Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ Get Certified Get Ahead SY0-501 > Chapter 7 Protecting Against Advanced Attacks > Flashcards

Chapter 7 Protecting Against Advanced Attacks Flashcards

1
Q

____ attacks typically include sustained, abnormally high network traffic

A

DDoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

_______ occurs when one person or entity impersonates or masquerades as someone or something else.

A

Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

____ flood attacks disrupt the TCP handshake process and can prevent legitimate clients from connecting.

A

SYN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

True or False: In a SYN attack, the attacker never finishes the handshake sequence

A

True

The attacker floods the server with SYN packets but never sends the final ACK packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False: Attackers often spoof the source IP address when conducting SYN flood DoS attacks

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A ________ attack is a form of active interception or active eavesdropping. It uses a separate computer that accepts traffic from each party in a conversation and forwards the traffic between the two.

A

man-in-the-middle(MITM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

_____ ______ is one way that an attacker can launch an MITM attack.

A

Address Resolution Protocol (ARP) poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Kerberos helps prevent man-in-the-middle attacks with ______ ______.

A

mutual authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

______ ______ is an attack that misleads computers or switches about the actual MAC address of a system.

A

ARP poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

_____ resolves the IP addresses of systems to their hardware address and stores the result in an area of memory known as the ARP cache.

A

ARP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

True or False : The ARP request broadcasts the MAC address and essentially asks, “Who has this MAC address?”

A

False

It broadcasts the IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

True or False : The computer with the IP address in the ARP request responds with its MAC address. The computer that sent the ARP request caches the MAC address for the IP.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True or False : In a man-in-the-middle attack, an attacker can redirect network traffic and, in some cases, insert malicious code.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An attacker can also use ARP poisoning in a ____attack.

A

DoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The ____ ____ is the IP address of a router connection that provides a path out of the network.

A

default gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False : If all the computers cache a bogus MAC address for the default gateway, a few of them can reach it.

A

False

None of them can reach the default gateway and it stops all traffic out of the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A ___ ____ attack attempts to modify or corrupt DNS results.

A

DNS poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

True or False : Many current DNS servers use Domain Name System Security Extensions(DNSSEC) to protect the DNS records and prevent DNS poisoning attacks.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A ______ attack is another type of attack that manipulates the DNS name resolution process.

A

pharming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

True or False : Pharming attacks on the client computer modify the hosts file used on Windows systems.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An _____ _____ is a type of DDoS attack which typically uses a method that significantly increases the amount of traffic sent to, or requested from, a victim.

A

amplification attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A _____ attack spoofs the source address of a directed broadcast ping packet to flood a victim with ping replies.

A

smurf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

__ amplification attacks send DNS requests to DNS servers spoofing the IP address of the victim.

A

DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

True or False : DNS poisoning attacks attempt to corrupt DNS data.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

True or False : Amplification attacks increase the amount of traffic sent to or requested from a victim and can be used against a wide variety of systems, including individual hosts, DNS servers, and NTP servers.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A ____ ____ attack attempts to guess all possible character combinations.

A

brute force

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

List the two types of brute force attacks

A
  1. Online

2. Offline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

An ______ password attack attempts to discover a password from an _____ system.

A

online

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

______ password attacks attempt to discover passwords from a captured database or captured packet scan.

A

Offline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

True or False : One of the first steps to thwart offline brute force attacks is to use complex passwords and to store the passwords in an encrypted or hashed format.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A ______ attack is one of the original password attacks which uses a ______ of words and attempts every word in the _____ to see if it works.

A

dictionary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

_____ attacks attack the ____ of a password instead of the password.

A

Hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

True or False : Most authentication protocols encrypt the password or the hash before sending it across the network.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In a _______ attack, the attacker discovers the hash of the user’s password and then uses it to log on to the system as the user.

A

pass the hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

True or False : Any authentication protocol that passes the hash over the network in an unencrypted format is susceptible to a pass the hash attack

A

True

Mostly associated with MS LAN Manager (LM) and NT LAN Manager (NTLM). Two older MS security protocols used to authenticate MS clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

______ uses a number used once (nonce) on both the client and the authenticating server.

A

NTLMv2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is a better alternative to NTLM?

A

NTLMv2 or Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In a ______ attack, an attacker is able to create a password that produces the same hash as the user’s actual password.

A

birthday

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

A hash _____ occurs when the hashing algorithm creates the same hash from different passwords.

A

collision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

True or False : Birthday attacks on hashes are thwarted by decreasing the number of bits used in the hash to decrease the number of possible hashes.

A

False

Birthday attacks on hashes are thwarted by increasing the number of bits used in the hash to increase the number of possible hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

______ attacks are a type of attack that attempts to discover the password from the hash. It is a huge database of precomputed hashes.

A

Rainbow table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

______ passwords is a common method of preventing rainbow table attacks, along with other password attacks such as dictionary attacks.

A

Salting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

A ____ is a set of random data such as two additional characters.

A

salt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

True or False : Using additional characters add complexity to the password, and also result in a different hash than the system would create using only the original password. This causes password attacks that compare hashes to fail.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

A _____ attack is one where an attacker _____ data that was already part of a communication session. In this scenario, a third party attempts to impersonate a client that is involved in the original session.

A

replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

True or False : Many protocols use timestamps and sequence numbers to thwart replay attacks.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

True or False : An attacker can launch a known plaintext attack if he has samples of both the plaintext and the ciphertext.

A

True

48
Q

A ____ plaintext attack uses targeted parts of a message to encrypt and match against entire ciphertext to determine the encryption algorithm being used.

A

chosen

49
Q

In a _______ only attack, the attacker doesn’t have any information on the plaintext.

A

ciphertext

50
Q

_____/______ occurs when someone buys a domain name that is close to a legitimate domain name.

A

Typo squatting/URL hijacking

51
Q

List a few reasons why attackers might buy a similar domain i.e. comptai.org vs original comptia.org

A

Hosting a malicious web site.
Earning ad revenue.
Reselling the domain.

52
Q

______ tricks users into clicking something other than what they think they’re clicking.

A

Clickjacking

53
Q

_____ hijacking takes advantage of ____ IDs stored in cookies.

A

Session

54
Q

True or False : Attackers can read cookies installed on systems through several methods, such as through cross-site scripting attacks (described later in this chapter). Once they have the session ID, they can insert it into the HTTP header and send it to the web site. If the web server uses this session ID to log the user on automatically, it gives the attacker access to the user’s account.

A

True

55
Q

A _______ is a type of proxy Trojan horse that infects vulnerable web browsers.

A

man-in-the-browser

56
Q

_____ provides the solution that makes it appear that the older drivers are compatible. A driver ____ is additional code that can be run instead of the original driver.

A

Shimming, shim

57
Q

______ code is the process of rewriting the internal processing of the code, without changing its external behavior.

A

Refactoring

58
Q

A _____ vulnerability is a weakness or bug that is unknown to trusted sources

A

zero-day

59
Q

A ________ is a bug in a computer application that causes the application to consume more and more memory the longer it runs.

A

memory leak

60
Q

An _______ attack attempts to use or create a numeric value that is too big for an application to handle.

A

integer overflow

61
Q

A _______ occurs when an application receives more input, or different input, than it expects. The result is an error that exposes system memory that would otherwise be protected and inaccessible.

A

buffer overflow

62
Q

True or False : If the attacker uses the buffer overflow to crash the system or disrupt its services, it is a DoS attack.

A

True

63
Q

True or False : A buffer overflow attack includes several different elements, but they happen all at once. The attacker sends a single string of data to the application. The first part of the string causes the buffer overflow. The next part of the string is a long string of NOPs followed by the attacker’s malicious code, stored in the attacked system’s memory. Last, the malicious code goes to work.

A

True

64
Q

True or False : Buffer overflows occur when an application receives more data than it can handle, or receives unexpected data that exposes system memory. Buffer overflow attacks often include NOP instructions (such as x90) followed by malicious code. When successful, the attack causes the system to execute the malicious code. Input validation helps prevent buffer overflow attacks.

A

True

65
Q

____ ____ is an attack that injects a DLL into a system’s memory and causes it to run.

A

DLL injection

66
Q

True or False : In a successful DLL injection attack, the attacker attaches to a running process, allocates memory within the running process, connects the malicious DLL within the allocated memory, and then executes functions within the DLL.

A

True

67
Q

____ ___ has been optimized by an application (called a compiler) and converted into an executable file..

A

Compiled code

68
Q

____ ___ is evaluated, interpreted, and executed when the code is run.

A

Runtime code i.e. HTML
Note: Python is a hybrid of compiled and runtime code. Code is initially compiled then accessed each time during runtime. If interpreter detects change in source code it recompiles it.

69
Q

____ ___ is the practice of checking data for validity before using it and is one of the most important security steps that developers should take.

A

Input validation

70
Q

_____ ____ prevents an attacker from sending malicious code that an application will use by either sanitizing the input to remove malicious code or rejecting the input.

A

Input validation

71
Q

True or False : Improper input handling (or the lack of input validation) is one of the most common security issues on web-based applications. It allows many different types of attacks, such as buffer overflow attacks, SQL injection, command injection, and cross-site scripting attacks.

A

True

72
Q

Preventing the use of specific characters (, = -) can be used to prevent _____ attacks

A

SQL injection attacks

73
Q

Preventing the use of special characters (< >) can be used to block _____ code

A

HTML

74
Q

True or False : Other input validation techniques attempt to sanitize HTML code before sending it to a web browser also referred to as escaping the HTML code or encoding the HTML code.

A

True

75
Q

True or False : Improper error handling can often give attackers information about an application.

A

True

76
Q

List two factors about error handling

A
  1. Errors to users should be general.

2. Detailed information should be logged.

77
Q

True or False : Error and exception handling helps protect the integrity of the operating system and controls the errors shown to users. Applications should show generic error messages to users but log detailed information.

A

True

78
Q

True or False : Certificates can be used to authenticate and validate software code

A

True

79
Q

What are two benefits with code signing?

A
  1. The certificate identifies the author

2. The hash verifies the code has not been modified

80
Q

___ ___ is code that is never executed or used

A

Dead code

81
Q

____ code analyzers examines the code without executing it

A

Static

82
Q

____ analysis checks the code as it is running

A

Dynamic

83
Q

____ uses a computer program to send random data to an application.

A

Fuzzing

84
Q

____ testing attempts to simulate a live environment and determine how effective or efficient an application operates with a load

A

Stress

85
Q

______ is an isolated area used for testing programs

A

Sandbox

86
Q

_____ _____ is the process of ensuring that software meets specifications and fulfills its intended purpose.

A

Model verification

87
Q

_____ models attempt to give structure to software development projects

A

Software development life cycle (SDLC)

88
Q

List two popular SDLC models

A
  1. Waterfall

2. Agile

89
Q

______ model includes multiple stages going from top to bottom.

A

Waterfall

90
Q

List typical stages used with the waterfall model

A
  1. Requirements
  2. Design
  3. Implementation
  4. Verification
  5. Maintenance
91
Q

True or False : A challenge with the waterfall method is that it is overly flexible

A

False

The waterfall method is said to lack flexibility

92
Q

_____ model uses a set of principles shared by cross-functional teams.

A

Agile

93
Q

True or False : Instead of strict phases, the agile model uses iterative cycles

A

True

94
Q

True or False : A key difference of the waterfall model is that emphasizes interaction between customers, developers, and testers during each cycle.

A

False

It is the agile model that does this.

95
Q

True or False : The agile model can be very effective if the customer has a clear idea of the requirements

A

True

96
Q

___ ____ is an agile-aligned methodology that stresses security throughout the lifetime of the project.

A

Secure DevOps

97
Q

_____ _____ helps ensure that developers do not make unauthorized changes.

A

Change management

98
Q

_____ ____ tracks the versions of software as it is updated, including who made the update and when.

A

Version control

99
Q

______ an application refers to preparing and configuring the application to launch on different devices and to use different application services.

A

Provisioning

100
Q

_______ an app refers to removing it from a device.

A

Deprovisioning

101
Q

List the two primary applications used for web servers

A
  1. Apache is free and can run on UNIX, LINUX, and Windows systems
  2. Internet Information Services (IIS) is a Microsoft product and is included free with any Windows Server product
102
Q

______ of a database refers to organizing the tables and columns to reduce redundant data and improve overall database performance.

A

Normalization

103
Q

True or False : A database is in First Normal Form 1NF if it meets the following criteria:

  1. Each row within a table is unique and identified with a primary key
  2. Related data is contained in a separate table
  3. None of the columns include repeating groups
A

True

104
Q

True or False : A database is in Second Normal Form 2NF only applies to tables that have a composite key where two or more columns make up the full primary key.

A

True

105
Q

True or False : A database is in Second Normal Form 2NF if it meets the following criteria:

  1. It is in 1NF
  2. Non-primary key attributes are completely dependent on the composite primary key
A

True

106
Q

True or False : A database is in Third Normal Form 3NF if it meets the following criteria:

  1. It is in 2NF and 1NF
  2. All columns that aren’t primary keys are only dependent on the primary key.
A

True

107
Q

True or False : In many cases, a SQL injection attack starts by sending improperly formatted SQL statements to the system to generate errors.

A

True

108
Q

True or False : Attackers use SQL injection attacks to pass queries to back-end databases through web servers. Many SQL injection attacks use the phrase ‘ or ‘1’=’1’ – to trick the database server into providing information.

A

True

109
Q

_____ ____ is a specific type of command injection attack that attempts to access a file by including the full directory path, or traversing the directory structure.

A

Directory traversal

110
Q

_____ ____ ___ is another web application vulnerability that can be prevented with input validation techniques. Attackers embed malicious HTML or JavaScript code into a web site’s code. The code executes when the user visits the site.

A

Cross-site scripting (XSS)

111
Q

True or False : Cross-site scripting (XSS) attacks allow attackers to capture user information such as cookies. Input validation techniques at the server help prevent XSS attacks.

A

True

112
Q

______ is an attack where an attacker tricks a user into performing an action on a web site.

A

Cross-site request forgery (XSRF or CSRF)

113
Q

True or False : Cross-site request forgery (XSRF) scripting causes users to perform actions on web sites, such as making purchases, without their knowledge. In some cases, it allows an attacker to steal cookies and harvest passwords.

A

True

114
Q

A ______ is a structure used to provide a foundation.

A

Framework

115
Q

_____ ____ typically use a structure of basic concepts and they provide guidance to professionals on how to implement security in various systems.

A

Cybersecurity frameworks

116
Q

List some categories of frameworks

A
  1. Regulatory frameworks based on relevant laws and regulations
  2. Non-regulatory framework typically identifies common standards and best practices that organizations can follow. i.e. COBIT
  3. Industry-specific i.e. PCI DSS for credit cards

Security+ Get Certified Get Ahead SY0-501 (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions