1.5 - 1.8

Question 1

Threat actors and attributes

Answer 1

Entity responsible for an event that has an impact on the safety of another entity

Advanced persistent threat (apt)

Question 2

Hacktivist

Answer 2

Hacker with purpose, such as political agenda or social change

Very specific hacks, message or theme.

Usually not financial gain involved

Question 3

Script kiddies

Answer 3

Runs premade Scripts not really full of technical knowledge. Hoping one of many scripts will work

Question 4

Hackers

Answer 4

Authorized ethical hackers
Unauthorized hackers For malicious was
Semi authoriZed finds vulnerability but doesn’t take advantage
Of it

Question 5

Going rogue

Answer 5

Instead of IT giving approval, we go rogue and do techniques to work around road blocks

Question 6

Attack vectors

Answer 6

Gain access to infected target.. finding just on vulnerability

Question 7

Wireless attack vectors

Answer 7

Default login needs to change
Rogue access needs to be closed
Evil twins or man in the middle with on path need to be destroyed
Use latest tech

Question 8

Email vector attacks

Answer 8

Phishing malware or social engineering, invoice scams

Question 9

Supply chain attack vector

Answer 9

Each step in the supply chain is an attack vector

Question 10

Social media attack vectors

Answer 10

Using on one info against you via profiling and getting ur questions

Fake friends

Question 11

Removal media attack vectors

Answer 11

Usb with malicious software Can also act like a Keyboard and can exfiltrate a lot of data even terabytes

Question 12

Cloud attack vector

Answer 12

Public facing apps can be made with miss configuration

Bruteforce , or denial of service or orchestration attacks

Question 13

Threat Intel

Answer 13

Research, decisions based on intel, via open source materials on the internet, gov or internet sources

Needs constant threat monitoring

Question 14

Vulnerability databases

Answer 14

Common vulnerability and exposure where researchers go in study and make the data bases more secure

See at national vulnerability database

Question 15

Automated indicator sharing

Answer 15

Automating the dissemination of threat Intel

Question 16

Stix

Answer 16

Structured threat information expression

Describes cyber threat info including motivations abilities capabilities and response info

And uses Taxii to share stix securely. Trusted automated exchange of indicator information

Question 17

Indicator of compromise

Answer 17

Indicator that someone is on your network , an event and the time roughly

Indicators-
Unusual amount of traffic
Change in hash values
Unusual network activity
Changes in dns
Uncommon logins
Spikes of read requests

Question 18

Predictive analysis

Answer 18

To understand where hackers are focusing efforts such as real-time dns query analysis, real time traffic patterns with location data.

Combining these can create a basic forecast

Inference about data rather then on signature

Question 19

Threat maps

Answer 19

Where threats occur per time of day in the world

Question 20

Threat research

Answer 20

Know what exists to be able to stop them

Vendor websites
Vulnerability feeds nvd.nist.gov or cve.mitre.org
Vulnerability management system
Conferences
Stories from the trenches

Question 21

Request for comments

Answer 21

Rfc standards documents of various vulnerabilities

Question 22

Ttp

Answer 22

Tactics techniques and procedures

What adversaries are doing now, proactively looking through threats, information on target victims, infrastructure used by attackers
Type of attacks etc

Question 23

Vulnerability types

Answer 23

Zero-day attacks, things we havent found yet. Researchers Trying to help fill the holes But hackers are racing them to find zero day

Question 24

Open permissions

Answer 24

Info is on the internet but no security…

Question 25

Unsecured root accounts

Answer 25

Admin or superuser as a result of misconfiguration Need to disable direct Login and user sudo

Question 26

Weak encryptions

Answer 26

Can cause hackage. Needs aes, 3des etc Length of encrpyrion matters needs 128 Need ro check hash sha or md5

Question 27

Insecure protocols

Answer 27

In the clear traffic sent via ftp, smtp, imap Need encrypted traffic lome ssh, sftp, imaps

Question 28

Third party risks

Answer 28

Human error is biggest issue This os a system integration risk. Sometimes there is lack of vendor report, so they need to update sec to work with us

Question 29

Threat hunting

Answer 29

Constant game of cat and mouse Strats always change Cant see attack until it happens Use tech to fight back to speed up

Question 30

Vulnerability scans

Answer 30

Not a pen test, just to look at the “potential” vulnerabilities. Port scan > nmap ip address. Test from outside and inside network

Question 31

Vulnerability scan types

Answer 31

Non intrusive scans to gather info Intrustive test to seemif vulnerability is real Non-credentialed scans from users without permission Credentialed scan from users with permission

Question 32

False Positives False negetivd

Answer 32

Vulnerability scan got it wrong, doesnt exist Diff than low Severity which exists but low prob Or false neg where there was no info, exists but doesnt detect

Question 33

Configuration review

Answer 33

Validate security levels, workstation configuration type and place, server access control permissions, sec devices and their firewall rules and authentication options

Question 34

Siem

Answer 34

Security information and event management Can collect security logs, events, alerts and info Central repository for historical and current reports Forensic analysis is possible after sec event occurs

Question 35

Syslog

Answer 35

Standard for sending messages from diverse tech but coming in syslog language

Question 36

Siem data inputs (type of data in siem)

Answer 36

Server authentication attempts Vpn connections Firewall session logs Denied outbound traffic flows Network utilization Packet captures

Question 37

Type of data analytic in cyber

Answer 37

Big data analytics User and entity behavior analytics (ueba) Sentiment analysis

Question 38

Soar

Answer 38

Security orchestration automation and response Configuring or reconfiguring rules dynamically as system is being evaluated

Question 39

Penetration test

Answer 39

Simulates an attack trying to gain access through exploitation Have permission, know systems to exploit, find vulnerabilities.. Password bruteforce Social engineering Database Injections Buffer overflows In path attacks

Question 40

The process of Pen testing

Answer 40

Initial exploitation (get in) Lateral movement (from sys to sys) Persistence (backdoor, user accoubts, change or verify pws; so can come back in) Pivot gain access to point they can restart at by using vulnerability sys as a proxy or relay After.. Clean up

Question 41

Reconnaissance before attack

Answer 41

Need info Gather digital footprint (social media) Understand security posture Minimize attack area (key systems) Create network map

Question 42

Wardriving /warflying

Answer 42

Combine wifi and gos to find wifi spots Can identify ssid, wifi security level etc Using kismet

Question 43

Passive and active footprintinf

Answer 43

They cant see us, passive is social media research,and network maps They can see us… Active is trying the locks on the doors with log scans, ping scans, port scans dns queries, os scans, os fingerprinting, nmap to find service and version scans

Question 44

Red team and blue team

Answer 44

Red On offense, ethical hackers can also use social engineering Blue - on defense include day to day sec tasks, damage control or reconstruction.

Question 45

Purple team and whote team

Answer 45

Combine red and Blue to not compete But sharing using feedback loop Overseeing both teams Like a Referee keep track of scoring