CEH

Question 1

What is IT Risk?

Answer 1

Threat x Vuln x Impact = Risk, Threat x Vuln x Asset = Risk, is the probability that something negative might happen.

Question 2

What are the five phases of hacking?

Answer 2

Reconnaissance which is the collecting information and learning about our target, examples are job posting survey, passive recon, and do some DNS queries. The scanning phases are the active part of the recon, check for open ports, vulnerability scan, and check service versions. Next phase is gaining access for example RCE attacks, password and injection attacks, session hijacking, etc. Next phase is maintaining access and live into the system, command and control systems. The last phase is to cover your tracks which is try not to be identified, check for log files,

Question 3

What are the types of IoC?

Answer 3

Atomic, compute, and behavioral types.

Question 4

What are some categories of IoC?

Answer 4

Behavioral, Email, Network, and Host bases.

Question 5

What is a DMZ and what it is used for?

Answer 5

A Demilitarized Zone is basically an area in your network that is facing outside from your internal network. The idea is to add a layer of security between your critical systems and servers that are more probable of being targeted, for example, a web server.

Question 6

What are some attack classifications?

Answer 6

Passive and active, close-in, insiders, and distributed attacks.

Question 7

What are the phases of Cyber Kill Chain?

Answer 7

Reconnaissance, weaponization, delivery, exploitation, installation, command and control (c2), and access control.

Question 8

Information warfare types…

Answer 8

It uses information and communication technology to gain a competitive advantage over your adversary. C2 or C&C, intelligence-based (knowledge is power), electronic-based (signal jamming), psychological, hacker, economic, cyber-warfare.

Question 9

What is Confidentiality

Answer 9

Is the effort of an organization to make sure data is kept private or secret. Breaches of confidentiality can be accidental or intentional/unintentional, however, to mitigate breaches, we can use access controls and encryption.

Question 10

What is integrity?

Answer 10

Is the effort to make sure the data has not been tampered with by making sure it is reliable, authentic and accurate. To promote integrity we can use hashing and digital signature.

Question 11

What is availability

Answer 11

Is the effort to make sure the data that needs to be consumed by authorized personnel, is accessible. We need to set some protections to prevent denial of services attacks, and natural disasters by promoting disaster recovery plans, backups, redundant systems, and other security controls.

Question 12

What is authenticity

Answer 12

Is the quality, in terms of the data, of being legitimate or real.

Question 13

What is non-repudiation?

Answer 13

Is the assurance provided by the system to make sure the sender and receiver of data, cannot later deny having processed the data. We can use digital signatures to make sure the sender of an email, for example, cannot deny sending the email afterwards.

Question 14

What are the attacker’s motivation into hacking?

Answer 14

Curiosity, hackivism, revenge, bragging rights, cyber crime, terrorism, disruption of business, religious, and political.

Question 15

Explain the tactics, techniques, and procedures.

Answer 15

tactics are guiding principles, techniques is how you do it, procedures is more granularity from a higher level to a lower level. A tactic is the overall goal of the objective at hand. The techniques are the list of attacks that are going to be used to complete the tactics or the objectives. The procedure are the tools and programs used to proceed with the techniques.

Question 16

What are some common adversarial behaviors?

Answer 16

Internal recon, Powershell for data exfiltration, CLI/terminal tools such as cmd and bash, using HTTP user agent, web shell use,

Question 17

What is a DoS and a DDoS

Answer 17

A denial of service is an attack in which you flood a system or service into exhausting available resources, thus preventing other trusted consumers of those services, to get the service they need. A denial of service can be distributed by using a collection of bots or zombie systems into attacking a service at the same time.

Question 18

What is the risk level formula?

Answer 18

Impact x Probability = Risk Level, they are measured as Low, Medium, and High. Low is that a threat exists, however it is unlikely to occur and the impact is negligible. Medium threats are likely but not imminent, High is risk that needs to be addressed immediately.

Question 19

What are risk management and their phases?

Answer 19

Is the idea and process in managing in our organization keeping risk at an acceptable levels. We have the 1st phase: Identify the risks, assess the risks identified using likelihood and impact, then treat, mitigate, and control the risk down into a manageable levels.

Question 20

Cyber threat intelligence, what it means and their CTI types?

Answer 20

High levels such as Strategic, and Operational, and low-level such as Tactical, and Technical. CTI is any information that we can gather that helps an organization to identify, assess, monitor, and respond to cyber threats. Examples of CTI are indicators, events, TTP, and findings from the analysis of incidents.

Question 21

What are the threat modeling process?

Answer 21

Identify security objectives, and identify what needs to be secured, the second phase is the application overview which identifies roles, and usage scenarios (why), step three is decomposing the application, which is like the were, making a diagram of the ins and outs, how is data flowing in the systems. Step 4 is identifying the threats. Step 5 would be placing the vulnerabilities. Common models for threat modeling are STRIDE, PASTA, and DREAD threat modeling.