Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

MC 701 > 701 - Chapter 8 > Flashcards

701 - Chapter 8 Flashcards

1
Q

What is the likelihood that a threat will exploit a vulnerability called? What is a weakness in a system application or process? And what is a potential danger that might take advantage of a vulnerability called

A

Risk… vulnerability… threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two major criteria we use when we evaluate a risk?

A

The impact… the likelihood or probability of that risk occurring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does an organization mitigate IT risks?

A

By using different types of security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three IT related threats? And what does an organization use to help identify categorize threats

A

Malicious human threats, accidental human threats, environmental threats… a threat assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the five risk types or categories?

A

Internal, external, intellectual property theft, software compliance and licensing, legacy systems and legacy platforms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the practice of identifying, analyzing, monitoring, and limiting risk to a manageable level?

A

Risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the acknowledgment that risk exist and must be addressed to mitigate them?

A

Risk awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What refers to the risk that exist before controls are in place to manage the risk? What is the amount of risk that remains after managing or mitigating the risk to an acceptable level? And what refers to the risk that exist if in place controls do not adequately manage risks?

A

Inherent risk… residual risk… control risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What refers to the amount of risk in organization is willing to accept? And what is an organizations ability to withstand risk?

A

Risk appetite… risk tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the risk management strategy when an organization does not provide a risky service or does not participate in a risky activity?

A

Avoidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the risk management strategy when an organization implements controls to reduce risk? What are the two ways that mitigation reduces a risk?

A

Mitigation… by reducing the vulnerability or by reducing the impact of the threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the risk management strategy when the cost of a control outweigh the risk itself?

A

Risk acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the risk management strategy when an organization transfers, the risk to another entity or at least shares the risk with another entity? And what is a common example of this?

A

Risk transference… insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

And what insurance helps protect businesses and individuals from some of the losses related to cyber security incidents?

A

Cybersecurity insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the risk management task that quantifies or qualifies risks based on different values or judgments?

A

Risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is any product system resource or process that an organ organization values called? And what is the value of that asset called?

A

Asset… asset value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which risk assessment measurement uses numbers, such as a monetary figure representing cost and value? And which use judgments?

A

Quantitative… qualitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What examines an organizations known risk and evaluates the effectiveness of in place controls?

A

A risk control assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are two important factors or variables when doing a quantitative risk assessment? What is the portion of an asset that we expect would be damaged if a risk materializes?

A

Asset value AV and the exposure factor EF… exposure factor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the SLE and how is it calculated?

A

Single loss expectancy, it is the cost of any single loss of a specific asset… AV x EF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the ARO?

A

Annualized rate of occurrence, and it indicates how many times the loss will occur in a year… it is a measure of probability or likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the ALE? How is computed?

A

Annualized loss expectancy, it brings together the impact and probability/likelihood …SLE x ARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the assessment that uses judgment to categorize risk based on the likelihood of occurrence and impact?

A

A qualitative risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the two simple guidelines when making a quantitative risk assessment?

A

If the cost of the control is less than the savings purchase it… if the cost of the control is greater than the savings accept the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the final phase of the risk assessment called? And what does it identify?

A

Risk reporting… it identifies the risk discovered and the recommended controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are metrics used to measure and monitor the level of risk associated with a particular activity process or system called? What are some examples of KRIs?

A

Key risk indicators KRI… Number of security incidents detected per month, the percentage of overdue security patches,’the average time to detect and respond to a security incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a comprehensive document listing known information about risks such as the risk owner? And what does it typically include??

A

Risk register… Risk scores along with recommended security controls to reduce the scores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What plots risks onto a chart?

A

A risk matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What includes all the elements required to produce and sell a product called? And what is one way to reduce reduce the risk to this?

A

Supply chain… Ensuring that it has multiple sources for everything that is needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What assesses the security posture of systems and networks, the identify vulnerabilities or weaknesses within systems networks and organization as part of an overall risk management plan?

A

Vulnerability assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What uses various techniques to gather information about hosts within a network?

A

A network scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the five methods that a network scanner uses?

A

ARP ping scan, syn stealth scan, port-scan, service scan and OS detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is used to identify which systems are susceptible to attack, they identify vulnerabilities, misconfigured systems and the lack of security controls (such as out of date patches) that attackers can exploit?

A

Vulnerability scanner

34
Q

What do vulnerability scanners utilize?

A

A database or dictionary of known vulnerabilities

35
Q

What does CVE stand for?

A

Common vulnerabilities and exposures

36
Q

What does CVSS stand for? And what is the range of scores and what is most severe? And why have a the scores?

A

Common vulnerability scoring system… 0 to 10, 10 is most severe… to help with prioritizing the work with known vulnerabilities

37
Q

What is another standard used by vulnerability scanners and why was this designed?

A

Security content automation protocol SCAP… to help facilitate communication between vulnerability scanners and other security and management tools

38
Q

Which scans/tests are passive and have little impact on a system during a test? And which is intrusive and can potentially compromise a system?

A

Vulnerability scan… Penetration test

39
Q

What type of scan runs under the context of a valid account and can get more detailed information? They are typically more accurate than what and result in fewer what?

A

Credentialed… non-credentialed scans…false positives

40
Q

What type of scanner performs a configuration review of Systems to verify they are configured correctly? And are they running as credentialed or non-credentialed?

A

Configuration compliance scanner… credentialed

41
Q

What actively assesses deployed security controls within a system or network and generally starts with a reconnaissance to learn about the Target?

A

Penetration testing

42
Q

What are the four major categories of penetration testing?

A

Physical, offensive, defensive, integrated

43
Q

What outlines the boundaries of the penetration tests? And why is it important?

A

Rules of engagement… if this is not in writing, it essentially is an attack vs a penetration test

44
Q

What is generally the first phase of a penetration test? And what are the two methods for this?

A

Reconnaissance… passive, and active reconnaissance

45
Q

What is generally the difference between active and passive reconnaissance?

A

Passive reconnaissance does not include using any tools to engage the target and isnt illegal…while active reconnaissance does use tools to engage the Target and is illegal

46
Q

What type of Searches a network for active IP addresses it typically sends an Internet control message protocol ICMP pinging to arrange of IP dresses on any network? What is the problem with this type of scan?

A

IP Scanner…ICMP scans are often blocked

47
Q

What type of scanner runs from a command prompt and includes many capabilities like identifying all the active host on a network, their IP addresses, the the protocols and services running on each of these hosts and its operating system?

A

Nmap

48
Q

What is a command line tool that administrators often use for remotely accessing Linux systems

A

Netcat nc

49
Q

What is a python based command line utility to perform port scans?

A

Scanless

50
Q

What is a python based command line utility to perform port scans?

A

Scanless

51
Q

What is the command that will list DNS records for domains?

A

dnsenum

52
Q

What is a vulnerability scanner developed by tenable network security that uses plug-ins to perform various scans against systems and is often used for configuration reviews?

A

Nessus

53
Q

What utility can send pings using TCP, UDP or ICMP it can also be used to scan systems for open ports on remote systems?

A

hping

54
Q

What is an automated scanner used for vulnerability assessments and to gather information on targets during penetration testing it combines the features of many common tools into a single application?

A

sn1per

55
Q

This is used to transfer and retrieve data to and from server such as web servers?

A

cURL

56
Q

What are the two techniques penetration testers often combined to identify targets? Which one provides a big picture view, and which homes in on individual systems to provide details of each?

A

footprinting and fingerprinting…footprinting and fingerprinting…

57
Q

What type of fingerprinting identifies the operating system? And how does it do this? And what can it verify?

A

OS… By sending protocol queries or port scans to a server… That a service is running

58
Q

What is an attacker ability to maintain a presence in a network for weeks months or even years without being detected? And what is a common technique used to maintain this?

A

Persistence… creating a back door

59
Q

What is it called when an atacker gains access to its Target and then uses it to maneuver throughout a network?

A

Lateral movement

60
Q

What is it when a tester uses various techniques to gain more and more privileges?

A

Privilege escalation

61
Q

What is the process of using an exploited system to Target other systems?

A

Pivoting

62
Q

What are the three testing types (and their associated colors) defined based on how much the testers know about the environment?

A

Unknown environment testing (black box), known environment testing (white box) and partially known environment testing (gray)

63
Q

What is one of the last steps of a penetration test called and what does it include?

A

Clean up… Moving all traces of the penetration testing activity including accounts, scripts, files and settings

64
Q

What kind of programs allow for disclosure of security issues and vulnerabilities to be addressed before they are exploited by attackers? And what is an example of this?

A

Responsible disclosure… bug bounty

65
Q

What is an important tool for assessing an organizations compliance with industry standards, best practices, and internal policies by reviewing an organizations systems, processes and procedures?

A

System and process audit

66
Q

What is the most common method for resolving of vulnerability? In the event that this is not available to fix the issue, what are three other methods that can be used?

A

Applying a patch… deploying a compensating control, using segmentation to place the system on an isolated network and granting an exception/exemption to the security policy thus allowing the system to continue operating

67
Q

What refers to capturing network package transmitted over network and what refers to sending the packets back out over the network a second time? And would a packet be resent a second time?

A

Packet capture… packet replay… if needed the packets can be modified and resent for testing or for attacking

68
Q

What provides administrators and attackers with the ability to capture, display and analyze packets sent over a network? What are they useful for?

A

Protocol analyzers… troubleshooting communication problems between systems and to detect attacks that manipulate or fragment packets

69
Q

What is a suite of utilities used to edit packet captures and then send the edited pack packets over them at work? What is a command line protocol analyzer?

A

Tcpreplay…tcpdump

70
Q

What is a feature available on many routers and switches that can collect IP traffic statistics and send them to a collector?

A

Netflow

71
Q

Which ISO standard provides information on information security management system requirements?

A

ISO 27001

72
Q

Which ISO standard is a compliment to ISO 27001 and And provides organizations with best practice guidance?

A

ISO 27002

73
Q

Which ISO standard is an extension to ISO 27001 and ISO 27002 and outlines a framework for managing and protecting PII?

A

ISO 27701

74
Q

Which ISO standard is a family of standards related to risk management and provides a guideline that organizations can adopt?

A

ISO 31000

75
Q

What is the NIST framework that has seven steps to identify mitigate risks and is adopted by the US federal government?

A

Risk management framework RMF

76
Q

What is the NIST framework that aligns with RMF and has three components to improve prevention, detection, and response to cyber attacks?

A

NIST cyber security framework CSF

77
Q

In cyber security, what is a document or set of documents that provides a set of standards?

A

Reference architecture

78
Q

What is a formal evaluation of an organizations, policies, procedures, and operations and the world of cyber security these confirmed that the organization has put security controls in place that are adequate and effective and protecting critical assets? And what is the outcome of an audit called?

A

Audits…attestation

79
Q

What are less formal review of an organization cyber security defenses?

A

Assessments

80
Q

What is a type of assessment where the reviewer takes a standard and then compares the requirements in that standard to the organizations normal operation?

A

Gap analysis

MC 701 (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions