Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 601 2022 > Commands > Flashcards

Commands Flashcards

1
Q

netstat

A

-a all active connections
-b show binaries
-n do not resolve names (just ips)
show network status and protocol statistics. You can display the status of TCP and UDP endpoints in table format, routing table information, and interface information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

traceroute/tracert

A

trace traffic from one destination to another

Uses ICMP and TTL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

pathping

A

combines traceroute and ping

will give more accurate latency information than traceroute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

arp -a

A

ip address and mac address for devices on the network that are in the local arp table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

dig/nslookup

A

Information on DNS server

names and IP addresses (more info with dig)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

route print/netstat -r

A

view device’s routing table
Find out which way the packets will go
allows you to make manual entries into the network routing tables with add flag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

hping

A

ping that can send almost anything
can modify the port, ip, tcp, udp, icmp values
Easy to accidentally flood a server and cause DDoS
used to send large volumes of TCP traffic at a target while spoofing the source IP address, making it appear random or even originating from a specific user-defined source.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

nmap

A 
learn about network devices
port scan to id open ports
OS scan to discover without logging in
What services running on device
Can run additional scripts (NSE)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

scanless

A

runs port scan from different host (from proxy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

dnsenum

A

finds host names in dns

FInds all hostnames that are associated with that address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cuckoo

A

test a file in a safe environment (sandbox)

Can evaluate the file for malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Nessus

A

Industry leader in vulnerability scanning
(not command code)
Provides vulnerabilities as well as suggested resolutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Wireshark

A

Graphical packet analyzer
Grabs network traffic and stores for offline analysis
Grabs Ethernet, Bluetooth, Wireless (IEEE. 802.11, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

tcpdump

A

Displays packet on screen

command line version of wireshark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

tcpreplay

A

Allows to replay packets

Can be useful to check if security would catch particular packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

dd

A

Linux

create a bit by bit copy of a drive or directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

memdump

A

Takes all information in system memory and send to file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

WinHex

A

Able to view file information in hexadecimal form

Useful with disk cloning, data recovery, hardware cleaning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

FTK imager

A

REad drive as a windows executable

20
Q

Autopsy

A

view and recover data from storage devices

21
Q

MITRE

A

Framework to look at potential attacks

Gives types, causes, and potential resolution and prevention

22
Q

Diamond model

A

Developed by government

Used after an attack to identify parts of the attack as well as looking how to prevent in the future

23
Q

Cyber Kill Chain

A

Defines different phases of a cyber attack

How it is done by an attacker

24
Q

Logs

Network, System, application, security, web, DNS, Authentication, Dump files, VoIP and call managers, SIP traffic

A

Network- info from network devices (updates, auth issues, etc.)
System- auth details, monitor apps, file changes, may require filter
Application-specific to the application
Security- blocked and allowed traffic flows, exploited attempts, blocked URL, DNS sinkhole traffic, security devices
Web- Info firewall and web application attacks, IP address, Auth issues, server activity
DNS- IP address, hostname, malware sites
Authentication- who logged in or didn’t
Dump files- Read mem and DNS dump files
VOIP- inbound and outbound info, auth, audit trail
Session Initiation Protocol (SIP)- setup and teardown of VoIP, inbound and outbound calls, alerts on unusual numbers or country codes

25
Q

syslog

A

Standard for message logging
Integrated with SIEM
facility code and severity level wiht each entry
Different types of syslogs
rsyslog- fast log processing
syslog-ng- popular for linix, additional filtering and storage options
NXlog- collection from different log types

26
Q

journalctl

A

method for query system journal in linux

linux logs are stores in binary format

27
Q

NetFlow

A

Gather traffinc from all traffic flows

standard so can be used with many vendors

28
Q

IPFIX

A

Newer version of Netflow

Can customize what data is collected from network devices

29
Q

sFlow

A

only a portion of the actual network traffic

usually embedded in infrascructure

30
Q

Protocol analyzer

A

Solve complex application issues
Gathers packets on network
Can be used with wireless networks
Detailed information about each packet going through the network

31
Q

GDPR

A

Regulations set in EU

Ability for person to control what happens to their data and where it goes

32
Q

PCI DSS

A 
Credit Card regulations
Secure network and systems
Protect cardholdedr data
Maintain vulnerability management program
Strong access control
monitor and test network
Information security policy
33
Q

CIS

A

CIS-CSC

Framework to improve cyber defense

34
Q

NIST RMF

A

Framework mandatory for US federal agencies

Categorize, select, implement, assess, authorize, monitor

35
Q

NIST CSF

A

Framework designed for commercial uses
Framework core- Identify, protect, detect, respond, recover
Framework Implementation Tiers- org’s understanding their cybersecurity vulnerabilities and what tools are needed
Framework Profile- policies, guidelines, and standards that are being implemented with framework core

36
Q

ISO/IEC 27001

A

Standard for Information Security Management System (ISMS)

37
Q

ISO/IEC 27002

A

Code of practice for information security controls

38
Q

ISO/IEC 27701

A

Privacy, PIMS

39
Q

ISO/IEC 31000

A

International standards for risk management practices

40
Q

SSAE SOC 2 Type I/II

A

Auditing standard for SSAE 18
SOC 2 - Trust services criteria- firewalls, intrustion detection MFA
Type I audit - Test controls in place at a particular point in time
Type II audit - Test controls over at least 6 months

41
Q

CSA

A

Security in cloud computing

CCM - Standards for security controls

42
Q

AUP

A

Acceptable Use Policy

What is acceptable use of company assets

43
Q

SLA

A

Service level agreement
Minimal terms for services provided (uptime, response time, etc.)
Between customer and service provider

44
Q

MOU

A

Memorandum of Understanding
includes statements of confidentiality
informal letter of intent not signed contract
understand what requirements are for business process

45
Q

MSA

A

Measurement system analysis
assess the measurement process
Calculate measurement uncertainty
Used with quality management systems

46
Q

BPA

A

Business Partnership Agreement

Security+ 601 2022 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions