Chapter 2 Flashcards
An employee stealing company data could be an example of which kind of threat actor?
Internal threat
External threat
Non-persistent threat
Persistent threat
Internal threat
Which of the following is the BEST definition of the term hacker?
A general term used to describe any individual who uses their technical knowledge to gain unauthorized access to an organization.
The most organized, well-funded, and dangerous type of threat actor.
Any individual whose attacks are politically motivated.
A threat actor whose main goal is financial gain.
A threat actor who lacks skills and sophistication but wants to impress their friends or garner attention.
A general term used to describe any individual who uses their technical knowledge to gain unauthorized access to an organization.
Which of the following threat actors seeks to defame, shed light on, or cripple an organization or government?
Hacktivist
Insider
Script kiddie
Nation state
Competitor
Hacktivist
The IT manager in your organization proposes taking steps to deflect a potential threat actor. The proposal includes the following:
Create and follow onboarding and off-boarding procedures.
Employ the principal of least privilege.
Have appropriate physical security controls in place.
Which type of threat actor do these steps guard against?
Competitor
Hacktivist
Script kiddie
Insider
Insider
A script kiddie is a threat actor who lacks knowledge and sophistication. Script kiddie attacks often seek to exploit well-known vulnerabilities in systems.
What is the BEST defense against script kiddie attacks?
Have appropriate physical security controls in place.
Implement email filtering systems.
Keep systems up to date and use standard security practices.
Properly secure and store data backups.
Build a comprehensive security approach that uses all aspects of threat prevention and protection.
Keep systems up to date and use standard security practices.
A hacker scans hundreds of IP addresses randomly on the internet until they find an exploitable target. What kind of attack is this?
Insider attack
Nation state attack
Opportunistic attack
Targeted attack
Opportunistic attack
-Stealing Information
-Preparing a computer to perform additional tasks in the attack.
-Crashing systems.
-Gathering system hardware information.
-Penetrating system defenses to gain unauthorized access.
-Configuring additional rights to do more than breach the system.
Match the general attack strategy
Reconnaissance
Breaching
Escalating Privileges
Staging
Exploitation
-Exploitation
-Staging
-Exploitation
-Reconnaissance
-Breaching
-Escalating Privileges
-The constant change in personal habits and passwords to prevent anticipated events and exploitation.
-Diversifying layers of defense.
-Giving users only the access they need to do their job and nothing more.
-Implementing multiple security measures to protect the same asset.
-Eliminating single points of failure.
-Giving groups only the access they need to do their job and nothing more.
Match the general defense strategy
Layering
Principle of least privilege
Variety
Randomness
Simplicity
-Randomness
-Variety
-Principle of least privilege
-Layering
-Layering
-Principle of least privilege
Which of the following is the BEST example of the principle of least privilege?
Wanda has been given access to the files that she needs for her job.
Lenny has been given access to files that he does not need for his job.
Mary has been given access to all of the file servers.
Jill has been given access to all of the files on one server.
Wanda has been given access to the files that she needs for her job.
In which phase of an attack does the attacker gather information about the target?
Escalating privileges
Exploit the system
Reconnaissance
Breach the system
Reconnaissance
A collection of zombie computers have been set up to collect personal information. Which type of malware do the zombie computers represent?
Spyware
Trojan horse
Logic bomb
Botnet
Botnet
Which kind of virus operates only in memory and usually exploits a trusted application like PowerShell to circumvent traditional endpoint security solutions?
Remote Access Trojan (RAT)
Fileless virus
Worm
Ransomware
Fileless virus
Which of the following describes a logic bomb?
A program that performs a malicious activity at a specific time or after a triggering event.
A program that has no useful purpose, but attempts to spread itself to other systems and often damages resources on the systems where it is found.
A type of malicious code similar to a virus whose primary purpose is to duplicate itself and spread while not necessarily intentionally damaging or destroying resources.
A program that appears to be a legitimate application, utility, game, or screensaver that performs malicious activities surreptitiously.
A program that performs a malicious activity at a specific time or after a triggering event.
A type of malware that prevents the system from being used until the victim pays the attacker money is known as what?
Remote Access Trojan (RAT)
Fileless virus
Ransomware
Denial-of-service attack (DoS attack)
Ransomware
Which kind of malware provides an attacker with administrative control over a target computer through a backdoor?
Remote Access Trojan (RAT)
Trojan horse
Crypto-malware
Potentially Unwanted Program (PUP)
Remote Access Trojan (RAT)
