Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CyberSecurity > CIT > Flashcards

CIT Flashcards

1
Q

ClamAV

A

Free open-source cross-platform antivirus software
Mainly CLI tool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

False Positive (F/P) Causes

A

Heuristics: AVs evolve and so do viruses
Behavioral Analysis: Legit apps behaving like malicious apps
Machine Learning: Mistakes in training data fed to software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Zero Day

A

Undiscovered or newly discovered flaw in a program before the vendor can patch it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are three ways that anti-virus programs discover viruses

A

String/Byte Signatures
Hash Signatures
Heuristic Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Antivirus Bypass Techniques

A

Packing and Encryption
Fileless Attacks
Code Mutation
Disable AV updates
Stealth Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Internal Firewall

A

Blocks incoming/outgoing connections to/from the workstation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

HIDS/HIPS

A

Host Based Intrusion Detection System
Host Based Intrusion Prevention System
Detects, protects, and alerts upon malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Sandbox

A

Restricted environment used to run suspicious programs and files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

EDR

A

Endpoint Threat Detection and Response
Focuses on detecting and responding to malicious activity on the host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

YARA Signature Types

A

Body-Based Signature: looks for specific sequences
Hash-Based Signature: Looks for identical hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

YARA Rules

A

Way of describing a pattern to identify files
Rules written to meet specific conditions
YARA Rule Signature: Max 64 strings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Honeypot

A

Decoy devices meant to lure attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Honeypot Aims

A

Analysis: analyze attacker’s movements and gain insight
Collection: Collect forensic data needed to improve security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Honeytokens

A

Fake IT resources designed to draw the attacker’s attention.
Typically found in public areas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Canary Traps

A

Used to identify internal data leakers. Changes documents slightly and that is traced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MHN

A

Modern Honey Network
Open-source platform for honeypot management
Collects and analyzed honeypot data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Regex

A

Regular Expressions
Method used to describe a specific pattern of characters

18
Q

DLP

A

Data Loss Prevention

19
Q

OpenDLP

A

Free open-source server
Able to concurrently scan thousands of OSs

20
Q

DLP Bypass Techniques

A

Encoding, Ciphering, and Steganography

21
Q

DNS Record

A

Stores info about every site on the web
DNS records tell DNS servers which domain is associated with which IP

22
Q

Mail Protocols

A

SMTP (25): Outgoing mail
POP3 (110): Push mail
IMAP (143): Keep mail on server

23
Q

Email Spoofing

A

Forging email headers to fool recipients into trusting the message

24
Q

DNS Spoofing

A

Creating fake DNS records to redirect traffic to a malicious website

25
Q

SPF

A

Sender Policy Framework
Email authentication protocol
Store info about which IPs can send emails from a domain
Doesn’t work when forwarding emails

26
Q

DKIM

A

DomainKey Identified Mail
Email validation
Preformed on server level
Uses digital signatures

27
Q

DMARC

A

Domain-Based Message Authentication, Reporting, and Conformance
Fails DMARC check: Monitor, Quarantine, Reject
Can generate a report about outgoing emails

28
Q

MTA

A

Mail Transfer Agent
Application side
Forwards

29
Q

MDA

A

Mail Delivery Agent
Sorting and delivery

30
Q

SIEM

A

Security Information and Event Management
Detect security incidents early

31
Q

SIEM Workflow

A

Collection, Parsing, Evaluation, Correlation, Inspection

32
Q

Snort

A

Open-source IDS/IPS system
Can preform real time network traffic analysis

33
Q

Splunk

A

Search Header: Interface used to search and access data
Indexers: Log parsers
Small Components: Collect data to be sent to Splunk

34
Q

Pipe & Search

A

Advanced Syntax Queries
Pipe forms a chain of commands
Search is used with Pipe to filter the output

35
Q

AS & BY

A

Advanced Syntax Queries
AS renames a column
BY groups by field

36
Q

Alert Flow

A

Log Inspection
Rule Definition
Rule Testing
Fine Tuning
Production

37
Q

Aggregation Alerts

A

Consolidate logs with identical content
Detects attacks like brute-force and port scanning

38
Q

Correlation Alerts

A

Alerts from different events correlated to single event
Indicate similar suspicious behavior among various system products

39
Q

SOAR

A

Security Orchestration Automation Response
Designed to reduce need for human intervention

40
Q

SOAR Features

A

Security Incident Response: Tools that respond to security-related incidents
Security Operation Automation: Repetitive tasks can be automated

41
Q

IOT System Components

A

Edge Components, Smart Gateway, Connectors, Data Processing, User Interface

CyberSecurity (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions