Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CYSA+ > Chapter 13 Cybersecurity Toolkit > Flashcards

Chapter 13 Cybersecurity Toolkit Flashcards

1
Q
  • Set of security mitigation capabilities bundled together to help prevent malware from exploiting vulnerabilities and other attacks
  • Includes: Data execution prevention (DEP) and Address space layout randomization (ASLR)
A

Enhanced Mitigation Experience Toolkit (EMET)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Feature to prevent the execution of malware loaded into data space in memory

A

Data execution prevention (DEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Helps prevent buffer overflows attacks and others that rely on specific acknowledge of memory locations

A

Address Space Layout Randomization (ASLR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Name the tools in the Windows Sysinternals Suite

A
  • AccessEnum
  • AutoRuns
  • Process Explorer
  • PsTools
  • SDelete
  • ShareEnum
  • Sysmon
  • ProcDump
  • TCPView
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Enumerates the access on a system
  • Provides a good view of who has permissions to files, directories, and other objects
  • Part of Windows Sysinternals Suite
A

AccessEnum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • A utility that shows what programs start at login or system boot
  • Part of Windows Sysinternals Suite
A

AutoRuns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  • Tool that shows the files, DLLs, registry keys and other objects in use by each process
  • Part of Windows Sysinternals Suite
A

Process Explorer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Set of command line utilities with a broad range of functions, including process information and start/stop capabilities, event log dumping, password changes, and many others
  • Part of Windows Sysinternals Suite
A

PsTools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  • Secure file deletion utility

- Part of Windows Sysinternals Suite

A

SDelete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Tool that analyzes shares and their permissions

- Part of Windows Sysinternals Suite

A

ShareEnum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • Often used for intrusion detection and forensic analysis for its ability to monitor processes and their activity in a searchable and easily viewable manner
  • Part of Windows Sysinternals Suite
A

Sysmon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Provides process dumping for memory and error analysis

- Part of Windows Sysinternals Suite

A

ProcDump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Tool for stock at level visibility for analyzing network connected services
  • Part of Windows Sysinternals Suite
A

TCPView

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Standard for logging and is designed to allow logs to be created for an endpoint server, system, or device, and then be stored locally or sent to essential server or storage system

A

Syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SIEM tool designed to provide large-scale data collection and analysis capabilities for broad range of data types

A

Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Provides SIEM functionality as well as asset discovery, vulnerability scanning and assessment, behavior (heuristic) analysis capabilities, and IDS capabilities

A

AlienVault’s Universal Security Manager (USM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An open source SIEM that integrates a number of Open Source tools to provide security information and event capabilities

A

AlienVault offers OSSIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A network graphing tool that runs on top of RRDtool (a data logging and graphing system) to allow recurring, time-based data collection and analysis

A

Cacti

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A network monitoring tool that leverages SNMP to monitor traffic on network connections

A

Multi Router Traffic Grapher (MRTG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Well-known and widely respected network vulnerability scanning product

A

Tenable Nessus

21
Q

A vulnerability scanner that uses Software-as-a-Service (SaaS) management console to run scans using appliances located both in on premise datacenters and in the cloud

A

Qualys’s QualysGuard

22
Q

Another commercial vulnerability scanner that offers similar capabilities to Nessus and QualysGuard

A

Rapid7’s Nexpose

23
Q

An open source vulnerability scanner

A

open source OpenVAS

24
Q
  • Test for web specific vulnerabilities, such as SQL injections, cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities
  • i.e. Nikto
A

Web application scanners

25
Q

Tools designed to help with acquisition of passwords

A
  • fgdump
  • pwdump
  • SAMdump2
26
Q

Open source tool designed to crack passwords and hashes, including Linux, Windows, Kerberos and other frequently use password hashing methods

A

John the Ripper

27
Q

Open source password cracking tool that relies on rainbow tables to quickly look up hashes to return their original value

A

Ophcrack

28
Q
  • Perform similar actions to their Network counterparts, seeking to identify and block potentially malicious network traffic
  • Not used a lot in production
A

Host intrusion prevention systems (HIPS)

29
Q
  • Build a table of hash values for all files resident on a protected computer system and then monitors files for unexpected changes in those hash values
  • ie Tripwire
  • Mandated by PCI DSS
A

File Integrity Monitoring software

30
Q
  • Has replaced nslookup for Mac OS and Linux

- Provides a little more detail than nslookup

A

Dig

31
Q
  • Acts as a middleman between end-user systems and web servers
  • All web requests are sent to the server rather than direct connection between web server and end user clients
A

Proxy servers

32
Q

What are the benefits of using a proxy server over direct connections?

A
  1. Proxy servers provide an opportunity to perform content filtering
  2. Proxy servers may perform caching of frequently requested content - improve response time for users and decreases bandwidth consumption
33
Q

The majority of servers implementing TLS and SSL do so by using what open source library?

A

OpenSSL

34
Q
  • Provide content and protocol-aware firewall and technical protections for web applications
  • Can be used to provide protection against zero-day attacks that are not patched but have known attack profiles by building custom rules that address the exploit
A

Web application firewall

35
Q

Name a couple of interception proxies

A

Burp Suite proxy

Zed attack proxy (ZAP)

36
Q

Name some popular Fuzzer tools

A
  • Peach fuzzer
  • Untidy fuzzer
  • Microsoft security development lifecycle (SDL) includes: MiniFuzz file fuzzer and the SDL Regex Fuzzer
37
Q

The three major forensic image formats or what?

A
  1. RAW
  2. AFF
  3. E01
38
Q
  • Forensic image format

- Bit by bit copies of the original format. Metadata is sometimes acquired along with this image and stored separately

A

RAW

39
Q
  • Forensic image format

- An open extensible forensic format for disk images and metadata

A

AFF Advanced Forensic Format

40
Q
  • Forensic image format
  • Commonly used for law enforcement investigations
    ENCase file format
A

E01

41
Q

What are some stand-alone imaging utilities available?

A
  • dd
  • OSFColone
  • FTK Image
42
Q

Guidance Software commercial forensic suite, provides a GUI driven full forensics week

A

EnCase

43
Q

Complete commercial forensic suite provided by access data

A

FTK, the Forensic Toolkit

44
Q
  • Toolkit built using open-source tools and it’s based on Ubuntu Linux
  • Popular forensic suite
A

SANS SIFT

45
Q
  • Command line based toolkit for image analysis and file recovery
  • Popular forensic Suite
A

Sleuth Kit

46
Q

GUI-based program that provides forensic image analysis capabilities

A

Autopsy

47
Q

Pair of commercial forensic tools

A

Helix 3 Enterprise and Pro

48
Q

Provides dedicated mobile forensic features designed to capture, analyze, and report on data from phones and other mobile devices

A

Cellebrite’s UFED

CYSA+ (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions