Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH > Chapter 1 - Essential Knowledge > Flashcards

Chapter 1 - Essential Knowledge Flashcards

1
Q

Network Security Zones - Internet

A

Uncontrollable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Network Security Zone - Internet DMZ

A

Controleld buffer network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Network Security Zone - Production Network Zone

A

Very restricted; controls direct access from uncontrolled zones; has no users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Network Security Zone - Intranet Zone

A

Controlled; has little to no heavy restrictions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Network Security Zone - Management Network Zone

A

Might find VLAN and IPSEC; highly secured; strict policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CVSS

A

Common Vulnerability Scoring System - Places numerical score based on severity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

National Vulnerability Database (NVD)

A

US government repository of vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 2 access control types?

A

Mandatory (MAC) - access is set by an administrator. Discretionary (DAC) - allows users to give access to resources that they own and control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Hack Value

A

perceived value or worth of a target as seen by the attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Zero-day Attack

A

attack that occurs before a vendor knows or is able to patch a flaw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Doxing

A

searching for and publishing information about an individual usually with a malicious intent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Enterprise Information Security Architecture (EISA)

A

process that determines how systems work within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Incident Management

A

Deals with specific incidents to mitigate the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the risk management phases?

A

Risk Identification, Risk Assessment, Risk Treatment, Risk Tracking, Risk Review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Annualized Loss Expectancy

A

ARO x SLE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Security Control Types: Physical, Technical, Administrative

A

Physical: Guards, lights, cameras. Technical: Encryption, Smart Cards, Access Control Lists. Administrative: Training awareness, policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Types of Security Controls: Preventative, Detective, Corrective

A

Preventative: Authentication, alarm bells. Detective: Audits, Backups. Corrective: Restore Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

User Behavior Analytics

A

(UBA) - Tracking users and extrapolating data in light of malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CIA Triad

A

Confidentiality: Passwords, encryption. Integrity: Hashing, digital signatures. Availability: Anti-dos solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Bit Flipping

A

Integrity attack. In Bit flipping, the attacker isn’t interested in learning the entirety of the plain-text message. Instead, bits are manipulated in the cipher text itself to generate a predictable outcome in the plain text once it is decrypted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

MAC Address spoofing is an example of what kind of CIA attack?

A

Authentication

22
Q

Evaluation Assurance Level (EAL)

A

The Evaluation Assurance Level (EAL1 through EAL7) of an IT product or system is a numerical grade assigned following the completion of a Common Criteria security evaluation

23
Q

Common Criteria for IT Security Evaluation

A

Testing standard designed to reduce or remove vulnerabilities from a product before its released.

24
Q

Target of Evaluation (Common Criteria)

A

What is being tested

25
Q

Security Target (ST) ( common criteria)

A

The documentation describing the TOE and security requirements

26
Q

Protection Profile (PP) (Common Criteria)

A

A set of security requirements specifically for the type of product being tested.

27
Q

Security Policy Categories: Promiscuous, Permissive, Prudent, Paranoid

A

Promiscuous: Wide Open. Permissive: Blocks only known dangerous things. Prudent: Blocks most and only allows things for business purpose. Paranoid: Locks everything down

28
Q

Standards vs. Baselines vs. Guidelines

A

Standards: Mandatory rules to achieve consistency. Baselines: Provide minimum security necessary. Guidelines: Flexible or recommended actions

29
Q

Script Kiddie

A

Uneducated in security methods, but uses tools that are freely available to perform malicious ativities

30
Q

Phreaker

A

Manipulates telephone systems

31
Q

White vs Black vs Gray Hat

A

White Hat: Ethical Hackers. Black Hat: Hackers that seek to perform malicioius activities. Gray Hat: Hackers that perform good or bad activities but do not have the permission of the organization they are hacking against

32
Q

Suicide Hacker

A

Do not care about any impunity to themselves, hack to get the job done

33
Q

Hacktivist

A

Someone who hacks for a cause.

34
Q

Operating System Attack

A

Attacks targeting OS flaws or security issues inside such as guest accounts or default passwords

35
Q

Application Level Attack

A

Attacks on programming code and software logic

36
Q

Shrink-Wrap Code attack

A

Attack takes advantage of built-in code or scripts

37
Q

Misconfiguration Attack

A

Attack takes advantage of systems that are misconfigured due to improper configuration of default configuration.

38
Q

What are the phases of ethical hacking?

A

Reconaissance, Scanning and Enumeration, Gaining Access (escalate privilege) , Maintaining Access, Covering Tracks

39
Q

Ethical Hacker vs. Cracker

A

Ethical Hacker - Employs tools that hackers use with a customer’s perimission; often obtains agreement from client before testing done. Cracker - Uses tools for personal gaihn or destructive purposes.

40
Q

What are the Pen Test phases?

A

Preparation: Contracts, team, scope of pen test determined. Assessment: All hacking phases (recon, scanning, attacks, etc.). Post-Assessment: Reports & Conclusions

41
Q

White Box vs. Black Box vs. Gray Box

A

Black Box Testing: Ethical hacker has NO knowledge of TOE. White-Box: Pen tester has full knowledge of network, systems, infrastructure they’re targeting. Gray-Box: Partial knowledge testing, some knowledge of system/or network.

42
Q

ISO 27001

A

Security standard based on the British BS7799 standard, focuses on security governance

43
Q

NIST-800-53

A

SOmeone who hacks for a cause.

44
Q

ISO 27002 AND 17799

A

Based on BS799 but focuses on security objectives and provides security controls based on industry best practice

45
Q

FISMA

A

“Federal Information Security Modernization Ac Of 2002” A law updated in 2004 to codify the authority of the Department of Homeland Security with regard to implementation of information security policies

46
Q

FITARA

A

“Federal Information Technology Acquisition Reform Act” A 2013 bill that was intended to change the framework that determines how the US GOV purchases technology

47
Q

HIPAA

A

“Health Insurance Portability and Accountability Act” a law that set’s privacy standards to protect patient medical records and health information shared between doctors, hospitals and insurance providers

48
Q

PCI-DSS

A

“Payment Card Industry Data Security Standard” Standard for organizations handling Credit Cards, ATM cards and other POS cards

49
Q

COBIT

A

“Control Object for Information and Related Technology” IT Governance framework and toolset, created by ISACA and ITGI

50
Q

SOX

A

“Sarbanes-Oxley Act” Law that requires publicly traded companies to submit to independent audits and to properly disclose financial information

51
Q

GLBA

A

“U.S Gramm-Leach-Bliley Act” Law that protects the confidentiality and integrity of personal information that is collected by financial institutions.

52
Q

OSSTM Compliance

A

“Open Source Security Testing Methodology Manual” maintained by ISECOM , defines three types of compliance: Legislative - Deals with government regulations (Such as SOX and HIPAA. Contractual - Deals with industry / group requirement (Such as PCI DSS). Standards based - Deals with practices that must be followed by members of a given group/organization (Such as ITIL ,ISO and OSSTMM itself)

CEH (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions