Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > Chap 8 - Security operations > Flashcards

Chap 8 - Security operations Flashcards

1
Q

what are the common classification of an event

A
  • precursor = signal that something will take place
  • indicator = signal that something is taking place
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are the main issues log management addresses

A
  • compliance and standards
  • policies throughout the system and info lifecycle
  • infrastructure
  • generation, collection and normalization
  • protection from creation to disposal (archiv/defens destruct
  • review, analytics and reporting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is an IDS

A

solution that monitors the environment and automatically recognizes malicious attempts to gain unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is an IPS

A

solution that monitors environment and automatically takes action when it recognizes malicious attempts to gain unauthorized access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IDS/IPS deployment

A

can be deployed as perimeter placement (DMZ) or host-based or network-based and be located at various physical and logical locations in the IT environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

how can IDS/IPS detect malicious activities

A
  • deviation
  • signatures
  • pattern matching
  • heuristic (machine learning algorithm)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are the main tradeoff associated with IDS/IPS

A
  • maintenance
  • overhead
  • false positive
  • agility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what are types of SIEM deployments

A
  • self-hosted, self-managed
  • cloud SIEM, self-managed
  • hybrid self hosted
  • SIEM as a Service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what are the main functions of a SIEM

A
  • aggregation = gather info across environment
  • normalization = present data in meaningful ways
  • correlation = probability that stream of log is of an attack
  • secure storage = follow rule of evidence
  • analysis = automatic analysis
  • reporting
  • real-time monitoring = threat detection across network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ingress monitoring

A

inbound communication traffic

tools:
- firewall
- gateway
- remote authentication servers
- IDS/IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Egress monitoring

A

outbound communication traffic

tools:
- DLP (through signature, pattern, labeling)

DLP can cover data at rest, in motion and in use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are the main effort as part of data protection

A
  • data discovery / classification / categorization
  • monitoring
  • enforcement (training, attribution, prevention)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what do we use regression testing for?

A

confirms that the systems’ behavior has been altered only in ways that the approved change should have caused and that no other anomalous behavior as resulted from changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is the Information Technology Infrastructure Library (ITIL)

A

widely adopted information technology change practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the ITIL process level based on urgency

A
  • standard changes
  • emergency changes
  • normal changes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what are the 2 important processes that come together via well-implemented change mgmt practices

A
  • baselining
  • provisioning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

change initiation steps include

A
  • identifying of change requirements
  • risk assessment
  • change prioritization
  • documentation of the RFC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Change review & approval steps include

A
  • evaluating the RFCs for completeness
  • assignment to the proper change authorization process
  • stakeholder review
  • appropriate approvals or rejections
  • documentation of approval or rejection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

implementation and evaluation steps include

A
  • scheduling the change
  • testing the change
  • verifying the rollback procedures
  • implementing the change
  • evaluating the change for proper operation
  • documenting the change in the production
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what are the practice of patching system challenges

A
  • interoperability
  • poorly craft patches
  • required downtime
  • virtualization-specific concerns
  • timing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what are the best practices in patching system

A
  • notice of patch
  • determine applicability/evaluation
  • determine potential impacts
  • testing the patch

after approval ->
- perform a full backup prior to application
- apply the patch
- confirm installation of the patch for all target systems

verify operationality post-patch->
- solicit/receive user feedback
- document
or
- rollback if required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what are the main 4 change management activities

A
  1. change management
  2. vulnerability management
  3. patch management
  4. configuration management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

when does an event becomes an incident?

A

when there is a possibility of harm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what are common business practices to handle incident

A
  • incident detection
  • assessment
  • escalation
  • communication
  • recovery
  • learning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

what is the NIST computer security incident handling lifecycle

A
  1. preparation
  2. detection and analysis
  3. containment, eradication and recovery
  4. post-incident activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what are the 4 phases of cyber forensics

A
  • collection (of medias -> data)
  • examination (of the data -> to find information)
  • analysis (of the information -> to find evidence/artifacts)
  • reporting (of the evidence/artifacts)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what are incident response team communication to key stakeholders

A
  • customers (media)
  • other response teams
  • internet service providers
  • incident reporters
  • law enforcement agencies
  • software and support vendors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is the primary role of Security Operation Center (SOC)

A

ENABLE the organization’s senior leadership and management to make INFORMED DECISIONS about emergency or urgent actions to take to PROTECT THE ORGANIZATION from loss or impact

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

what are some types of event that might be a step of attack kill chain

A
  • input buffer overflows
  • endpoint/ removable media infections
  • filenames containing unusual/ unprintable characters
  • access control system notice
  • unplanned restart
  • unmanaged host or endpoint try to join network
  • notice of unplanned configuration changes
  • multiple login failed attempts
  • email system alert of increase in bounced/refuse/junk mail
  • unusual deviation in network traffic flows
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what are the main approach to root cause analysis

A
  • Pareto analysis = 80% value -> 20% effort
  • 5 whys
  • Fishbone diagram = visualization tool focusing on causes
  • failure mode effects analysis = systematic identify failure
  • Fault tree = applies to boolean logic
31
Q

what are the main type on attack containment tactics

A
  • logical or physical disconnection
  • disconnect key server
  • disconnect your internal network
  • disabling wifi
  • disabling outgoing and incoming connection to unknown
  • disabling outgoing and incoming connection to all external
  • disconnect from any extranets or VPNs
  • disconnect all external access to system
  • disable internal users, process or application
32
Q

what is eradication process

A

process of identifying and then removing every instance of the causal agent and its associated files, executables and so forth from all elements of your system

33
Q

what is recovery process

A

process by which the organization’s IT infrastructure, applications, data and workflows are reestablished and declared operational

34
Q

what is the remediation process

A

activities to immediately limit or reduce the chance of reoccurrence of this type of attack

35
Q

what is a SOAR

A
  • security orchestration
  • security automation
  • security response
36
Q

what is an allowed listing

A

permits only previously approved items to be executed and blocks execution of all others

37
Q

what is block listing

A

explicitly prohibits application on the block list

38
Q

what is a honeypot or honeynets

A

are machines that exist on the network but do not contain sensitive or valuable data (number of machines connected form a honey net)

they are not to be considered a mean to lure or attract the attention of malicious actors

39
Q

is hackback legal

A

in almost all jurisdictions hackback is illegal, often with several penalties (US and UK it is a felony)

40
Q

main steps that can be improved in organization to respond to ransomware

A
  • back up data regularly
  • separate backups from computer and the network backing
  • physically isolate sensitive processes
  • implement cross-domain solutions
  • patch mgmt and legal software
  • awareness training
  • anti-malware tools
  • IDS/IPS
  • incident response readiness
  • network segmentation for quarantine
  • table top exercise
  • define decision making process
  • others including EDR / XDR / etc.
41
Q

what is software defined security (SDS)

A

next generation of SOAR -> holistic approach

evolution from start
1. IAM
2. device label sec
3. Network IDS/IPS
4. SIEM
5. SOAR
6. SDS

42
Q

types of security services provided by 3rd party

A
  • threat hunting
  • network monitoring
  • physical security
  • network mgmt
  • audit
43
Q

what are the main due diligence steps when contracting 3rd party

A
  • review governance
  • SLAs
  • NDAs
  • insurance/bonding
  • audit/testing
  • strong contract language
  • regulator approval
44
Q

what is the minimum protection in backup storage strategy

A
  • 3 copies of the data (original + 2x backups)
  • 2x different storage media type (magnetic/removable/cloud)
  • one copy offsite
45
Q

what are type of locations for backups

A
  • onsite
  • offsite
  • Cloud backup as a service
46
Q

what are types of backup

A
  1. Full backup
  2. differential backup: all change since last full backup
  3. incremental backup: new/change files since last full backup
  4. journaling: granular recovery of DB, rec. all transaction log
  5. Snapshot: virtualized storage that mirror data blocks
  6. Continuous data protection (CPD): form of snapshotting every time data block change
47
Q

2 key consideration when backing up

A

Versioning: ability to conserve several versions of backups to eliminate the risk of losing all recovery capability (if one affected…)

Validation: each backup should be validated to ensure the copy is thorough and accurate

48
Q

what are common recovery site strategies

A
  • Mirrored: identical to original -> High availability & reliable
  • Hot: similar to mirror but no latest data -> few hours deploy
  • warm: no current version, no full equip. -> few days deploy
  • cold: empty facility -> no HW/software ->few weeks/month
  • mobile: portable facility -> HW only -> few days deploy
  • Cloud: backup in CSP -> check SLAs for guarranty
  • Joint operating agreement (JOA): usually gov. shared location
  • multiple processing site: each site 50% capacity (active-active
49
Q

what is the difference between active-active & active-passive

A

active-active: all sites operate normally, but at low capacity (e.g., 50%) if needed ability to transfer 100% on single site

active-passive: at least 1x site of cluster is not working on normal operations -> only brought online if disruption of the “Active system”

50
Q

what are the key system resilience considreations

A
  • sufficient spare components
  • clustering of sites (e.g., active-active)
  • power
  • Uninterruptible power supplies (UPS)
  • generators
51
Q

what are the different types of Redundant Array of Independent Disk (RAID)

A
  • RAID 0: no actual redundancy -> data striped
  • RAID 1: mirroring
  • RAID 2: legacy approach (not used)
  • RAID 3 & 4: data striped across multi-drives & 1x drive parity
  • RAID 5: Data & parity striped across multi-drives
  • RAID 6: data strip & 2x set parity across mutli-drives
  • RAID 0+1: data striped & mirror -> used by Cloud -> see SLA
  • RAID 1+0 (10): data striped and duplicated simultaneously
  • ## RAID 15 & 51: use of 1 and 5 -> high cost an impact on prod.
52
Q

why apply physical security

A

protect from
- damage
- loss
- theft

53
Q

what is Crime prevention through environmental design (CPTED)

A
  • landscape to enforce sec. (no straight road, fence, river)
  • areas isolation
  • lightning system for movement detection
  • guards
  • doors/ windows with solid core
  • locks
  • etc.
54
Q

what are type of protection to wired closets (server)

A
  • secured room
  • access to room monitored
  • tamper protection
  • environmental protection
  • protection from lightning
  • backup power
  • HVAC system
  • fire detection
  • emergency shutoff
55
Q

Heating, Ventilation and Air Conditioning (HVAC) security & safety protections

A
  • redundancy
  • detection of failure (sensors)
  • HVAC control
  • adequate cooling & airflow
56
Q

what are the main environmental issues to consider

A
  • hurricane
  • tornado
  • forest/wildfire
  • earthquake
  • tsunami
  • flooding
  • mudslides
57
Q

what is the fire triangle

A
  • fuel
  • O2
  • heat
58
Q

what are the fires classes

A

EU -> US -> description -> counter

A -> A -> ordinary combustible -> water
B -> B -> flammable liquids -> Foam
E -> C -> Electrical -> CO2
D -> D -> flammable metals -> dry powder
F -> K -> commercial cooking equ -> chemicals

59
Q

what are common types of water-based suppression systems

A
  • wet-pipe
  • dry pipe
  • pre-action
  • deluge
  • aqueous firefighting foam (AFFF)
60
Q

what are common Gas-based suppression system

A
  • hydrofluorocarbon
  • halon
  • FM-200
  • carbon dioxide (CO2)
  • Argonite
  • inergen
61
Q

what are personal/security concerns when traveling

A
  • secure remote access
  • jurisdictional concerns
  • personnel protection
  • condition monitoring
62
Q

what is duress

A

personnel should have a means to report to the organization if they are ever put under duress (threaten)

63
Q

Darcy is designing a fault tolerant system and wants to implement RAID-5 for her system. What is the minimum number of physical hard disks she can use to build this system?

A

Three

RAID level 5, disk striping with parity, requires a minimum of three physical hard disks to operate.

64
Q

Which one of the following is an example of physical infrastructure hardening?
A. Antivirus software
B. Hardware-based network firewall
C. Two-factor authentication
D. Fire suppression system

A

D. Fire suppression system

Antivirus software, hardware firewalls, and two-factor authentication are all examples of logical controls.

65
Q

You are also concerned about the availability of data stored on each office’s server. You would like to add technology that would enable continued access to files located on the server even if a hard drive in a server fails. What integrity control allows you to add robustness without adding additional servers?

A

RAID

Redundant Array of Inexpensive Disks (RAID) uses additional hard drives to protect the server against the failure of a single device.

66
Q

What does labelling data allow a DLP system to do?

A

The DLP system can detect labels and apply appropriate protections.

Data loss prevention (DLP) systems can use labels on data to determine the appropriate controls to apply to the data.

67
Q

What type of fire suppression system fills with water when the initial stages of a fire are detected and then requires a sprinkler head heat activation before dispensing water?

A

Preaction

A preaction fire suppression system activates in two steps.

The pipes fill with water once the early signs of a fire are detected. The system does not dispense water until heat sensors on the sprinkler heads trigger the second phase.

68
Q

Warren is designing a physical intrusion detection system for his data center and wants to include technology that issues an alert if the communications lines for the alarm system are unexpectedly cut. What technology would meet this requirement?

A

Heartbeat sensor

Heartbeat sensors send periodic status messages from the alarm system to the monitoring center.

69
Q

Which one of the following fire suppression systems uses a suppressant that is no longer manufactured due to environmental concerns?

A

Halon

Halon fire suppression systems use a chlorofluorocarbon (CFC) suppressant material that was banned in the Montreal Protocol because it depletes the ozone layer

70
Q

Which one of the following humidity values is within the acceptable range for a data center operation?

A

Data center humidity should be maintained between 40% and 60%.

Values below this range increase the risk of static electricity, while values above this range may generate moisture that damages equipment.

71
Q

What protocol is used to handle vulnerability management data?

A

The Security Content Automation Protocol (SCAP) is a community sourced specification for security flaw and security configuration information and is defined in NIST

72
Q

Danielle wants to compare vulnerabilities she has discovered in her data center based on how exploitable they are, if exploit code exists, as well as how hard they are to remediate. What scoring system should she use to compare vulnerability metrics like these?

A

CVSS

The Common Vulnerability Scoring System (CVSS)

includes metrics and calculation tools for exploitability, impact, how mature exploit code is, and how vulnerabilities can be remediated, as well as a means to score vulnerabilities against users’ unique requirements.

73
Q

When a Windows system is rebooted, what type of log is generated?

A

Information

Rebooting a Windows machine results in an information log entry.

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions