Conduct post-assessment tasks

A

Remediate/mitigate vulnerabilities
Recovery planning processes and procedures

85
Q

Hardening

A
86
Q

Patches

A
87
Q

Conduct audit/validate action was taken

A
88
Q

Vendor agreements, NDAs, and vendor assessment questionnaires

A

CFR-410 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions