Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IT ALL Knowledge > CANES 2 > Flashcards

CANES 2 Flashcards

1
Q

Main references for CANES Core

A

CANES SW4 IETM – EE689-2X-IEM-004- AN/USQ-208C(V)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

C5ISR

A

Navy Command, Control, Communications, Computers, Combat Systems, Intelligence, Surveillance, and Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Navy Command, Control, Communications, Computers, Combat Systems, Intelligence, Surveillance, and Reconnaissance (C5ISR) consists of:

A

Navy Command, Control, Communications, Computers, Combat Systems, Intelligence, Surveillance, and Reconnaissance (C5ISR) consists of:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

2 CANES online resources

A

Naval Information Warfare Systems Command (NAVWAR) Acquisition Integrated Logistics Online Repository (SAILOR)
Navy Enterprise Service Desk (NESD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CDS provides

A

Cross Domain Solutions (CDS) provides client access to the UNCLAS, SR, and SECRET enclaves
CDS Transfer Guard provides the capability to disseminate data from systems accredited at the same or lower classification levels
Sanitizes and downgrades data for release to systems withdifferent classification levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Fault Isolation Strategy Six Step Process:

A
  • Recognize symptom(s)
  • Define symptom(s)
  • List probable faulty function
  • Localize the faulty function
  • Localize trouble to the faulty component
  • Analyze the failure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The hardware components used in CANES can be broken down into the following four functional areas:

A

Data Processing
Data Storage
Data Transfer
Power Distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Servers are installed in the CANES equipment racks and provide VMware vSAN storage for hoste apps and virtual machines.

A

The HP DL380 G10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

One of this is the Witness server and is installed in the SECRET enclave only. It enables MAC-1 failover/failback to occur automatically.
As such it is considered critical equipment and must always remain powered on.

A

HP DL20 G10 this unit is located in the VTC rack (Unit 51 or 52) depending on the installation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
A

Most likely not connected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The Line Console 0 (con 0) in the Cisco IOS represents the physical console port, and is configured via the Line Interface:

A

Access the Line Interface from Global Config Mode by typing: Line Con 0 followed by the Enter key
Changing the Line Interface configuration without required proper approvals in not authorized
To verify the configuration is unchanged from baseline settings
From Privileged EXEC mode type: show running-config | begin line
Compare the Line Con 0 configs to the ship’s network template

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Viewing Local Accounts
Cisco Switch and Router

A

From Privilege EXEC mode, type: show run | include username
Verify local accounts list and privilege level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cisco Default Privilege Levels

A

Level 0: log out, enable, disable, help, and exit commands
Level 1: Read-only access
Level 15: Full router or switch control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Cisco Local Account Creation

A

From Global Config mode, type: Username <new> privilege <privilege> password <new></new></privilege></new>

Local Account Deletion
From Global Config mode, type: no username <username></username>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Show Running Config | Section OSPF

A

command shows the OSPF section of the running configuration
Results can be used to compare baseline settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Show IP OSPF Neighbors

A

command shows the state of adjacency; OSPF requires full adjacency to function
Results show ip address ospf neighbors’ connecting interface – the CANES Border Firewall interface that connects to the Backbone router-switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Show IP OSPF Interface

A

command: shows OSPF information per interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Show IP OSPF Database

A

command: shows all router IDs in the OSPF area

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Show IP Route

A

command: shows directly connected, static, link local, and OSPF learned network routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Exchange Troubleshooting
The _____ Diagram is a helpful resource when errors occur

A

Exchange Troubleshooting
The Email and Calendar Service Troubleshooting Fault Isolation Diagram is a helpful resource when errors occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Exchange Toolbox is installed on

A

CANES EX01/02 and IAEXET

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

It is a Microsoft Management Console (MMC) snap-in that you can use to view information about and act on queues and messages in queues

A

Exchange Toolbox includes Queue Viewer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

System Admins can use Queue Viewer to perform the following actions

A

Remove messages
Suspend messages
Resume messages
Redirect messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Accessing Queue Viewer

A

Log in to IAEXET with System Administrator credentials
Navigate to Start > Microsoft Server Exchange 2016 > Exchange Toolbox and click on Queue Viewer
Click on Queue Viewer under Mailflow Tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Exchange Troubleshooting (cont.)
There are five areas of importance

A

Network
Hardware
Services
Configurations
Off ship Connectivity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Exchange Troubleshooting
Configuration Items to monitor from the Security Information and Event Management (SIEM) or the Systems Center Operations Management (SCOM) dashboard

A

Mail transport - Replication
Name resolution service
Encryption Service - Processes
Message Application Programming Interface (MAPI) and Mail submission
Active Directory Remote Procedure Call (RPC) Access
Directory Inquiry
Rights management
Alternate client access for Standard Mail Transfer Protocol (SMTP) Clients
Active directory Global catalogue
EdgeSync
Hub transport
Directory Queries
Lightweight Directory Access Protocol (LDAP) global catalogue queries
Registry access
Clustering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CANES is preconfigured to support the implementation of River City procedures in all enclaves
There are four OPSECON groups

A

OPSECON 1 - CO, XO, CMC, TAO
OPSECON 2 - OPS, EMO, CHENG
OPSECON 3 - All Officers, All Chiefs
OPSECON 4 - E-6 and Junior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Generating and Exporting ACAS Report to VRAM

A

From ACAS SecurityCenter, navigate to Scans > Active Scans and select desired scan to upload
Select Post Scan and then select the report configured to publish
Click Submit to save the scan, and then navigate to Reporting Report > Results to access report
Select report and click Download to save locally with a meaningful name
Select Submit button and a dialog box is displayed, indicating the upload has been sent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Server that bypasses wsav

A

ADNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Encryption for CANES

A

Symantec Endpoint Encryption Manager > Symantec Endpoint Encryption Software Setup > Removable Media Encryption is used to restore removable drive encryption to reimaged computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Disk encryption recovery with BitLocker:

A

BitLocker Recovery Key is found under Active Directory Users and Computers (ADUC) in the Trusted Platform Module (TPM)
Access the ADUC <FQDN> CANES Users and Computers > Computers
Select the computer and click on the BitLocker Recovery tab to find the BitLocker Recovery Key</FQDN>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

All Federal DoD information systems are required to use devices protected by the _____ and maintain encryption standard of _____ encryption Federal Information Processing Standards (FIPS)-140-2n

A

All Federal DoD information systems are required to use devices protected by the TPM and maintain encryption standard of AES 256-bit encryption Federal Information Processing Standards (FIPS)-140-2n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

SEE

A

Symantec Endpoint Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Is used for hard drive encryption

A

Bitlocker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Is used for removable media encryption

A

WinZip Secure Burn

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

DAR

A

Data at rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Three Bitlocker status

A

Protection Status 0 – Protection OFF
Protection Status 1 – Protection ON (Unlocked)
Protection Status 2 – Protection ON (Locked)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

is used to restore removable drive encryption to reimaged computers

A

Symantec Endpoint Encryption Manager > Symantec Endpoint Encryption Software Setup > Removable Media Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

NCVI

A

Navy Certificate Validation Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

CLO

A

Cryptographic Logon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

UNCLAS enclave CLO logon uses certificates on

A

the CAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

SECRET enclave CLO logon uses a

A

Secret Internet Protocol Router Network (SIPRNet) Token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

3 ways to login wsav CLI

A
  • Putty: port 22 SSH (wsav.<FQDN>)</FQDN>
  • vSphere: remote MRDS, vcsa select UNCLASS_WSAV
  • Remote MRDS: Cisco WSAV Management Console Shortcut
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

SCSM

A

Microsoft system Center Service Manager software that manages incidents and problems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

View the connectors that transfer data to SCSM

A

MRDS01 > Microsoft System Center > Service Manager Console > Administration > Connectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

SCOM

A

System Center Operations Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

SCOM uses _____ to monitor communication channels between an agent and its management server

A

If heartbeats stop, no data is transmitted to the management server
A heartbeat is a packet of data sent by an agent every 60 seconds
Three missed heartbeats generate an alert, prompting the management server to ping the computer
If the computer does not respond to the ping, an alert is generated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

MECM

A

Microsoft Endpoint Configuration Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Are groups of devices or users that can be created so they can be managed as a group

A

Collections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

MECM dashboards have several options to visually represent system data

A

Navigate to MECM > Monitoring > Overview > Client Status > Client > Activity Dashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

SIEM and SAM are the names of Virtual Machines (VMs).
What are the applications installed on those VMs?

A

Sentinel Server and Sentinel Agent Manager are the applications installed on those VMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

SIEM heartbeat checking

A

Checks heartbeat every five minutes
Analysis begins after 12 mins of no heartbeat
Unknown status after 18 days of no heartbeat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Sentinel is the security and system log collector and

A

analyzer application for CANES.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

for SW4 is the addition of two VMs

A

New in NetIQ SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Microsoft System Center > Operations Console.
If the Server name field is blank

A

type: EM01 and click Connect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Troubleshooting VoSIP/VoIP Phones – Basic and Factory Reset (cont.)
Prerequisites for Factory Reset and steps

A

For SCI enclave, the phone must be on a DHCP-enabled network
For SCI enclave, a valid TFTP server must be set in DHCP option 150 or option 66
The term62.default.loads file or the term42.default.loads and the files specified in that file should be available on the TFTP server that is specified by the DHCP packet
Unplug the power cable from the phone and then plug it back in
While the phone is powering up, and before the speaker button flashes on and off, press and hold #
Continue to hold # until each line button flashes (amber) on and off in sequence
Release # and press 123456789*0#
Once the factory reset is completed, perform the steps in the IETM for Manual Cisco SCI VoIP Phone Configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

VTC

A

Video Teleconference

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Force-Level ships support VTC on:

A

UNCLAS
SECRET
Sensitive Compartmented Information (SCI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

CANES VTC service includes the Cisco Precision High Definition (HD) camera that works with the

A

Cisco WEBEX CODEC in SW4 to provide full teleconferencing services to CANES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

VTC interfaces with Network Operations Center (NOC), Broadcast Control Authority (BCA), and

A

Force-level platforms to exchange audio and video

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

All SCI VTCs, except for the SCI VTC testing conducted by the Global Helpdesk, are scheduled through the

A

Joint Worldwide Intelligence Communications System (JWICS) VTC Scheduling system via http://vcwizard.dodiis.ic.gov
Download Rules of Engagement and VTC Scheduling guides
Open a web browser and navigate to: http://www.jwics.ic.gov
Download the VTC Scheduling Guide by clicking VTC Engineering > Documents tab > VTC Scheduling Guide
This document will assist with navigating the scheduling wizard to set up an SCI VTC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

VTC VLANs

A

UNCLAS: VLAN 183
SECRET: VLAN 283
SCI: VLAN 513 (Force-level ships only)
SCI: VLAN 520 (Force-level ships only)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

VTC Operations

A

Most teleconferences will use a gatekeeper, meaning participants will call into a central location to join the conference
It may be necessary to bypass the gatekeeper to do a point-to-point teleconference
Before any underway, the VTC should be tested to ensure that all equipment and the connectivity of the system is in good working order
Prior to any scheduled VTC, testing of the equipment should be done the day prior and at least 30 minutes before the call
River City conditions may have to be made to control how much bandwidth a platform uses during a VTC

64
Q

World Wide Web Publishing service

A

is required for web browsing

65
Q

Half of people by name have issues with exchange

A

check the databases are mounted in ex01 and ex02

65
Q

A new user doesn’t have access to USA User folders

A

User nationality might be wrong and the account has to be made again

66
Q

Where to edit river city?

A

MRDS01 > WSAV

67
Q

Web App doesn’t open

A

check the service WWW

68
Q

Server time is out of sync

A

restart “Windows Time” service. run command w32tm /resync

69
Q

Remote Procedure Call Error

A

Check network adapter from vSphere vcsa

Example in replication error check RODC

70
Q

Quickest trouble shoot procedure when server goes down

A

Restart from last snapshot in vShere vcsa

71
Q

Quickest trouble shoot procedure when server goes down

A

Restart from last snapshot in vShere vcsa

72
Q

Services to check in NSIPS server (4)

A

PeopleSoft D:Apps, PeopleSoft PIA, OracleServiceNEDB, Oracle…Listener

73
Q

User’s browser fix for NSIPS

A

Clear browsing cache

74
Q

If account does’t show at “create user” after NSIPS “NSIPS Self-Service (New Users)”

A

Let admin know

75
Q

IMS bandaid

A

Stop IMS message agent service
Stop process within IMS
Restart IMS message agent

76
Q

People cannot access their emails

A

Check mounted data base

Servers > data base > ellipsis

77
Q

View if anything is stuck in the outbox que

A

Check Queue Viewer in Exchange Toolbox

78
Q

For in-depth Exchange settings
Create Scripts

A

Active Directory Administrative Center

79
Q

2 River City components

A

WSAV and Exchange

80
Q

How to access WSAV

A

MRDS01 wsav.FDQN
Web security manager
Policy groups
Disable River City
by diabling all groups (1-4)
To set River City 1 disable policy river city 2, 3, 4

81
Q

When to look for SOPA watchwill

A

Tuesdays

82
Q

Explore ship’s browsing

A

WSAV
monitor/wsa_user_report

83
Q

How to set River City

A

MRDS01 wsav.FDQN
Web security manager
Policy groups
Disable River City
by diabling all groups (1-4)
To set River City 1 disable policy river city 2, 3, 4

84
Q

Starting ACS services

A

Page 28 in PDF ACS 3.4 System Admin (CANES folder) <admin> sysadmin
- Will have to get to indicated directory
-omit services</admin>

85
Q

Where to look for passwords

A

_CANES install

86
Q

Where to update cyber 12 o’clocks

A

vram.navy.mil per network
Cybersecurity Readiness
- Last date scan, total, current , valid, percent scanned, RA NRA VPH

87
Q

RA, NRA VPH

A

Remediation Available, No RA
Vulnerability per Host

88
Q

Command to reset Cisco switch once Putty’d

A

reload

88
Q

Break down RA/ NRA VPH (common remediation)

A

Detail View (windows updates/ sailor.com updates)

89
Q

Personal for

A

Print out take it to captain annotate it on special handling log

90
Q

Smell smoke

A

Cut power source
Report class and place to CSOOW
Test agent 45 second CO2 bottle
“The fire appears to be out”
Duty electrician determines when a Charlie fire is out
SIPR: COMMPLAN
Order of restoring: Enclosure 11 Overall restoral priority
Break down: Enclosure 12 Circuit Restoral Priority

91
Q

First action during flooding?

A

Try closing valve

92
Q

If abandoning space what to take with you?

A

Visitor’s log
Message log
Crypto inventory

93
Q

CO2 bottle specs

A

4-6 feet
45 seconds
test
ground

94
Q

Say fire is out:

A

“The fire appears to be out”

95
Q

Who can determine a class Charlie fire is out

A

Duty electrician

96
Q

Overall restoral priority found at

A

Enclosure 11, COMMS PLAN

97
Q

ACAS

A

Assured Compliance Assessment Solution

98
Q

ACAS functions (Tenable Security Center)

A

Discover what is in my network
Discover what vulnerabilities my systems have
Check if my systems are compatible with STIGs
Create reports on my assessments and vulnerabilities for CMRS

99
Q

Who supports program management and supports the deployment of this solution?

A

The Defense Information Systems Agency (DISA) is a combat support agency of the U.S. Department of Defense (DoD). It provides secure and reliable communications, IT solutions, and cybersecurity capabilities to enable command and control, information sharing, and decision-making for military forces and other government stakeholders. DISA plays a critical role in ensuring global connectivity and interoperability for the DoD.

100
Q

STIG

A

A Security Technical Implementation Guide or STIG is a configuration standard consisting of cybersecurity requirements for a specific product. The use of STIGs enables a methodology for securing protocols within networks, servers, computers, and logical designs to enhance overall security.

101
Q

Nessus Agent

A

Lightweight agent installed in the clients

102
Q

Tenable Security Center

A

Pushes updates, plugins, pulls results.

103
Q

How does ACAS discovers assets?

A

Trace Route
Port Scanner
Host TTL Discovered
Ping

104
Q

Types of vulnerability

A

Configuration
Implementation
Design

105
Q

Examples of configuration vulnerability

A

Poorly Configured Firewall Rules: Allow unnecessary or overly permissive traffic through a firewall, potentially enabling attackers to access sensitive services or systems.

Web Servers Displaying Directory Contents: When no index.html or equivalent file exists, the server may expose the directory listing, revealing file names and paths that could aid attackers in identifying exploitable files.

FTP Servers with Publicly Readable/Writeable Incoming Directories: Allow unauthorized users to upload and download files, which could lead to data leaks, malware distribution, or abuse of the server for malicious purposes.

106
Q

Examples of implementation vulnerability

A

Web Forms That Do Not Sanitize Data Before Passing It to a SQL Database: This can lead to SQL Injection attacks, where malicious input can manipulate database queries, potentially exposing or altering sensitive data.

Program That Allows for Buffer Overflows: A vulnerability where a program writes more data to a buffer than it can handle, potentially allowing attackers to overwrite memory, execute arbitrary code, or crash the system.

Websites That Allow XSS (Cross-Site Scripting) or CSRF (Cross-Site Request Forgery):

XSS: Exploits web pages to inject malicious scripts that run in a user’s browser, stealing cookies or sensitive data.
CSRF: Tricks a user into performing unwanted actions on a site where they are authenticated, potentially causing unauthorized changes or data exposure.

107
Q

Examples of design vulnerability

A

Telnet: A protocol for remote communication that transmits data, including credentials, in plain text. This lack of encryption makes it vulnerable to eavesdropping and credential theft.

FTP (File Transfer Protocol): Like Telnet, FTP transmits data, including usernames and passwords, in plain text, making it susceptible to interception by attackers.

Berkeley “r” Services (e.g., rsh, rlogin, rexec): These services rely on trust-based authentication (like hostname-based trust), which is weak and easily spoofed. They lack encryption, exposing communication to interception and abuse.

SSH v1 (Man-in-the-Middle Attack): The first version of SSH (Secure Shell) has flaws in its key exchange process, making it vulnerable to man-in-the-middle (MITM) attacks. An attacker can intercept and alter the communication between two parties without detection. SSH v2 addresses these vulnerabilities with improved encryption and authentication mechanisms.

108
Q

NASL

A

Nessus Attack Scripting Language

109
Q

PASL

A

Code used by the plugins NNM- Passive Analysis Script Language for Nessus Network Monitor or Passive Scanner

110
Q

What are the sources of security related data?

A

log files, HTTP traffic, login processes etc

111
Q

The difference between active scanning and passive scanning lies in their methods and impact on the target system or network:

A

Active Scanning:
Definition: Actively interacts with the target system by sending probes or requests to gather information.
Examples: Port scanning, vulnerability scanning, or sending queries to detect open ports or services.
Impact: Can be detected by intrusion detection systems (IDS) or security logs due to the direct interaction.
Use Case: Identifying specific vulnerabilities or open services on a system.

Passive Scanning:
Definition: Observes network traffic or system activity without directly interacting with the target.
Examples: Monitoring network traffic via packet sniffing or analyzing publicly available information.
Impact: Stealthy and less likely to be detected by security measures, as it does not generate noticeable traffic.
Use Case: Gathering intelligence without alerting the target, such as during reconnaissance.

112
Q

When performed on your own network, the difference between active and passive scanning is primarily about how each method interacts with your network systems and the type of information gathered:

A

Active Scanning:
How It Works: Actively probes devices on the network (e.g., via ping sweeps, port scans, or vulnerability scanners like Nessus).
Purpose: To identify open ports, services, misconfigurations, or vulnerabilities in real time.
Impact: Generates noticeable traffic on the network and may temporarily disrupt operations if scans are too aggressive.
Example Use Case: Testing for open ports, weak passwords, or outdated software.

Passive Scanning:
How It Works: Monitors and analyzes traffic passively without sending probes (e.g., using tools like Wireshark or network intrusion detection systems).
Purpose: To observe network activity, detect anomalies, and gather intelligence without affecting network performance.
Impact: Non-intrusive, with no risk of disrupting network operations.
Example Use Case: Monitoring for unauthorized devices or suspicious traffic patterns.

113
Q

Data at rest and Data in motion

A

Data at Rest: Data stored on devices (e.g., hard drives, databases) and not actively moving. Protected via encryption and access controls.

Data in Motion: Data being transmitted over a network. Secured with encryption (e.g., TLS) to prevent interception.

114
Q

Tenable Security Center communicates with _____ to send scanning instructions and receive results.

A

Associated Nessus Scanner

115
Q

The Nessus manager can manage up to _____ Nessus Agents

A

10,000

116
Q

What is a plugin in the context of Nessus?

A

In the context of Nessus, a plugin is a script or module that performs a specific check during a scan. Plugins are used to identify vulnerabilities, misconfigurations, or compliance issues. Each plugin is tailored to detect a particular condition, such as missing patches, outdated software, or weak configurations, using techniques like banner grabbing, file checks, or service analysis. Plugins are regularly updated by Tenable to include checks for newly discovered vulnerabilities.

117
Q

Tenable generally releases Security Center and NNM updates _____, and Nessus updates are closer to _____

A

Tenable generally releases Security Center and NNM updates quarterly, and Nessus updates are closer to monthly or bi-monthly

118
Q

DISA plugin servers and the Patch Repositories (NIPR and SIPR) are updated …

A

DISA plugin servers and the Patch Repositories (NIPR and SIPR) are updated daily. Contractually, plugins should be updated with IAVM data within 48 hours of the IAVM announcement. Note that not all Tenable products receive daily plugin updates from the COTS vendor, however sites should update plugins daily.

119
Q

Source: Web Browser
Destination: Security Center
Port

A

Port 443 (inbound)

120
Q

Source: Web Browser
Destination: Nessus Scanner / Manager
Port

A

Port 8834 (inbound)

121
Q

Source: Web Browser
Destination: NNM Scanner
Port

A

Port 8835 (inbound)

122
Q

Source: Security Center
Destination: NIPRNET / SIPRNET
Port

A

Port 443

123
Q

Source: Security Center
Destination: Nessus Scanner / Manager
Port

A

Port 8834

124
Q

Source: Security Center
Destination: NNM Scanner
Port

A

Port 8835

125
Q

Source: Security Center
Destination: Security Center (Repository Sync)
Port

A

Optional: Port 22

126
Q

Source: Nessus Agents
Destination: Nessus Manager
Port

A

Default: Port 8834
Recommended: 8934

127
Q

Source:
Nessus Cluster
Child Node
Destination:
Nessus Cluster
Parent Node

A

Default: Port 8834
Recommended: 8934

128
Q

Source: Nessus Scanner
Destination: Target
Port

A

No firewall or restrictions

129
Q

Difference between Nessus and Tenable

A

Nessus is a product developed by Tenable, Inc., which is the company behind its creation and ongoing development. Tenable provides various cybersecurity solutions, and Nessus is one of their key offerings focused on vulnerability scanning and assessment.

130
Q

NNM uses what language?

A

PASL

131
Q

CMRS

A

Continuous Monitoring and Risk Scoring

132
Q

tenable.sc

A

Tenable Security Center

133
Q

Plugins relate to an IAVA which is

A

IAVA stands for Information Assurance Vulnerability Alert. It is a notification issued by the U.S. Department of Defense (DoD) to address and mitigate security vulnerabilities that could pose a significant risk to DoD information systems.

134
Q

Tenable.sc, start scan or report button

A

“Launch”

135
Q

Tenable.sc last updates

A

“Feeds”

136
Q

Tenable.sc Zone

A

Group of IP address

137
Q

In the context of Tenable Security Center, a repository is a

A

In the context of Tenable Security Center, a repository is a data storage container that organizes and stores vulnerability and scan data.

138
Q

Manually and Automatically get plugins (Tenable)

A

Tenable updates plugins to both: DoD Patch Repository is manual, DISA Plugin server is automatically. Link for DoD Patch Repository link is available in the BPG

139
Q

What to use Tenable Security Center and Nessus in Linux?

A

ACAS Kickstart

140
Q

What to use Tenable Security Center and Nessus in Windows OS Virtual Machine?

A

In Linux virtual machines

141
Q

Building blocks for Tenable Security Center

A

Policies
Zones
Organization (roles)
Plugins (scripts)

142
Q

IP address you’re scanning need to be contained both in

A

repository and and definition of scan zone

143
Q

DISA has approved Tenable Security Center to run only on what OS?

A

RHEL

144
Q

Nessus Active Scan components

A

Credentials
Scan Schedule
Policy
Repository
Targets
Scan Zones (static IPs)

145
Q

What file to check to see a different parameter for a plugin is acceptable?

A

Scan Policy Settings Spreadsheet

146
Q

Scanning Freeze Window

A

Assets protected from scanning

147
Q

Default scan zone is

A

Common ports

148
Q

How to open downloaded scans (Nessus)

A

Wordpad

149
Q

Create Nessus Report (Tenable Report)

A

Reports > Reports Result > Check box > Download

150
Q

Where to acquire information about the Nessus Cyber Summary Report

A

BPG Appendix Q

151
Q

Nessus Cyber Summary Report and what is needed for TASKORD compliance scanning.

A

Auditors will need to see no less than 90 days’ worth of scan data or report results that demonstrate the organization is consistently performing TASKORD compliance scanning. It is recommended to store report results offline or in other systems to demonstrate historical TASKORD compliance. This report can be used to show proof of 7 days’ worth of results that demonstrate the organization is consistently performing TASKORD compliance scanning. The report should be run weekly, 3 months prior to a CORA (previously called a CCRI.)

152
Q

How do you share generated reports automatically? (NESSUS)

A

Distribution Tab

153
Q

Share report to person in another organization (NESSUS)

A

email addresses

154
Q

(NESSUS) What plugin is best to start with when issues with a scan?

A

19506

155
Q
A

IT ALL Knowledge (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions