Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security +syo-501 > Attacks > Flashcards

Attacks Flashcards

1
Q

What is Social Engineering?

A

An attack against a user, and typically involves some form of social interaction

A training and awareness program is the best defense…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Phishing?

A

An attacker attempts to obtain sensitive information from users by masquerading as a trusted entity in an email or instant message sent to a large group of often random users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Spear Phishing?

A

A phishing attack aimed at a specific individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Whaling attack?

A

A phishing attack targeted against a high value target like a corporate officer or system admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Vishing attack?

A

A form of social engineering attack over voice lines (VoIP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Tailgating?

A

The act of following an authorized person through a doorway without using your own credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an Impersonation attack?

A

A social engineering technique that can occur in person, over a phone, or online, where the attacker assumes a role that is recognized by the person being attacked, and in assuming that role, the attacker uses the potential victim’s biases against their better judgment to follow procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Dumpster Diving?

A

The practice of searching through trash to discover material that has been thrown away that is sensitive, yet not destroyed or shredded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Shoulder Surfing?

A

Stealing of credentials by looking over someone’s shoulder while they type them into a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Watering Hole attack?

A

The infecting of a specific target website, one that users trust and go to on a regular basis, with malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a DoS attack?

A

Denial of Service (DoS)

An attack in which actions are taken to deprive authorized individuals from accessing a system, it’s resources, the data it stores or processes, or the network to which it is connected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a DDoS attack?

A

Distributed Denial of Service (DDoS)

A special type of DoS attack in which the attacker elicits the generally unwilling support of other systems to launch a many-against-one attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Man-in-the-middle attack?

A

Any attack that attempts to use a network node as the intermediary between two other nodes. Each of the endpoint nodes think it is talking directly to the other, but each is actually talking to the intermediary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Buffer Overflow?

A

A specific type of software coding error that enables user input to overflow the allocated storage area and corrupt a running program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is XSS?

A

Cross-site Scripting (XSS)

A method of attacking a system by sending script commands to the system input and relying upon the parsers and execution elements to perform the requested scripted actions, thus instantiating the attack exploiting the trust a user has for the site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Non-persistent XSS attack?

A

where the injected script is not persisted or stored, but rather is immediately executed and passed back via the web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Persistent XSS attack?

A

Where the script is permanently stored on the web server or some back-end storage allowing the script to be used against others who log in to the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is DOM-based XSS attack?

A

Where the script is executed in the browser via the Document Object Model (DOM) process as opposed to the web server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is CSRF or XSRF?

A

Cross-site Request Forgery (CSRF or XSRF)

A method of attacking a system by sending malicious input to the system and relying upon the parsers and execution elements to perform the requested actions, thus instantiating the attack. Exploits the trust a site has in the user’s browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Privilege Escalation?

A

The step in an attack where an attacker increases their privilege, preferably to administrator or root level

21
Q

What is ARP Poisoning?

A

Address Resolution Protocol (ARP) Poisoning

An attack that involves sending spoofed ARP or RARP replies to a victim in an attempt to alter the ARP table on the victim’s system. If successful, the attack will replace one or more MAC addresses in the victim’s ARP table with the MAC address the attacker supplies in their spoofed responses

22
Q

What is Amplification?

A

An act of leveraging technology to increase the volume of an attack, such as pinging a network address to get all attacked devices to respond

23
Q

What is DNS Poisoning?

A

Domain Name Service/Server (DNS) Poisoning

The changing of data in a DNS table to cause misaddressing of packets

24
Q

What is Domain Hijacking?

A

The act of changing the registration of a domain name without the permission of its original registrant

25
Q

What is a Man-in-the-Browser attack?

A

A man-in-the-middle attack involving browser helper objects and browsers to conduct the attack.

26
Q

What is A Zero Day attack?

A

A vulnerability for which there is no previous knowledge

27
Q

What is A Replay Attack?

A

The reusing of data during an attack to cause a system to respond based on previous acts

Best defense is use of encryption and short time frames…

28
Q

What is a Pass the Hash attack?

A

An attack where the credentials are passed in hashed form to convince an object that permission has been granted

29
Q

What is Clickjacking?

A

An attack against a user interface where the user clicks on something without knowing it, triggering a browser action unbeknownst to the user at the time

30
Q

What is Session Hijacking?

A

An attack against a communication session by injecting packets into the middle of the communication session

31
Q

What is Typo Squatting?

A

An attack form that involves capitalizing upon common typo errors at the URL level, hoping the browser user will not notice they end up on a different site

32
Q

What is Driver Manipulation?

A

The attack on a system by changing drivers, thus changing the behavior of the system

33
Q

What is Shimming?

A

The process of putting a layer of code between the driver and the OS to allow flexibility and portability

34
Q

What is Refactoring?

A

The process of restructuring existing computer code without changing its external behavior to improve nonfunctional attributes of the software, such as improving code readability and/or reducing complexity

35
Q

What is Spoofing?

A

Making data appear to have originated from another source so as to hide the true origin from the recipient

36
Q

What is MAC Spoofing?

A

The act of changing a MAC address to bypass security checks based on the MAC address

37
Q

What is IP address Spoofing?

A

Inserting a different IP address in the Form portion of the packet

38
Q

What is an Evil Twin?

A

An attack involving an attacker-owned router in a wireless system, configured to match a legitimate router

39
Q

What is Jamming?

A

A form of DoS that specifically targets the radio spectrum aspect of wireless

40
Q

What is WPS?

A

Wi-Fi Protected Setup (WPS)

A network security standard that allows easy setup of a wireless home network

41
Q

What is Bluejacking?

A

The sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, tablets, or laptop computers

42
Q

What is Bluesnarfing?

A

The unauthorized access of information from a Bluetooth-enabled device through a Bluetooth connecting, often between mobile phones, desktops, laptops, and tablets

43
Q

What is NFC?

A

Near Field Communication (NFC)

A set of wireless technologies that enables smartphones and other devices to establish radio communication over a short proximity, typically a distance of 10cm or less

44
Q

What is a Disassociation attack?

A

An attack on a wireless network whereby the attacker sends a deauthentication frame in a wireless connection, to break an existing connection

45
Q

What is a Birthday attack?

A

An attack methodology based on combinations rather than linear probability. In a room of 30 people, one doesn’t have to match a specific birthday, rather match any two birthdays in the room match, making the problem a combinatorial match, which is much more likely

46
Q

What is a Rainbow Table attack?

A

A precomputed set of hash tables for matching passwords by searching rather than computing each on the fly

47
Q

What is a salt?

A

A random set of characters designed to increase the length of the item being hashed, effectively making rainbow tables too big to compute

48
Q

What is a Dictionary attack?

A

A password-cracking program that uses a list of dictionary words to try to guess the password

49
Q

What is a Brute Force attack?

A

A password-cracking program that attempts all possible password combinations

Security +syo-501 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions