Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SY0-601 > Chapter 1 Missed Questions > Flashcards

Chapter 1 Missed Questions Flashcards

1
Q

Which protocol is a common Command-and-Control mechanism for botnets?

A

IRC Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where do file-less viruses store themselves in order to maintain persistence?

A

Windows Registry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What security technology best assists with automation of security workflows?

  • IPS
  • SIEM
  • SOAR
  • CASB
A

SOAR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What type of approach to threat identification begins with a listing of all resources owned by the organization?

A

An Asset Focused approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of artificial intelligence technique is most commonly associated with optimization?

A

Prescriptive analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What CVSS value is the threshold at which PCI DSS requires remediation to achieve a passing scan?

A

4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This is a layer 2 attack where the attacker sends messages to corrupt the ARP table and causes packets to be misrouted. (This is done to set up a MitM attack)

A

ARP Poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This attack floods the table with addresses, making the switch unable to find the correct address for a packet

A

MAC Flooding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This is a layer 3 attack where the attacker sends a large number of connection requests to open network services

A

SYN Flooding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This is a layer 3 attack where the attacker attempts to manipulate the source or destination IP address of network traffic

A

IP Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an IV (Initialization Vector) used for in a wireless communication protocol?

A

The IV is used in wireless systems as the randomization element at the beginning of a connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is considered the most secure current encryption protocol used in securing HTTPS sessions?

A

TLS 1.3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the condensed penetration process?

A

Planning, Discovery, Attack, Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the dark web?

A

The dark web uses obfuscation methods to restrict access, requires TOR, and uses onion routing (.onion instead of .com, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the deep web?

A

Websites that are not indexed by traditional search engines and require additional methods of access or authentication are considered to be part of the ‘deep web’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What type of attack method did Morris finger worm, Code Red, and Slammer use to compromise systems?

A

Buffer Overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an SQL injection?

A

Code injection attacks that can be used to bypass login forms by tricking a web application into evaluating a statement that is always true. ‘password is correct OR 1=1’ can be used to login without credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What can be used to stop SQL injections?

A

Input Filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Sentiment Analysis?

A

A technique used to identify and track patterns in human emotions, opinions, or attitudes that may be present in data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Difference between Phishing, Vishing, Smishing, Spim, and Spam?

A 
Phishing - Scam E-Mails
Vishing - Scam Phone Calls
Smishing - Scam Text Messages (SMS)
Spim - Spam Instant Messaging
Spam - Unsolicited communication sent in bulk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is an Evil Twin?

A

A wireless access point that looks and acts like a legitimate access point, but with a stronger signal to trick users into connecting to it

22
Q

What is a Rogue Access Point?

A

An unauthorized access point connected to an organizations network, but does not try to impersonate a legitimate AP

23
Q

What is a worm?

A

A self-propagating program that attempts to penetrate networks and computer systems through vulnerable network services. It installs itself and attempts to spread to additional systems. (They don’t need to attach to pieces of software or files to spread)

24
Q

What is a virus?

A

A virus is a program that attaches to a piece of software, code or file

25
Q

What is a bot?

A

Functioning piece of software that performs some task or tasks under the control of another program

26
Q

What is a botnet?

A

A series of bots controlled across the network in a group

27
Q

What is the packet sequence for a TCP 3-way handshake?

A

SYN –> SYN/ACK –> ACK

28
Q

What happens during a TCP 3-way handshake?

A

The sender system sends a SYN packet to the target system it wants to communicate with. The target system responds with a SYN/ACK packet if it is able to accept the request. When the sender system receives the SYN/ACK packet, it responds back with an ACK packet and the communication can proceed.

29
Q

What is the difference of shimming vs refactoring in driver manipulation?

A

Shimming is the process of putting a layer of code between the driver and the OS to change behavior without modifying original code. Refactoring is the process of restructuring existing computer code to add functions to an existing driver.

30
Q

What are some common application protocols along with descriptions, ports, and are they secure?

A

FTP - Ports 20/21 - File Transfer Protocol (Unsecure)
SSH - Port 22 - Secure Shell (Secure)
Telnet - Port 23 - (Unsecure)
SMTP - Port 25/587 - Simple Mail Transfer Protocol (Secure)
DNS - Port 53 - Domain Name Services (Secure)
HTTP - Port 80 - Hyper Text Transfer Protocol (Unsecure)
HTTPS - Port 443 (Hyper Text Transfer Protocol Secure) (Secure)

31
Q

What is intelligence fusion?

A

Process involving the collecting and analyzing of threat feeds from both internal and external sources on a large scale

32
Q

What are XSS (Cross Site Scripting) attacks?

A

Adding scripts to the input and rending the script as part of the webs process

33
Q

What is the difference between persistent, non-persistent and DOM-based XSS (Cross Site Scripting) attack?

A

Persistent XSS attacks permanently store the injected scripts on the web server or back-end storage, allowing script to be used against others who log into the system. Non-persistent XSS attacks are not stored and immediately executed. DOM-based XSS attacks are executed in the browser via the Document Object Model (DOM) process instead of the web server

34
Q

What is a DLL injection?

A

A Dynamic Link Library injection adds functionality to a program, at runtime, that has a specific function vulnerability that can be capitalized by the attacker

35
Q

What is an LDAP injection?

A

A Lightweight Directory Access Protocol constructs user input to validate requests. A LDAP injection adds code to an input to to execute code on the systems directory.

36
Q

What is XML injection?

A

A Extensible Markup Language (XML) injection is an attack on XML systems to alter configurations, change data streams or change outputs.

37
Q

What is the difference between XSS attacks and SQL injections?

A

SQL injections are server-side vulnerabilities that attack the applications database whereas XSS attacks are client-side vulnerabilities that target other users using the application

38
Q

What are the differences between DLL, LDAP and XML injections?

A

The difference is where and how the code is being executed and written. DLL, LDAP and XML are all different types of data that can be used on a website. LDAP code can’t be injected into a XML data stream.

39
Q

What is SSL stripping?

A

Secure Socket Layer stripping is a MitM attack against all SSL and TLS 1.0 & 1.1 connections that intercepts the initial connection request for HTTPS, redirects it to an HTTP site and captures all information sent to the website.

40
Q

What can TLS 1.3 connections prevent (compared to earlier versions)?

A

SSL stripping, Man-in-the-Middle attack

41
Q

Explain the DNS record types?

A

The MX DNS record identifies the mail server for a domain. The A DNS record identifies domain names associated with with IP’s. The CNAMES DNS record is used to create aliases. The SOA (Start of Authority) DNS records contain information about the authoritative servers for a DNS zone.

42
Q

What is an ASLR?

A

An Address Space Layout Randomization is a security technique that randomizes the locations of objects in memory causing buffer overflow attacks to be less likely to succeed

43
Q

What is SOAR?

A

Security Orchestration, Automation, and Response. SOAR platforms are designed to react to security information and perform workflows across various systems.

44
Q

What are rainbow tables and how are they used in attacks?

A

Rainbow tables are pre-computed hash values for common passwords. Attackers can use these values to search password files that aren’t salted.

45
Q

How do you find collisions in a hash function?

A

Birthday attack

46
Q

What is URL spoofing and what are other names for it?

A

Hyperlink spoofing and web spoofing. It is a type of attack where a user is redirected to a fake website that appears as a valid session. Takes advantage of hyperlinks instead of DNS addresses.

47
Q

What is a land attack?

A

An attack where a spoofed TCP SYN packet with the targets IP address and an open port in both the source and destination headers. This makes the machine continuously reply to itself causing a system crash or freeze.

48
Q

What are other names for XSRF? What is XSRF?

A

Another name for XSRF, cross-site request forgery, is session riding, CSRF, sea surf, and hostile linking. XSRF is an application issue that involves unauthorized commands coming from a trusted user , to a trusted user or website.

49
Q

What are war driving attacks?

A

A method of discovering 802.11 wireless networks by driving around with a laptop and looking for open wireless networks.

50
Q

What is an armored virus?

A

A virus including protected code that prevents examination of critical elements, such as anti-virus.

SY0-601 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions