Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEHv10 > CEHv10 > Flashcards

CEHv10 Flashcards

1
Q

What is preventative control?

A

Controls in place to prevent something from occurring. A smart card could be preventative meassure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Corrective control

A

An attempt to correct an issue. Like antivirus attempting to remove malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Registration Authority

A

The registration authority (RA) is the entity responsible for receiving certificate request, identifying the subject and requesting the CA to issue a certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is the OCSP?

A

Online Certificate Status Protocol. Obtains revocation status of X.509 certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the Verification Authority (VA) do?

A

Validates the identity of a subject when a certificate is used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does a CA Certificate Authority do?

A

Issues certificates based on requests from the RA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does SOAP do?

A

Simple Object Access Protocol. Is platform independent, simplifies communication and leverages multiple transport protocols.

Not faster then CORBA because it utilizes XML which takes longer then binary.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is CORBA?

A

Common Object Request Broker Architect. A standard defined by the object management group (OMG). Designed to facilitate the communication of systems that are deployed on diverse platforms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is IPChains

A

A firewall on older linux kernels up to verion 2.2x

Has the ability to filter packet fragments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is IPTables

A

A linux firewall that replaced IPChains from Linux kernel version 2.4x and above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is ipfwadm?

A

An older linux firewall replaced by IPChains.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 types of the Web Application Architecture

A
  1. Client or presentation layer - The frontend of the application.
  2. Business logic layer - Controls how the application works.
  3. Database Layer - Handles and stores data required by the application.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is een alternate data stream

A

Hiding data in existing files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

True statements regarding whitfiled diffie and martin hellman.

A
  1. The algo named after them performs encryption

2. They invented Public Key Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the NMAP TCP Connect scan?

A

Peforms a full tcp connection or completes the full tcp handshake. It is very easy to detect on the hosts being scanned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what can a network vulnerability scanner not do?

A

Scan through a firewall.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the 8 steps of a CEH scanning methodology

A
  1. check for live systems
  2. check for open ports
  3. check beyond the IDS
  4. Grab banners
  5. Scan for vulnerabilities
  6. Draw network diagrams
  7. prepare proxies
  8. Pen test the network for scanning vulnerabilities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe an N-Tier architecture

A

Each server performs a single and unique role in the group. Web-server, database server and application server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe service-oriented architecture (SOA)

A

The components provide a service to other components via a communication protocol.

20
Q

What is seperation of duties

A

A security concepts that prescribes breaking operatino int parts and assign the parts to individuals to prevent fraud.

21
Q

What is Dual control

A

I requeres 2 individuals to be present to perform a sensitive operation. Like missile launch.

22
Q

What is OWASP

A

Testing methodologies to address security controls

23
Q

What is OWASP top 10 proactive controls?

A
  1. verify security early and often
  2. parameterize queries
  3. encode data.
  4. validate inputs.
  5. implement identity and authentication controls
  6. implement appropriate access controls
  7. protect data
  8. implement logging and intrusion detection
  9. leverage security frameworks and libraries
  10. implement error and exception handling
24
Q

What is NIST

A

National Institute of Standards and Technology. valt onder de amerikaanse overheid en zet zich in voor standaardisatie in de wetenschap.

25
Q

what are the dom objects for a javascript XSS defacment attack?

A

getElemenetByID()

getElementsByTagName()

26
Q

Wat zijn de 7 lagen van het OSI model?

A
  1. Toepassing - DATA
  2. Presentatie - DATA
  3. Sessie - DATA
  4. Transport - Segmenten
  5. Netwerk - Paketten
  6. Datalink - Frames
  7. Fysiek - Bits
27
Q

TCP Session Hijack

A

Transport Layer attack. Layer 4 OSI

28
Q

MAC Spoofing

A

Data layer attack. Layer 2 OSI

29
Q

ICMP flooding

A

Network layer attack. Layer 3 OSI

30
Q

Telnet DoS attack

A

Session layer attack. Layer 5 OSI

31
Q

What is PCI DSS Standard

A

Payment Card Industry - Data Security Standard

32
Q

What are the steps of an incident management process

A
  1. prepare for incident handling and response
  2. detect and analyze
  3. classify and prioritize
  4. notify
  5. contain
  6. investigate
  7. eradicate and recover
  8. perform post-incident activities
33
Q

what are the core components of Metasploit

A
  1. libraries
  2. modules
  3. interfaces
34
Q

CSIRT

A

Computer Security Incident Response Team. Provides incident response services to users and organization, government agency in partnership with homeland security.

35
Q

NIST

A

National Institute of Standards and Technology. a non-regulatory agency of the united states department of commerce.

36
Q

What is a bastion host?

A

A gateway between an inside and an outside network located on the public side of the dmz and is designed to protect against attacks aimed at the inside network.

37
Q

Name 3 anonymizers

A

proxify
psiphon
tor

38
Q

Name the ISO Standards and what they do

A

27000 outlines how to best secure a large organization

27001 describes how to perform a risk assessment

27002 describes how to apply security controls after performing the risk assessment described in ISO 27001

27005 describes how to best manage security risks using an organized and systematic approach

27006 describes audits and certifications for security management systems.

39
Q

What is the purpose of a Mole tool?

A

To automate sql injection attacks

40
Q

What is Cain and Able

A

A password recovery tool for windows

41
Q

What is DataThief

A

A program to reverse engineer data points from a graph

42
Q

What is Netcat

A

A tool to read and write data across the network using tcp or udp protocols. Netcat is commonly embedded in Trojan Payloads.

43
Q

Which statements are true of ARP?

A
  1. maps 48 bit addresses to 32 bit addresses

2. prone to man in the middle attacks.

44
Q

Name the Security Laws and Standards

A

PCI-DSS - Payment Card Industry Data Security Standard

ISO 27001

HIPAA - Health Insurrance Portability and Accountability Act

SOX - Sarbane-Oxley Act 2002 _ Financial institutes like ABN Amro of Wallstreet

DMCA - Digital Millenium Copyright Act

FISMA - Federal Information Security Management Act

45
Q

What are the 9 Security Policy Creation Steps

A
  1. Risk Assesment
  2. Use security standards and Frameworks as guide
  3. Get management and staff input
  4. enforce the policy. Use penalties for non-compliance
  5. Publish final draft
  6. Have all staff read/sign that they understood the policy
  7. employ tools to help enforce policy
  8. staff training
  9. review and update regularly
46
Q

What is the Vulnerability Life Cycle

A

Baseline - Vulnerability assesment - Risk assessment - Remediate - Verify - Monitor - Baseline

CEHv10 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions