Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Security > 6. Sound the alarm: detection and response > Flashcards

6. Sound the alarm: detection and response Flashcards

1
Q

Computer security incident response teams (CSIRT)

A

specialized group of security professionals that are trained in incident management and response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Documentation

A

any form of recorded content that is used for a specific purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Endpoint detection and response EDR

A

application that monitors an endpoint for malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Event

A

observable occurrence on a network, system, or device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

False negative

A

state where the presence of a threat is not detected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

False positive

A

alert that incorrectly detects the presence of a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident

A

occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of info or an info system; or constitutes a violation or imminent threat of violation of law, security policies, a security procedures, or acceptable uses policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Incident handler’s journal

A

form of documentation used in incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incident response plan

A

document that outlines the procedures to take in each step of incident response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Incident detection system IDS

A

application that monitors system activity and alerts on possible intrusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Intrusion prevention system IPS

A

application that monitors system activity for intrusive activity and takes action to stop the activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

National Institute of Standards and Technology NIST Incident Response Lifecycle

A

framework for incident response consisting of four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Playbook

A

manual that provides details about any operational action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security information and event management SIEM

A

application that collects and analyzes log data to monitor critical activities in an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security operations center SOC

A

org unit dedicated to monitoring networks, systems, and devices for security threats or attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security orchestration, automation, and response SOAR

A

collection of applications, tools, and workflows that uses automation to respond to security events

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True negative

A

state where there is no detection of malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

True positive

A

alert that correctly detects the presence of an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Command and control C2

A

techniques used by malicious actors to maintain comms with compromised systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Command-line interface CLI

A

text-based user interface that uses commands to interact with the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data exfiltration

A

unauthorized transmission of data from a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data packet

A

basic unit of info that travels from one device tot another within a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Indicators of compromise IoC

A

Observable evidence that suggests signs of a potential security incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Internet Protocol IP

A

set of standards used for routing and addressing data packets as they travel between devices on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Intrusion detection systems IDS
application that monitors system activity and alerts on possible intrusions
26
Media Access Control MAC address
unique alphanumeric identifier that is assigned to each physical device on a network
27
National Institute of Standards and Technology NIST Incident Response Lifecycle
framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, eradication and Recovery; and Post-incident activity
28
Network data
data that's transmitted between devices on a network
29
Network protocol analyzer packet sniffer
tool designed to capture and analyze data traffic within a network
30
Network traffic
amount of data that moves across a network
31
Network Interface Card NIC
Hardware that connects computers to a network
32
Packet capture p-cap
file containing data packets intercepted from an interface or network
33
Packet sniffing
practice of capturing and inspecting data packets across a network
34
Playbook
manual that provides details about any operational action
35
Root user (or superuser)
user with elevated privileges to modify the system
36
Sudo
command that temprarily grants elevated permissions to specific userst
37
tcpdump
command-line network protocol analyzer
38
wireshark
open-source network protocol analyzer
39
Analysis
investigation and validation of alerts
40
Broken chain of custody
Inconsistencies in the collection and logging of evidence in the chain of custody
41
Business continuity plan BCP
document that outlines the procedures to sustain business operations during and after a significant disruption
42
Chain of custody
process of documenting evidence possession and control during an incident lifecycle
43
Containment
act of limiting and preventing additional damage caused by an incident
44
Crowdsourcing
practice of gathering info using public input and collaboration
45
Detection
prompt discovery of security events
46
Documentation
any form of recorded content that is sued for a specific purpose
47
Eradication
complete removal of the incident elements from all affected systems
48
Final report
documentation that provides a comprehensive review of an incident
49
Honeypot
system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders
50
Incident response plan
document that outlines the procedures to take in each step of incident response
51
Indicators of attack IoA
series of observed events that indicate a real-time incident
52
Indicators of compromise IoC
Observable evidence that suggests signs of a potential security incident
53
intrusion detection system IDS
application that monitors system activity and alerts on possible intrusions
54
Lessons learned meeting
meeting that includes all involved parties after a major incident
55
Open-source intelligence OSINT
collection and analysis of info from publicly available sources to generate usable intelligence
56
Playbook
manual that provides details about any operational action
57
Post-incident activity
process of reviewing an incident to identify areas for improvement during incident handling
58
Recovery
process of returning affected systems back to normal operations
59
Resilience
ability to prepare for, respond to, and recover from disruptions
60
Standards
references that inform how to set policies
61
Threat hunting
proactive search for threats on a network
62
Threat intelligence
evidence-based threat info that provides context about existing or emerging threats
63
Triage
prioritizing of incidents according to their level of importance or urgency
64
VirusTotal
service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content
65
Anomaly-based analysis
detection method that identifies abnormal behavior
66
Array
data type that stores data in a comma-separated ordered list
67
Common Event Format CEF
log format that uses key-value pairs to structure data and identify fields and their corresponding values
68
Configuration file
file used to configure the settings of an application
69
Endpoint
any device connected on a network
70
Endpoint detection and response EDR
application that monitors an endpoint for malicious activity
71
False positive
alert that incorrectly detects the presence of a threat
72
Host-based intrusion detection system HIDS
application that monitors the activity of the host on which it's installed
73
Intrusion detection systems IDS
application that monitors system activity and alerts on possible intrusions
74
Key-value pair
set of data that represents two linked items: key, and its corresponding value
75
Log
record of events that occur within an organization's systems
76
Log analysis
process of examining logs to identify events of interest
77
Log management
process of collecting, storing, analyzing, and disposing of log data
78
Logging
recording of events occurring on computer systems and networks
79
Network-based intrusion detection system NIDS
application that collects and monitors network traffic and network data
80
Object
data type that stores data in a comma-separated list of key-value pairs
81
Search Processing Language SPL
Splunk's query language
82
Security information and event management SIEM
application that collects and analyzes log data to monitor critical activities in an organization
83
Signature
pattern that is associated with malicious activity
84
Signature analysis
detection method used to find events interest
85
Suricata
open-source intrusion detection system, intrusion prevention system, and network analysis tool
86
Telemetry
collect and transmission of data for analysis
87
Wildcard
special character that can be substituted with any other character
88
YARA-L
computer language used to create rules for searching through ingested log data
89
Zero-day
exploit that was previously unknown

Cyber Security (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions