Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > 4.0 Operations and Incident Response > Flashcards

4.0 Operations and Incident Response Flashcards

1
Q

What is tcpdump?

A

tcpdump is a command-line packet capture utility built-in to most Linux distributions that output a description of the contents of each packet received on a network interface

Can help audit server’s security settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is tshark?

Can it run on Windows?

A

tshark is a terminal version of Wireshark that also captures and displays packet information from any network interface. This can run on a Windows computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is AirPcap?

A

AirPcap is a wireless adapter designed specifically for packet capture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does Python Script indicate a function?

What does it not initialize with?

What kind of “=” simple does it use?

A

The correct Python script correctly defines its variables, uses “def” to indicate a function is being defined, uses proper indentation, and calls the function after it has been defined.

The code block that does not initialize the ‘filename’ or ‘pattern’ variables becomes incomplete. Therefore, the code will halt with an exception NameError.

The code block that uses the ‘==’ operator to assign variables is using the wrong syntax; it should use a single ‘=’ operator. The same code block is also calling the search_file function before it is defined which will result in an error.

The code block that defines the search_file function with func is using the wrong syntax. Instead the function should be defined with def.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is The DoD 5220.22-M?

A

The DoD 5220.22-M wipe method involves a three-phased pass of writing 1s, 0s, and random characters onto a hard drive.

This method will prevent the use of many software-based file recovery methods. The systems admin must use this method before sending equipment to public schools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Degaussing or to Degauss?

A

Degaussing is a method of erasing data on a hard drive with a powerful magnet.

This is appropriate for preparing systems before use by public schools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is whireshark?

Does it provide replay?

A

Wireshark is both a sniffer and protocol analyzer tool. It is capable of parsing (interpreting) the headers of hundreds of network protocols and listing the contents of the data packets in plain view, if available. It can eavesdrop and scan open networks.

Does not provide replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Nexpose?

A

Nexpose is a vulnerability scanner that is like Nessus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is “tcpreplay”

A

The tcpreplay tool can replay network traffic captured by another program, such as Wireshark, in the form of a .pcap file. This can be used to investigate suspicious traffic or test the effectiveness of intrusion detection rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is The scanless tool?

Whats it’s main function?

What does it run on

What does it not check?

A

The scanless tool is a port scanner that runs its scans through third-party websites to evade detection.

Its main functionality is scanning ports, and it does not capture or replay network traffic.

Python-based command-line utility

It does not check hosting records or DNS services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Cuckoo? What does it do?

What does it not do?

Where does it run?

what can it not be used for or what else or what else?

A

Cuckoo is a security product designed to analyze malware as it runs in an isolated sandbox environment. It does not scan for vulnerabilities.

it can not be used for Denial of Service attack

nor packet sniffing or injection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is FTK Imager?

What else is it capable of? what can of file format does it use?

A

FTK Imager is a data imaging tool that quickly assesses electronic evidence to determine if further analysis is required.

Includes the capability for live memory capture and saves the data in a proprietary .eo1 file format.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is WinHex?

What can it do? What requirements for it need to do so?

What is it used for?

A

WinHex is a hex and disk editor for Windows that, when preinstalled on the host system, allows live capture of system memory.

often used for digital forensics and data recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What os uses memdump?

What does it run agaisnt?

As long as what is installed?

Give 2 examples of such installation?

A

The Linux-based tool memdump can run against the /dev/mem device file provided a kernel driver, such as pmem or fmem, is installed.

However, it is not compatible with Windows machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is dd?

What OS is it for?

A

The common Linux tool dd is a file conversion and copying tool that copies entire disks, including hard disk images and memory dump files such as the /dev/mem device file on Linux. It’s not compatible with Windows machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is hping?

what are 3 of its capabilities?

A

The open-source tool, known as hping, has packet sniffing and injection capabilities, as well as Denial of Service (DoS) testing features built right in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is The Volatility Framework used for?

What can it install and tools can it use?

What would it access?

A

The Volatility Framework is widely used for system memory analysis and can install the pmem kernel driver, allowing tools such as memdump or dd to access the /dev/mem device memory file on Linux.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Sn1per framework designed for?

What can it integrate?

A

Sn1per is a framework designed for penetration test reporting and evidence gathering and can integrate with other tools, such as Metasploit, to run automated tests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe the Zed Attack Proxy?

Who was it developed by?

what does it provide?

A

The Zed Attack Proxy, developed by the Open Web Application Security Project (OWASP), provides scanning tools and scripts for web application and mobile app security testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is The netstat command?

What OS is it compatible with?

What can an admin do with it?

A

The netstat command allows the admin to check the state of ports on the local machine (Windows or Linux).

The admin may also be able to identify suspect remote connections to services on the local host or from the host to remote IP (Internet protocol) addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is netcat

What does it do?

What OS does it work with?

What can be used as?

A

The netcat (or nc for short) is a remote access software that is available for both Windows and Linux. It can be used as a backdoor to other servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What OS the tool “pathping” toll for ?

What does it provide ?

What is it equivalent to?

A

The pathping tool for Windows provides statistics for latency and packet loss along a route over a longer measuring period.

The equivalent on Linux is mtr.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is theHarvester?

A

theHarvester is a tool for gathering open-source intelligence (OSINT) for a particular domain or company name. It works by scanning multiple public data sources and gathering emails, names, subdomains, IPs, URLs, and other relevant data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Active KillDisk?

A

Active KillDisk is a disk wiping sanitization software tool that can purge data on disk by overwriting data with 1s and 0s.

Overwriting might also be performed in multiple passes. The disk can be recycled after using this software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does The “route” command do?

What would be a red flag?

A

The route command views and configures the host’s local routing table.

Entries that are unfamiliar or that are not routers can be considered suspicious.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What does The “tracert” command do?

A

The tracert command uses ICMP probes to report the round trip time (RTT) for hops between the local host and a host on a remote network on Windows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is The traceroute command?

A

The traceroute command performs route discovery from a Linux host using UDP probes rather than ICMP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Example of command to gernarate RSA Key?

what will be the output?

A

openssl genrsa -out server.key 1024 command generates an RSA key.

It will output as server.key. 1024 represents the key size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is The dnsenum tool?

A

The dnsenum tool performs a number of tests in a single query and can retrieve hosting information, name records, and even work out IP address ranges currently in use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is i The %SystemRoot%\NTDS\NTDS.DIT file?

A

The %SystemRoot%\NTDS\NTDS.DIT

file stores domain user passwords and credentials.

Employees commonly use their domain credentials to login to do work and gain access to corporate information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does The logger command do?

A

The logger command writes input to the local system log or to a remote syslog server.

32
Q

What does the arp command do?

A

The arp command is a TCP/IP command-line utility for viewing and modifying the local Address Resolution Protocol (ARP) cache, which contains recently resolved MAC addresses of Internet Protocol (IP) hosts on the network.

33
Q

What is Recovery is a in the incident response lifecycle?

What does it ensure?

What are 3 things it must accomplish?

A

Recovery is a stage in the incident response lifecycle.

This stage ensures that the threat no longer exists, and all systems are brought back to a secure state.

It requires to eliminate the threat,
bring systems online,
and test.

34
Q

What is the Identification in the incident response lifecycle?

What happens in it?

What is it followed by?

A

Identification is a stage in the incident response lifecycle.

In this stage, it is determined whether an incident has taken place.

The assessment of how severe the incident might be is followed by notification of the incident to stakeholders.

35
Q

What is Containment in the incident response lifecycle?

What is its goal? What’s a common approach?

What are 2 examples of containment

A

Containment is a stage in the incident response lifecycle. In this stage,

the goal is to limit the scope and reach of the event. One approach in containment is to isolate infected systems.

Containment involves limiting the scope and impact of the incident. Examples of containment would be putting controls in place, such as denying access to systems or password changes.

36
Q

What is Lessons learned in the incident response lifecycle?

What happens in it?

A

Lessons learned is a stage in the incident response lifecycle.

During this stage, the incident and related actions are reviewed for what went right and what went wrong data.

37
Q

What are Policies and Procedures in an incident response plan?

Why are they important?

Who should be part of it?

A

Policies and procedures for dealing with security breaches should be part of an incident response plan.

The preparation phase is important, as it outlines a structured response approach rather than simply reacting. It can also provide a guideline for incident prioritization.

Personnel and resources should be part of an incident response plan. When outlined in the preparation phase, responsibilities for specific actions and lines of communication will be coordinated, rather than chaotic, when an incident occurs.

38
Q

What is Incident management?

A

Incident management is an overall arching concept of managing an incident from start to finish.

39
Q

What is Analysis and identification in the incident lifecycle?

A

During this phase, a threat is identified for specifics so action can be taken.

40
Q

Which type of user should the security team primarily invite to their procedures?

A

The members of such a team should be able to provide the range of decision making and technical skills required to deal with different types of incidents.

The team should include a member with the ability to authorize actions.

41
Q

Who is a privacy officer?

A

A privacy officer is responsible for oversight of any Personally Identifiable Information (PII) assets managed by a company. This role ensures that the processing and disclosure of PII comply with legal and regulatory frameworks and also oversees the retention of PII.

42
Q

What can we say about employees with access to privileged data?

A

Employees with access to privileged data may have access to Personally Identifiable Information (PII) and should have training in any relevant regulatory or compliance frameworks.

43
Q

Which key element should the security experts focus on as a goal of disaster recovery exercises activities?

A

Roles and responsibilities can be defined and acted out in an exercise.

Assigning solid roles and responsibilities avoids the possibility of confusion and missed steps during an incident response.

44
Q

What is Eradication in the incident response lifecycle?

What happens in it?

Whats an example?

A

Eradication is a stage in the incident response lifecycle.

In this stage, IT removes the threat to proceed to recovery.

Eradication involves the removal or repair of the cause of the incident.

Examples of eradication would be virus removal or installing a software security patch to fix an exposed vulnerability.

45
Q

What is Recovery is a stage in the incident response lifecycle?

A

Recovery is a stage in the incident response lifecycle that ensures the threat no longer exists, and IT can bring back all systems to a secure state.

46
Q

What is an After-action report

A

An after-action report is a result of a lessons learned session

Lessons learned is a stage in the incident response lifecycle. During this stage, the incident and related actions are reviewed for what went right and what went wrong data.

47
Q

What is a tabletop exercise?

A

With a tabletop exercise, staff will “ghost” the same procedures as they would in a disaster, without actually creating disaster conditions or applying or changing anything.

48
Q

What is a walkthrough in incident response?

A

Walkthroughs provide basic awareness and training for disaster recovery team members, these exercises describe the contents of disaster recovery plans and other plans, and the roles and responsibilities outlined in those plans.

49
Q

What is Functional exercise in incident reponse?

A

Functional exercises are action-based sessions where employees can validate all plans by performing scenario-based activities in a simulated environment.

50
Q

What are Full-scale exercises in incident response?

A

Full-scale exercises are action-based sessions that reflect real situations. These exercises are held onsite and use real equipment and real personnel as much as possible.

51
Q

What is preparation in incident response?

A

Preparation involves:

hardening systems,

writing policies and procedures, and

establishing confidential lines of communication in the event of an incident.

52
Q

What is a test access point (TAP)?

What is it used for? Why?

What do you call an active TAP?

Which is more reliable?

A

A test access point (TAP) is a hardware device that copies signals from the physical layer and the data link layer,

Since no network or transport logic is used with a test access point (TAP), every frame is received, allowing reliable packet monitoring. (Test access point (TAP) avoids frame loss.)

Test access points (TAPs) can be either active or passive. Also, switched port analyzers (SPAN) are considered active.

Test access points (TAPs) are more stable and reliable than switched port analyzers (SPAN) and considered an investment as a long term solution, whereas SPAN is more useful for temporary solutions.

53
Q

What is OSSEC?

What does it do?

What can it do?

A

OSSEC is a host intrusion detection system (HIDS) that can collect DNS server logs for trend analysis.

OSSEC can crosscheck these DNS server logs against a list of known malicious domains.

OSSEC can perform frequency-based trend analysis on NXDOMAIN errors received by comparing it to a baseline. Trends outside of the baseline may allude to malicious activity.

54
Q

How a security specialist might adjust the sensitivity of the dashboard’s automated alerts in a SIEM ?

A

Reducing the number of rules that produce events will reduce sensitivity and reduce false positives.

By contrast, increasing the number of rules can increase sensitivity and reduce false negatives.

55
Q

What is NXlog (nxlog.co)

What platform is it compatible with?

A

is an open-source centralized log collection tool.

It has similar features of a SIEM like alerting, normalization, aggregation, correlation, and retention.

NXlog is multi-platform compatible.

56
Q

What is a SIEM (Security Information and Event Management) software?

A

SIEM (Security Information and Event Management) software collects and collates security and log data from across a network in real-time, and organizes it for efficient threat analysis, with the ability to link events and related data into alertable reports.

57
Q

In what order do the The rules in the ACL of a firewall process?

Where should you place implicit denial rules?

What happens If you do it all the way around

What happens if denial is placed in the middle?

A

The rules in the ACL of a firewall process top to bottom.

Traffic will continue to be checked down the list of rules to determine if it may pass or not.

Best practice is to set the implicit denial rule at the end (Bottom), to block all traffic left unmatched.

An implicit denial rule, processed first at the top of the list, will deny all traffic immediately. This will prevent all traffic.

An implicit denial rule in the middle of the list may cause some rules to process while others do not. This could lead to a leakage of some unwanted traffic.

58
Q

What is an Allow List ?

A

An allow list is a list of applications in an Access Control List with permission to run. Applications not found on the list cannot run. This often causes issues and results in more support calls and higher costs.

59
Q

What is Applocker?

What OS is it for?

A

Locks which apps can be used

AppLocker is only available on Windows machines. It protects against unwanted software and assists in software standardization.

60
Q

What are Blackholes in Networks??

What kind of teqnique is it?

A

Blackholes correspond to locations in the network that quietly discard (or “drop”) incoming or outgoing messages, without notifying the source that it did not reach its intended recipient. Blackholes are an isolation technique because they isolate the attacker from the network.

61
Q

What is a Sinkhole?

Who’s cam be a form of what? Why?

A

Sinkhole routing means suspicious traffic that is flooding a specific IP address routes to another network for analysis.

This is a form of segmentation because it maintains the connection to other networks.

62
Q

What is a sandbox ?

A

A sandbox is an isolated environment created for analyzing malware and exploits safely, such as Cuckoo, for example.

63
Q

Considering how evidence may be collected and documented, which method is more reliable but may make witnesses less willing to provide a statement?

A

Authorities use video recordings (usually with audio) to interview witnesses and suspects. While such a recording may be considered of great value in an investigation, individuals may be uncomfortable with being interviewed this way.

64
Q

What is eDiscovery in forensics?

A

eDiscovery is a means of filtering relevant evidence produced from all the data gathered in a forensic examination.

65
Q

How are Photographs used in crime scene?

A

Photographs would be used in a crime scene with physical evidence, but may not be as helpful when used as an interview method.

66
Q

What does dd command do ?

A

The dd command can copy an entire disk as an image to a USB thumbdrive. The team can then analyze the image in a sandbox environment.

67
Q

What can you say about drive snapshots as evidence?

A

It is possible to create snapshots of the compromised volumes, and in some cases, it can boot a virtual machine, as a full disk image can. This may not be the most efficient method, however.

68
Q

Determine Ways a cyber security team can analyze Windows OS compromise?

A

Check system and security logs.

Windows writes contents of memory to a dump file or mini dump file when Windows encounters an unrecoverable kernel error.
The contents can be analyzed for a variety of information.

Initiate sleep mode and analyze the hibernation file.

Windows creates a hibernation file at the root of the boot volume when in sleep mode. The data can be recovered and decompressed, then loaded into a software tool for analysis.

Check system and security logs.
Windows system and security logs can provide insight on certain events with a timeline and who may have logged on or tried to log on to the system.

69
Q

A help desk technician began recovery by powering the system down. As a result, what has been compromised?

A

Volatile storage (for example, system or cache RAM) is storage that is usually temporary and is easily erased or lost. Powering down a system will remove any potential evidence that is contained in volatile storage. The order of volatility can be used during an investigation and is a general outline of components arranged from more to less volatile.

70
Q

Wha is a Legal hold?

A

Legal holds refer to information that may be relevant to a court case that must be preserved. This may include data or entire computer systems.

71
Q

Recommend strategies for establishing the provenance of the evidence during the acquisition process.

if the evidence is in doubt, then it may become inadmissible in a court of law.

A

Recording the entire acquisition process establishes the provenance of the evidence and shows that the analyst has not tampered with the evidence.

Capture evidence in the order of volatility. From most volatile to less volatile, more data can be captured before it becomes unavailable. Assuming data is not corrupted, the order of volatility will not have a large impact on provenance or admissibility.

By providing a record of the investigation process that includes time stamps, a timeline can be established.

Writing down the time and method of acquisition might be helpful for internal tracking but it is not going to be admissible in a court of law.

72
Q

What determination do the investigators conclude as the reasoning behind the odd timestamps on the NTFS volumes and FAT?

A

Different file systems use different methods to identify the time when something occurred. NTFS uses UTC “internally,” but many file systems record timestamps as the local system time. In forensics, it is vital to note the offset between the local system time and UTC.

73
Q

What is the main difference between a snapshot and a disk image?

Which has more validity?

A

A disk image is a digital file accurately representing the contents and configuration of a disk volume or a whole data storage unit. A disk image includes a bootloader and operating system (OS).

Snapshots are not exclusive to Windows and are available on other OS platforms. Windows snapshots are possible using the Volume Shadow Copy Service (VSS)

A snapshot is a point-in-time copy of data maintained by the file system and are commonly live acquisitions. This has less validity than a disk image.

74
Q

What is Erradication?

A

Eradication is an incident response lifecycle phase pertaining to finding the root cause of an incident. For example, a user clicking a malicious link in an email is a root cause for a potentially larger problem.

75
Q

What kind of practice is keeping a timeline intended for? (Forensics)

A

Keeping a timeline is a preservation of evidence practice.

Security+ (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions