Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC+ > Chap 3 > Flashcards

Chap 3 Flashcards

1
Q

What is network reconnaissance and discovery?

A

Mapping out the attack surface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Topology discovery/ footprinting?

A

Scanning hosts, IP ranges, and routers between networks to map out the structure of the target network typically using command line tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What tools are used to test routing config and connectivity with remote hosts and networks?

A
  • Route
  • tracert (Windows)
  • traceroute (Linux)
  • pathping (windows) / mtr (Linux)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a SNMP?

A

Simple Network Management Protocol is a management protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Nmap Security Scanner?

A

One of the most popular open-source IP scanners ( shows open ports on a connection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is service discovery?

A

To discover what OS is running, which network services each host is running and potentially which app software is underpinning the services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Service discovery scan options?

A
  • TCP SYN (-sS)
  • UDP scans (-sU)
  • Port range (-p)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is TCP SYN (-sS)?

A

A service discovery option that is the fastest technique aka half-open scanning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is are UDP scans (-sU)?

A

scan UDP ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Port ranges?

A

Allows for NMAP to select a port range instead of the default 1000 commonly used ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is fingerprinting?

A

Detailed analysis of services on a particular host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is banner grabbing?

A

The process of scanning software to guess art the software name and version, without having any sort of privileged access to the host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What information can be gathered by using the -sV or -A command in NMAP?

A
  • Protocol
  • Application name and version
  • OS type and version
  • Device type
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is CPE

A

Common Platform Enumeration which is the standard syntax used to classify fingerprinting signatures in NMAP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is netstat?

A

Shows the local state of TCP/UDP ports on local machines .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Linux version of nslookup?

A

Dig

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the Harvester tool used for?

A

Tool for gathering open-source intelligence for a particular domain or company name.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the curl command?

A

command-line client for performing data transfers over many types of protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Nessus?

A

One of the best-known commercial vulnerability scanners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Packet analyzing?

A

deep-down frame-by-frame scrutiny of captured frames

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is protocol analyzing?

A

Using statistical tools to analyze a sequence of packets or packet trace.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What type of file is used for packet captures?

A

.pcap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Wireshark?

A

Open source graphical packet capture and analysis utility, with installer packages for most OS’s.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does Fellow TCP Stream do?

A

Reconstructs the packet contents for a TCP session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are some well known packet injection tools?

A
  • Dsniff
  • Ettercap
  • SCapy
  • hping
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is hping?

A

An open-source spoofing tool that provides a penetration tester with the ability to craft network packets to exploit vulnerable firewalls and IDSs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does TCPreplay do?

A

It takes previously captured traffic that has been saved to a .pcap file and replays it through a network interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a RAT?

A

Remote Access Trojan is malware that gives an adversary the means of remotely accessing the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How does an exploitation framework expolit?

A

By using the vulnerabilities identified by an automated scanner and launching scripts or software to attempt to deliver matching exploits.
Can also inject malicious code past an IDSs and AVs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the best-known exploit?

A

Metasploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Sn1per?

A

A framework designed for penetration test reporting and evidence gathering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Name other exploitation frameworks besides Sn1per and Metasploit?

A
  • fireELF
  • RouterSploit
  • Browser Exploitation Framework (BeEF)
  • Zed Attack Proxy (ZAP)
  • Pacu
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is Netcat?

A

tool to test for connectivity and can be used for port scanning and fingerprinting.

34
Q

What is software exploitation?

A

An attack that targets a vulnerability in software code

35
Q

What firmware does IOT and network appliances use?

A

OS code

36
Q

What is a Zero-Day?

A

A vulnerability that is exploited before the developer knows about it or can release a patch

37
Q

What is a legacy platform?

A

A platform that is no longer supported with security patches by its developer or vendor.

38
Q

Default settings is an example of what?

A

A weak configuration

39
Q

How can an adversary gain control of a root account?

A

guessing a weak password or using some local boot attack to change the set password.

40
Q

What is open permissions?

A

Provisioning data files or apps without differentiating access rights for user groups.

41
Q

Running unnecessary services or using weak encryption can do what?

A

Cause vulnerabilities

42
Q

What are some ways to harden services for a given role?

A
  • Restrict endpoints that are allowed to access the service by IP address or address range.
  • Disable services that are installed by default and not needed.
  • block access to ports at border firewalls or segment the network to keep external access at a minimum.
43
Q

What is an unsecure protocol?

A

The transfer data is sent in plaintext (no encryption) which means there is no secure way to authenticate the endpoints.

44
Q

Data Breach vs Data exfiltration

A

Data Breach: an event where confidential data is read or transferred without authorization and can be a result of an exfiltration.

Data Exfiltration: the methods and tools by which an attacker transfers data without authorization.

45
Q

Data exfiltration’s are always intentional and malicious, unlike data breaches. T/F?

A

True

46
Q

What is data loss?

A

When information becomes unavailable either permanently or temporarily.

47
Q

What is vendor management?

A

Process of selecting supplier companies and evaluating the risks inherent in relying on a third-party product or service.

48
Q

What is system integration?

A

Process of using components/services from multiple vendors to implement a business workflow.

49
Q

T/F
A contracting company may a list of preferred vendors and ask 3rd parties to build and support the solution.

A

True

50
Q

What are the two risk to data when using 3rd parties?

A
  • They will have access to the data
  • They may service to host data or data backups and archives.
51
Q

What are the main types of security assessment classed as?

A
  • Vulnerability Assessment
  • Threat Hunting
  • Penetration Testing
52
Q

What is a vulnerability assessment?

A

An evaluation of a system’s security and ability to meet compliance requirements based on the configuration state of the system. (Current config matches the baseline)

53
Q

What is a vulnerability scanner?

A

Test network hosts, including client PCs, mobile devices, servers, routers, and switches.

54
Q

What results come from vulnerability scans?

A

missing patches, deviations from baseline, and configuration templates.

55
Q

Each identified vulnerability is categorized and assigned an impact warning. T/F

A

True

56
Q

What are the best known application scanners?

A

web application scanners

57
Q

What does Nikto look for?

A

SQL injection and cross-site scripting (XSS)

58
Q

What is a vulnerability feed?

A

Up to date information from an automated scanner.

59
Q

How do Nessus and OpenVAS describe vulnerability feeds?

A

plug-ins and network vulnerability tests (NVT’s)

60
Q

What is SCAP?

A

Security Content Application Protocol obtains feed or plug-in updates for vulnerability scanners.

61
Q

Describe CVE.

A

Common Vulnerabilities and Exposures is a dictionary of vulnerabilities in published OSs’ and app software.

62
Q

What identifiers make up a CVE?

A
  • An identifier
  • A brief description of the vulnerability
  • A reference list of URLs
  • The date the vulnerability entry was created.
63
Q

Describe the CVSS

A

The Common Vulnerability Scoring System uses NIST’s National Vulnerability Database (NVD) data to develop a vulnerability score from 0-10 rating Low(.1+), Medium(4.0+), High(7.0+), and Critical(9.0+).

64
Q

What is scan intrusiveness?

A

How much the scanner interacts with the target.

65
Q

What is a Non-intrusive (or passive) scan?

A

Analyzing indirect evidence, such as the traffic generated by a device. Has the least impact but is less likely to ID vulnerabilities comprehensively.

66
Q

Describe active scanning

A

Probing the device’s configuration using some sort of network connection with the target. Consuming more bandwidth and has the ability to crash the target or cause an outage.

67
Q

Explain a non-credentialed scan

A

A scan that proceeds by directing test packets at a host w/o being able to log on to the OS or app and typically the most appropriate technique for external assessment of a network parameter.

68
Q

Explain a credentialed scan

A

Much more in-depth analysis, especially for misconfigurations and more intrusive than non-credentialed.

69
Q

What does RED denote in a vulnerability scan?

A

weakness that requires immediate attention.

70
Q

What is a false positive?

A

Something that is identified by a scanner or other assessment tool as being a vulnerability when it is not.

71
Q

What is a false negative?

A

Potential vulnerabilities that are not identified by a scan.

72
Q

What type of scan is required for a configuration review?

A

A credentialed scan.

73
Q

What components are used by a SCAP to determine if a computer meets configuration baseline?

A
  • Open Vulnerability Assessment Language (OVAL)
  • Extensible Configuration Checklist Description Format (XCCDF)
74
Q

Describe OVAL.

A

Open Vulnerability and Assessment Language is an XML schema for describing system security and querying vulnerability reports and info.

75
Q
A
76
Q

Describe XCCDF.

A

Extensible Configuration Checklist Description Format is an XML schema for developing and auditing best-practice configuration checklists and rules.

77
Q

What is threat hunting?

A

An assessment technique that utilizes insights gained from threat intelligence to proactively discover where there is evidence of TTPs already present w/in a system.

78
Q

What might be the trigger for establishing a threat hunt?

A

Security bulletins and advisories from vendors, and security researchers about new TTPs and/or vulnerabilities.

79
Q

What is Intelligence fusion?

A

A process to correlate threat data via an SIEM tool and threat analytics to threat hunt.

80
Q

What is Maneuver in threat hunting?

A

A military doctrine to obtain positional advantage in a live threat situation.

81
Q

Describe a penetration test/pen test/ethical hacking.

A

The use of authorized hacking techniques to discover exploitable weaknesses in the target’s security systems.

SEC+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions