CERTIFICATION CYBEROPS EXAM PRACTICE/REVISION Flashcards
Match the definition to the Microsoft Windows term. (Not all options are used.)
HANDLE – Provides access needed by the user space process.
REGISTRY – Database of hardware, software, users and settings.
THREAD – BLANK
WMI – Manages remote computers
CASE 2 Match the definition to the Microsoft Windows term. (Not all options are used.)
PROCESS – Currently executing program
REGISTRY – BLANK
SERVICE – Runs in the background to support the operating system and applications
THREAD – Instructions executed by the processor
What are two motivating factors for nation-state sponsored threat actors? (Choose two.)
Industrial espionage
AND
Disruption of trade or infrastructure
Explanation: Nation-state threat actors are not typically interested or motivated by financial gain. They are primarily involved in corporate espionage or disrupting international trade or critical infrastructure.
Match the description to the Linux term. (Not all options are used.)
FORK – Creates a copy of a process due to multi-tasking
HANDLE – BLANK
PERMISSIONS – Determines user rights to a file
PROCESS – A running instance of a computer program.
Match the antimalware approach to the description.
Recognises charactertistics of known malware files – signature-based
Recognises general features shared by types of malware – heuristics based
Recognises malware through types of suspicious actions – behaviour based
Which type of data is used by Cisco Cognitive Intelligence to find malicious activity that has bypassed security controls, or entered through unmonitored channels, and is operating inside an enterprise network?
Statistical
Explanation: Cisco Cognitive Intelligence utilizes statistical data for statistical analysis in order to find malicious activity that has bypassed security controls, or entered through unmonitored channels (including removable media), and is operating inside the network of an organization.
Which type of evasion technique splits malicious payloads into smaller packets in order to bypass security sensors that do not reassemble the payloads before scanning them?
Traffic fragmentation
Explanation: In order to keep the malicious payload from being recognized by security sensors, such as IPS or IDS, perpetrators fragment the data into smaller packets.These fragments can be passed by sensors that do not reassemble the data before scanning.
Which type of cyber attack is a form of MiTM in which the perpetrator copies IP packets off the network without modifying them?
Eavesdropping
Explanation: An eavesdropping attack is a form of man-in-the-middle in which the perpetrator just reads or copies IP packets off the network but does not alter them.
Which is an example of social engineering?
An unidentified person claiming to be a technician collecting user information from employees.
Explanation: A social engineer attempts to gain the confidence of an employee and convince that person to divulge confidential and sensitive information, such as usernames and passwords. DDoS attacks, pop-ups, and viruses are all examples of software based security threats, not social engineering.
Which component is a pillar of the zero trust security approach that focuses on the secure access of devices, such as servers, printers, and other endpoints, including devices attached to IoT?
Workplace.
Explanation: The workplace pillar focuses on secure access for any and all devices, including devices on the internet of things (IoT), which connect to enterprise networks, such as user endpoints, physical and virtual servers, printers, cameras, HVAC systems, kiosks, infusion pumps, industrial control systems, and more.
A security analyst is reviewing information contained in a Wireshark capture created during an attempted intrusion. The analyst wants to correlate the Wireshark information with the log files from two servers that may have been compromised. What type of information can be used to correlate the events found in these multiple data sets?
IP five-tuples.
Explanation: The source and destination IP address, ports, and protocol (the IP five-tuples) can be used to correlate different data sets when analyzing an intrusion.
A security analyst is investigating a cyber attack that began by compromising one file system through a vulnerability in a custom software application. The attack now appears to be affecting additional file systems under the control of another security authority. Which CVSS v3.0 base exploitability metric score is increased by this attack characteristic?
Scope.
Explanation: The scope metric is impacted by an exploited vulnerability that can affect resources beyond the authorized privileges of the vulnerable component or that are managed by a different security authority.
Which regular expression would match any string that contains 4 consecutive zeros?
0{4}
Explanation: The regular expression 0{4} matches any string that contains 4 repetitions of zero or 4 consecutive zeros.
Refer to the exhibit. https://snipboard.io/VOiGWc.jpg Which technology generated the event log? :
Netflow.
Explanation: The source of the output is Netflow.
Refer to the exhibit. https://snipboard.io/1W3ukp.jpg A security specialist is using Wireshark to review a PCAP file generated by tcpdump . When the client initiated a file download request, which source socket pair was used?
209.165.200.235:48598
Explanation: The combination of the source IP address and source port number, or the destination IP address and destination port number, is known as a socket. A socket is shown as the IP address and associated port number with a colon in between the two (IP_address:port_number).
Match the security service with the description.
Allows administrators to manage network devices – (Simple Network Management Protocol) SNMP
A series of commands that control whether a device forwards or drops packets – (Access-control list) ACL
Allows a switch to make duplicate copies of traffic that is sent to a traffic analyzer – PORT MONITORING
Provides statistics on packets flowing through CISCO router or multi-layer switch - NETFLOW
Using Tcpdump and Wireshark, a security analyst extracts a downloaded file from a pcap file. The analyst suspects that the file is a virus and wants to know the file type for further examination. Which Linux command can be used to determine the file type?
File
Explanation: The Linux file command can be used to determine a file type, such as whether it is executable, ASCII text, or zip.
Match the IPS alarm with the description.
Normal traffic is correctly not identified as a threat – TRUE NEGATIVE
Malicious Traffic is correctly identified as a threat – TRUE POSITIVE
Malicious Traffic is not correctly ideantified as a threat – FALSE NEGATIVE
Normal Traffic is incorectly identified as a threat – FALSE POSITIVE
What is a feature of an IPS?
It can stop malicious packets.
Explanation: An advantage of an intrusion prevention systems (IPS) is that it can identify and stop malicious packets. However, because an IPS is deployed inline, it can add latency to the network.
Which three fields are found in both the TCP and UDP headers? (Choose three.)
- Checksum
- Destination port
- Source port
Explanation: The UPD header has four fields. Three of these fields are in common with the TCP header. These three fields are the source port, destination port, and checksum.
What will match the regular expression ^83?
any string that begins with 83
What is a key difference between the data captured by NetFlow and data captured by Wireshark?
NetFlow collects metadata from a network flow whereas Wireshark captures full data packets.
NETFLOW - NETOWORK FLOW METADATA
WIRESHARK - FULL DATA PACKETS
Explanation: Wireshark captures the entire contents of a packet. NetFlow does not. Instead, NetFlow collects metadata, or data about the flow.
Which three IPv4 header fields have no equivalent in an IPv6 header? (Choose three.)
- Flag
- Identification
- Fragment offset
Explanation: Unlike IPv4, IPv6 routers do not perform fragmentation. Therefore, all three fields supporting fragmentation in the IPv4 header are removed and have no equivalent in the IPv6 header. These three fields are fragment offset, flag, and identification. IPv6 does support host packet fragmentation through the use of extension headers, which are not part of the IPv6 header.
What classification is used for an alert that correctly identifies that an exploit has occurred?
True positive
Explanation: A true positive occurs when an IDS and IPS signature is correctly fired and an alarm is generated when offending traffic is detected.
Match the NIST incident response life cycle phase with the description.
Identify, analyze, and validate incidents – DETECTION AND ANALYSIS
Conduct training on incident response – PREPARATION
Document how incidents are handled – POST INCIDENT ACTIVITIES
Implement procedures to eradicate the impact to organisational assets – CONTAINMENT, ERADICATION, AND RECOVERY
Place the seven steps defined in the Cyber Kill Chain in the correct order.
1) RECONNAISSANCE
2) WEAPONIZATION
3) DELIVERY
4) EXPLOITATION
5) INSTALLATION
6) COMMAND AND CONTROL
7) ACTION ON OBJECTIVES
During the detection and analysis phase of the NIST incident response process life cycle, which sign category is used to describe that an incident might occur in the future?
Precursor
Explanation: There are two categories for the signs of an incident:
Precursor – a sign that an incident might occur in the future.
Indicator – a sign that an incident might already have occurred or is currently occurring.
According to the Cyber Kill Chain model, after a weapon is delivered to a targeted system, what is the next step that a threat actor would take?
Exploitation
Explanation: The Cyber Kill Chain specifies seven steps (or phases) and sequences that a threat actor must complete to accomplish an attack:
Reconnaissance – The threat actor performs research, gathers intelligence, and selects targets. Weaponization – The threat actor uses the information from the reconnaissance phase to develop a weapon against specific targeted systems. Delivery – The weapon is transmitted to the target using a delivery vector. Exploitation – The threat actor uses the weapon delivered to break the vulnerability and gain control of the target. Installation – The threat actor establishes a back door into the system to allow for continued access to the target. Command and Control (CnC) – The threat actor establishes command and control (CnC) with the target system. Action on Objectives – The threat actor is able to take action on the target system, thus achieving the original objective.
A company is applying the NIST.SP800-61 r2 incident handling process to security events. What are two examples of incidents that are in the category of precursor? (Choose two.)
Log entries that show a response to a port scan
AND
A newly-discovered vulnerability in Apache web servers
Explanation: As an incident category, the precursor is a sign that an incident might occur in the future. Examples of precursors are log entries that show a response to a port scan or a newly-discovered vulnerability in web servers using Apache.
A network administrator is creating a network profile to generate a network baseline. What is included in the critical asset address space element?
The IP addresses or the logical location of essential systems or data.
Explanation: A network profile should include some important elements, such as the following:
Total throughput – the amount of data passing from a given source to a given destination in a given period of time
Session duratio n – the time between the establishment of a data flow and its termination
Ports used – a list of TCP or UDP processes that are available to accept data
Critical asset address space – the IP addresses or the logical location of essential systems or data
Which NIST-defined incident response stakeholder is responsible for coordinating incident response with other stakeholders and minimizing the damage of an incident?
Management
Explanation: The management team creates the policies, designs the budget, and is in charge of staffing all departments. Management is also responsible for coordinating the incident response with other stakeholders and minimizing the damage of an incident.
What is defined in the policy element of the NIST incident response plan?
How to handle incidents based on the mission and functions of an organization.
Explanation: The policy element of the NIST incident response plan details how incidents should be handled based on the mission and function of the organization.
What is the responsibility of the human resources department when handing a security incident as defined by NIST?
Perform disciplinary actions if an incident is caused by an employee.
Explanation: The human resources department may be called upon to perform disciplinary measures if an incident is caused by an employee.
What is the benefit of a defense-in-depth approach?
The effectiveness of other security measures is not impacted when a security mechanism fails.
Explanation: The benefit of the defense-in-depth approach is that network defenses are implemented in layers so that failure of any single security mechanism does not impact other secuirty measures.
Which type of analysis relies on predefined conditions and can analyze applications that only use well-known fixed ports?
Deterministic.
Explanation: Deterministic analysis uses predefined conditions to analyze applications that conform to specification standards, such as performing a port-based analysis.
Which type of analysis relies on different methods to establish the likelihood that a security event has happened or will happen?
Probabilistic
Explanation: Probabilistic methods use powerful tools to create a probabilistic answer as a result of analyzing applications.
Which access control model allows users to control access to data as an owner of that data?
Discretionary access control
Explanation: In the discretionary access control (DAC) model, users can control access to data as owners of the data.
