CEHv8 BOOTCAMP: MODULE 01-INTRODUCTION TO ETHICAL HACKING_SET-3

Question 1

What does Defense in Depth help prevent?

Answer 1

Direct attacks against an information system and data because a break in 1 layer only leads an attacker to the next layer.

Question 2

What is Incident Management?

Answer 2

A set of defined processes to identify, analyze, prioritize, and resolve security incidents to restore normal service operations as quickly as possible and prevent future reoccurrence of the incident.

Question 3

What are 7 purposes of the incident management process?

Answer 3

• Improves service quality
• Pro-active problem
• Reduces impact of incidents on business/organization
• Meets service availability requirements
• Increases staff efficiency and productivity
• Improves user/customer satisfaction
• Assists in handling future incidents

Question 4

What is Security Policy?

Answer 4

A document or set of documents that describes the security controls that will be implemented in the company at a high level.

Question 5

What are 8 goals of Security Policies?

Answer 5

• Maintain an outline for the management and administration of network security
• Protection of organization’s computing resources
• Elimination of legal liability from employees or third parties
• Ensures customers’ integrity and prevent waste of company computing resources
• Prevent unauthorized modifications of the data
• Reduce risks caused by illegal use of the system resource, loss of sensitive, confidential data, and potential property
• Differentiate the user’s access rights
• Protect confidential, proprietary information from theft, misuse, unauthorized

Question 6

What are 5 Classifications of Security Policies?

Answer 6

• User Policy
• IT Policy
• General Policies
• Partner Policy
• Issue Specific Policies

Question 7

What is a User Policy?

Answer 7

A policy that defines who can use the network and the limits on what the user to secure the network.

Question 8

What is a IT Policy?

Answer 8

A policy that is designed for the IT department to keep the network secure and stable.

Question 9

What is a General Policy?

Answer 9

A policy that defines the responsibility for general business purposes.

Question 10

What is a Partner Policy?

Answer 10

A policy that is defined among a group of partners.

Question 11

What is a Issue Specific Policy?

Answer 11

A policy that recognizes specific areas of concern and describe the organization’s status for top level management.

Question 12

What are the 4 Types of Security Policies?

Answer 12

• Promiscuous Policy
• Permissive Policy
• Prudent Policy
• Paranoid Policy

Question 13

What is a Promiscuous Policy?

Answer 13

Policy with no restrictions on Internet or remote access.

Question 14

What is a Permissive Policy?

Answer 14

Policy that begins wide open and only known dangerous services/attacks are blocked.

Question 15

What is a Prudent Policy?

Answer 15

Policy that begins by blocking all services and only safe/necessary services are enabled individually; everything is logged.

Question 16

What is a Paranoid Policy?

Answer 16

Policy that forbids everything.

Question 17

What are the 8 steps to create and implement Security Policies?

Answer 17

• Perform risk assessment to identify risks to the organizations assets
• Learn the standard guidelines and other organizations
• Include senior management and all other staff in policy development
• Set clear penalties and enforce them and also review and update of the security policy
• Make final version available to all of the staff in the organization
• Ensure every member of your staff read, sign, and understand the policy
• Install the tools you need to enforce policies
• Train your employees and educate them about the policy

Question 18

What is Penetration testing?

Answer 18

A method of evaluating the security of an information system or network by simulating an attack to find out vulnerabilities that an attacker could exploit.

Question 19

What is Black box testing?

Answer 19

Simulates an attack from someone who has no prior knowledge of the system.

Question 20

What is White box testing?

Answer 20

Simulates an attack from someone who has complete prior knowledge of the system.

Question 21

How are Vulnerabilities classified?

Answer 21

Severity Level (low, medium, or high), and Exploit Range (local or remote).

Question 22

What is Vulnerability Research?

Answer 22

The process of discovering vulnerabilities and design flaws that will open an operating system and its applications to attack or misuse.

Question 23

Who is a Hacker?

Answer 23

Someone who accesses a computer system by evading its security system

Question 24

Who is an Ethical Hacker?

Answer 24

Someone that helps an organization to better understand their security system and identify risks, highlight the remedial actions, and also reduce costs by resolving vulnerabilities using the same methods used by Hackers and still complying with the law.

Question 25

What does Ethical Hacking involve?

Answer 25

The use of hacking tools, tricks, and techniques to identify vulnerabilities so as to ensure system security.