CySA+

Question 1

Sysmon

Answer 1

System Monitor tool that is part of Sysinternals. Logs activity to Event Monitor, and incorporates XML config files to establish rules to alert on (exclude typical Microsoft activity, look for this malicious behavior, etc)

Question 2

Stored or Reflected XSS

Answer 2

Cross-site Scripting attack where an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

Example- script posted in a comment on a message board that then loads for any user that visits the page.

Question 3

Blind XSS

Answer 3

A form of Stored XSS. Attacker injects the malicious script or payload ‘blindly’ on some web pages without having any assurance that it will be executing. Web pages that are likely to save their payload into the database are the most important carrier for Blind XSS attacks.

Example- script posted into a Reporting form on a website

Question 4

Exact Data Match

Answer 4

EDM
Structured database of string values to match, used in DLP

Example- could store hashes of credit card numbers, then if DLP thinks a credit card number is being exported, hash it and see if the value matches in EDM.

Question 5

SDL

Answer 5

Security Development Lifecycle
Microsoft’s security framework for application development that supports dynamic development processes

Question 6

Rootkit

Answer 6

Class of malware that modifies system files (often at the kernel level) to conceal its presence and establish persistence

Question 7

Buffer Overflow

Answer 7

Attack where data goes past the boundary of the destination buffer and begins to corrupt adjacent memory

Question 8

Smash the Stack

Answer 8

Attacker fills up the buffer with NOP (No Operation) so that the return address may hit a NOP and continue on until it finds the attacker’s code to run

Question 9

Heap Overflow

Answer 9

Vulnerability where software attempts to move data from one location in memory into a fixed-length buffer allocated on the heap, which is too small to hold the data.

Question 10

Dereferencing

Answer 10

Software vulnerability that occurs when the code attempts to remove the relationship between a pointer and the thing it points to

Question 11

How can we mitigate race conditions?

Answer 11

Develop applications to not process things sequentially if possible.
Implement a locking mechanism within the app to provide exclusive access to that resource- for example SharePoint files get “checked out” and can’t be edited by someone else

Question 12

icacls

Answer 12

Windows command-line utility that IT admins can use to change access control lists on files and folders.

Question 13

Which coding languages are especially vulnerable to buffer overflow attacks?

Answer 13

C and C++, as strcpy does not perform boundary checking of buffers

Question 14

How can we mitigate overflow attacks?

Answer 14

Proper input validation
Proper boundary checking
Use ASLR (address space layout randomization)
Run programs with least privilege

Question 15

SEV

Answer 15

Secure Encrypted Virtualization
AMD Processor Security Extension

Question 16

SGX

Answer 16

Software Guard Extensions
Intel Processor Security Extension

Question 17

ASLR

Answer 17

Address Space Layout Randomization
Technique that hinders some types of security attacks by making it more difficult for an attacker to predict target addresses by randomly arranging theaddress spacepositions of key data areas of aprocess, including the base of theexecutableand the positions of thestack,heapandlibraries.

Question 18

SME

Answer 18

Secure Memory Encryption
AMD Processor Security Extension

Question 19

TXT

Answer 19

Trusted Execution Technology
Intel Processor Security Extension

Question 20

Modbus

Answer 20

Communications protocol used in OT networks

Question 21

Vehicular Vulnerabilites

Answer 21

Exploit over onboard cellular
Exploit over onboard WiFi
Attach exploit to the OBD-II

Question 22

Masquerading

Answer 22

Dropper replaces legitimate executable with a malicious one (malicious one masquerades as legitimate one)

Question 23

DLL Injection

Answer 23

DLL injection is a method of executing arbitrary code in the address space of a separate live process.

Question 24

DLL Sideloading

Answer 24

Malicious DLL is loaded as part of a legit program that has a vulnerability that was exploited

Question 25

Process Hollowing

Answer 25

Dropper starts process in a suspended state, then rewrites the memory locations containing the process code with the malware code

Question 26

Military Data Classifications

Answer 26

Unclassified- no restrictions
Classified- viewing restricted to authorized persons within organization or to third parties under NDA
Confidential- highly sensitive, only for approved persons within org (and MAYBE trusted third parties under NDA)
Secret- valuable info, viewing must be severely restricted
Top Secret- info that would cause grave danger if inadvertently disclosed

Question 27

SOX

Answer 27

Sarbanes-Oxley Act
Law in regards to an organization’s financial and business operations- specifies what types of documents need to be kept and for how long (auditing)

Question 28

GLBA

Answer 28

Gramm-Leach-Bliley Act
Sets forth requirements that help protect the privacy of an individual’s financial information that is held by financial institutions or others that may store it

Question 29

FISMA

Answer 29

Federal Information Security Management Act
Sets forth requirements for federal organizations to adopt information assurance controls

Question 30

Data Steward

Answer 30

Role focused on the quality of the data and associated metadata

Question 31

ISA

Answer 31

Interconnection Security Agreement
Document that regulates security-relevant aspects of an intended connection between a government agency and an external system

Question 32

PUF

Answer 32

Physically Unclonable Function
A physical entity embodied in a physical structure, usually implemented in integrated circuits. These physical variances can actually be used in cryptographic functions.

Question 33

Secure Enclave

Answer 33

Provides CPU hardware-level isolation and memory encryption on every server, by isolating application code and data from anyone with privileges, and encrypting its memory. With additional software, secure enclaves enable the encryption of both storage and network data for simple full stack security. Secure enclave hardware support is built into all new CPUs from Intel and AMD.

Question 34

EMM

Answer 34

Enterprise Mobility Management
MDM suite with broader capabilities such as IAM

Question 35

Insecure Components

Answer 35

Any code that is used or invoked outside the main program development process-
Code Reuse
Using a third-party library
Software Development Kit

Question 36

Field Bus

Answer 36

Digital serial data communications used in OT networks to link PLCs

Question 37

TPM

Answer 37

Trusted Platform Module
Hardware in COMPUTER that assists with cryptographic functions

Question 38

Trusted Execution

Answer 38

CPU’s security extensions invoke a TPM and secure boot attestation to ensure that a trusted OS is running

Question 39

PLC

Answer 39

Programmable Logic Controller
Type of computer designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems

Question 40

Firmware

Answer 40

Programming that is written directly to a hardware device’s static memory. It is used to run user programs on the device and can be thought of as the software that enables hardware to run.
Firmware has complete control over hardware and system memory, thereby making it a lucrative target

Question 41

COSO

Answer 41

Committee of Sponsoring Organizations of the Treadway Commission
Provides guidance on a variety of governance related topics including fraud, controls, finance and ethics

Question 42

Error Handler

Answer 42

Coding methods to anticipate and deal with exceptions thrown during execution of a process

Question 43

When you find a suspicious process, what things should you consider?

Answer 43

Identify how the process interacts with the Registry and file system
How is it being launched?
Is the image file located in system folder or a temp folder?
What files are being manipulated by the process?
Does the process restore itself upon reboot after deletion?
Does a system privilege or service get blocked if you delete the process?
Is the process interacting with the network?

Question 44

HTTP Response Codes- 4xx Range

Answer 44

These are client-side errors.
400- request couldn’t be parsed by server
401- request didn’t supply authentication credentials
403- insufficient permissions
404- requested resource doesn’t exist

Question 45

Covert Channels

Answer 45

Transmitting data over nonstandard port
Encoding data in TCP/IP packet headers
Segmenting data into multiple packets and sending spread out
Obfuscation by using HEX
Transmitting encrypted data

Question 46

Fileless Detection Techniques

Answer 46

Techniques that require analysis of the contents of system memory and of process behavior rather than scanning the file system

Question 47

When analyzing firewall logs, what four types of useful security data can be provided?

Answer 47

Connections that are permitted or denied
Port and protocol usage within network
Bandwidth utilization with the duration and volume of usage
Audit log of all address translations that occurred

Question 48

ALE and how to calculate

Answer 48

Annual Loss Expectancy
Multiply SLE (Single Loss Expectancy) by ARO (Annual Rate of Occurrence)
Example- if SLE is $2500, and it will likely happen 4 times, the ALE would be $10,000

Question 49

NIST Cybersecurity Framework

Answer 49

Risk-based framework that is focused on IT security over IT service provision.
FRAMEWORK CORE identifies five key functions (Identify, Protect, Detect, Respond, Recover) with subcategories
IMPLEMENTATION TIERS see how closely the FRAMEWORK CORE functions are integrated with org’s overall risk management process
FRAMEWORK PROFILES show current/target outcomes to identify where it is best to invest to close the gap in any cybersecurity capabilities

Question 50

Footprinting

Answer 50

Use of tools to map out layout of a NETWORK, usually in terms of
IP address usage
Routing topology
DNS namespace

Question 51

Fingerprinting

Answer 51

Use of tools that perform HOST SYSTEM DETECTION to map out data like
Open ports
OS type and version
File shares
Running services/applications
System uptime
Other useful metadata

Question 52

nmap -sV

Answer 52

Probe open ports to determine service/version info

Question 53

nmap -A

Answer 53

Enable OS detection, version detection, script scanning and traceroute

Question 54

Secure Erase

Answer 54

Sanitizing solid-state device using manufacturer provided software

Question 55

ROSI

Answer 55

Return on Security Investment
Is a security control worth the cost of deploying and maintaining it?
((ALE-ALE with mitigation in place) - Cost of mitigation)/Cost of mitigation

Question 56

nmap -f or –mtu

Answer 56

Fragmentation, splits TCP header of each probe between multiple IP datagrams to make it hard for IDS/IPS to detect

Question 57

Reconstruction

Answer 57

Method of restoring a system that has been sanitized using scripted installation routines and templates

Question 58

nmap -sS

Answer 58

TCP SYN scan, or “half open” scan
Sends a SYN packet to identify the port state without sending back an ACK afterwards
Requires root privileges on system you’re scanning from

Question 59

WRT

Answer 59

Work Recovery Time
Length of time in addition to the RTO of individual systems to perform reintegration and testing of a restored or upgraded system following an event

Question 60

Enterprise Security Architecture

Answer 60

Framework for defining the baseline, goals, and methods to secure a business

Question 61

RPO

Answer 61

Recovery Point Objective
Goal for maximum amount of DATA organization can tolerate losing. Measured in time

Question 62

RTO

Answer 62

Recovery Time Objective
Goal an organization sets for maximum length of time it should take to restore normal ops following an outage

Question 63

CDM

Answer 63

Continuous Diagnostics and Mitigation
Provides US gov. agencies/departments with capabilities and tools to identify cybersecurity risks on ongoing basis, prioritize them based on potential impact, and enable cybersecurity personnel to mitigate the most significant problems

Question 64

CVSS and Categories

Answer 64

Common Vulnerability Scoring System
Way to quantify vulnerability data and then take into account degree of risk to different types of system info
0- no risk
0.1-3.9- Low
4.0-6.9- Medium
7.0-8.9- High
9.0-10.0- Critical

Question 65

RFC

Answer 65

Request for Change
Document that lists the reason for a change and the procedures to implement that change

Question 66

hping

Answer 66

Spoofing tool that allows crafting of network packets to exploit vulnerable IDS/IPS

Question 67

Reaver

Answer 67

Command line tool used to brute-force WPS enabled accessed points. WPS used 8 digit points so very easy to hack into

Question 68

What can react unpredictably to any type of scanning?

Answer 68

Printers
VoIP phones
Embedded Systems

Question 69

What accounts should perform credentialed scans?

Answer 69

SERVICE ACCOUNTS, not local admins

Question 70

Responder

Answer 70

Command line tool used to poison responses to NetBIOS, LLMNR and MDNS name resolution requests in an attempt to perform a Man in the Middle attack.
Intercepts request and the returns attacker IP as the name record

Question 71

Aircrack-ng Suite

Answer 71

Suite of utilities designed for wireless network security testing

Question 72

airmon-ng

Answer 72

Utility in Aircrack-ng
Enable/disable monitor mode on cards

Question 73

airodump-ng

Answer 73

Utility in Aircrack-ng
Capture wireless frames

Question 74

aireplay-ng

Answer 74

Utility in Aircrack-ng
Deauth users and impersonate

Question 75

aircrack-ng

Answer 75

Utility in Aircrack-ng
Extract auth key and retrieve plaintext password- only works on WEP networks

Question 76

Hashcat and How it Works

Answer 76

Command line tool used to perform brute force and dictionary attacks against password hashes
Uses GPU to perform brute force cracking faster

Question 77

Canonicalization Attack

Answer 77

Attack method where input characters are encoded in such a way as to evade vulnerable input validation measures
Example- using %2e%2e%2f in place of ../

Question 78

Parameterized Queries

Answer 78

Technique that defends against SQL injection and insecure object references by incorporating placeholders in a SQL query

Basically says “only use these formats”

Question 79

Cookie Poisoning

Answer 79

A type of session hijacking in which attacker alters, forges, hijacks an otherwise valid cookie sent back to a server to steal data, bypass security, or both

Question 80

Remote File Inclusion

Answer 80

Attacker executes a script to inject a remote file INTO the web app or website. Example- embedding a hidden URL into the request to have it execute a script hosted on another site

Question 81

Local File Inclusion

Answer 81

Attacker adds a file to the web app or website that already exists on the hosting server. Example- using directory traversal to try and get the web server to allow a command prompt

Question 82

Insecure Object Reference and how to mitigate

Answer 82

Coding vulnerability where unvalidated input is used to select a resource object like a file or database
To mitigate, implement access control techniques in applications to verify a user is authorized to access a specific object

Question 83

XML data submitted without ______ or ______ is vulnerable to spoofing, request forgery, and injection of arbitrary code

Answer 83

Encryption or Input Validation

Question 84

Normalization

Answer 84

A string is stripped of illegal characters or substrings and converted to the accepted character set

Question 85

Output Encoding

Answer 85

Coding method to sanitize output by converting untrusted output to a SAFE FORM where the input is DISPLAYED AS DATA to the user WITHOUT EXECUTING AS CODE in the browser

Question 86

How can you prevent CSRF?

Answer 86

Request user-specific tokens in all form submissions

Question 87

The Five Cookie Attributes

Answer 87

Secure- instructs client’s web browser to only send cookie if its over secure channel (HTTPS)
HTTP Only- disables access from client-side scripting to your cookie, can only access via HTTP
Domain- sets domain of server that cookie is valid for, limits who has access
Path- Specify URL path for which cookie is valid
Expires- specify when persistent cookie expires

Question 88

How can you prevent clickjacking

Answer 88

Frame busting- a technique that removes the malicious iframe loaded on a site by forcing a specific page to the top frame. Can be implemented using Javascript or by setting X-FRAME-OPTIONS to DENY

Question 89

XML Bomb

Answer 89

XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it.

Used in Billion Laughs Attack, which would define 10 entities that each defined as consisting of 10 of the previous entity, which eventually expands to one billion copies of the first entity. This would most likely exceed computer memory.
The first entity was LOL, by the way.

Question 90

XXE

Answer 90

XML External Entity
Type of attack against an application that parses XML input
Occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser
Attack can lead to disclosure of confidential data, DoS, server side request forgery, etc

Question 91

XSS

Answer 91

Cross-site Scripting
User trusts a badly implemented website
Attacker injects a script into the trusted website
User’s browser executes attacker’s script

Question 92

CSRF/XSRF

Answer 92

Cross-Site Request Forgery
A badly implemented website trusts the user
Attacker tricks user’s browser into issuing requests
Website executes the attacker’s requests

Question 93

How can you prevent an application from exposing sensitive data?

Answer 93

Applications should ONLY send data between authenticated hosts using encryption to protect the session
Do NOT use hardcoded credentials in the application
Disable use of client password autocomplete features, temporary files, and cookies

Question 94

DOM XSS

Answer 94

Form of XSS that targets the Document Object Model on websites. Never reaches the server and instead executes in the user’s browser.

Example- a page designed to take a user’s name and display it on the webpage could have scripting executed in it if a malicious url was sent to the user. Then when they navigate to this page, it executes the script and makes the page look completely different

Question 95

Vulnerability Discovery Scan

Answer 95

Creates and updates inventory of assets by conducting enumeration of network without scanning for vulnerabilities

Question 96

XCCDF

Answer 96

Extensible Configuration Checklist Description Format
A structured collection of security configuration rules for some set of target systems. Written in XML

Question 97

OVAL

Answer 97

Open Vulnerability and Assessment Language
XML schema for describing system security state and querying vulnerability reports and information

Question 98

SCAP

Answer 98

Security Content Automation Protocol
NIST Framework that outlines acceptable practices for vulnerability scanning and standardizes the format and descriptive language with which software flaws and security configuration information is communicated, both to machines and humans.

Question 99

sigcheck

Answer 99

Sysinternals utility that allows you to verify root certificates in the local store against Microsoft’s master trust list

Question 100

CVE Categories: AC

Answer 100

Access Complexity
High or Low

Question 101

CCE

Answer 101

Common Configuration Enumeration
Scheme for provisioning secure configuration checks across multiple sources

Question 102

Continuous Delivery

Answer 102

Software development method where application and platform requirements are frequently tested and validated for immediate availability

Question 103

Continuous Integration

Answer 103

Software development method where code updates are tested and committed to a dev or build server/code repository rapidly

Question 104

PACU

Answer 104

Opensource cloud penetration testing framework to test the security configuration of an AWS account

Question 105

Prowler

Answer 105

Auditing tool for AWS that evaluates the cloud infrastructure against AWS benchmarks, GDPR compliance, and HIPAA compliance

Question 106

Scout Suite

Answer 106

Open-source tool written in Python that can audit instances and policies created on multicloud platforms

Question 107

CORS Policy and risks

Answer 107

Cross Origin Resource Sharing Policy
A CDN policy that instructs the browser to treat requests from nominated domains as safe
Weak CORS policies can expose site to XSS vulnerabilities

Question 108

API Security Best Practices

Answer 108

API must only be used over an encrypted channel
Data received by an API must pass server-side validation routines
Error messages should be sanitized
Implement throttling/rate limiting mechanisms to protect from a DoS
APIs should use secure authentication and authorization such as SAML or OAuth/OIDC before accessing data

Question 109

FaaS

Answer 109

Function as a Service
Cloud service model that supports serverless software architecture by provisioning runtime containers in which code is executed in a particular programming language

“Run things and make applications without having our own servers”

Question 110

Ansible

Answer 110

Automation tool that uses YAML files rather than user agents

Question 111

curl

Answer 111

Command line tool to transfer data from or to a server, using protocols like HTTP, FTP, etc

Question 112

SAML

Answer 112

Security Assertions Markup Language
XML-based data format used to exchange authentication info between a client and a service
Provides SSO and federated identity management

Question 113

SOAP

Answer 113

Simple Object Access Protocol
XML-based web services protocol that is used to exchange messages between applications

Question 114

ESB

Answer 114

Enterprise Service Bus
Common component of SOA (service oriented architecture) that facilitates decoupled service-to-service communication

Question 115

SOA

Answer 115

Service Oriented Architecture
Software architecture where components of the solution are conceived as loosely coupled services not dependent on a single platform type or technology
Each piece can be produced/tested separately
Each service takes defined inputs and produces defined outputs
An overall architecture for mapping business workflows to the IT systems that support them

Question 116

OWASP ZAP

Answer 116

Most widely used web app scanner. Free and open source.

Question 117

Interception Proxy

Answer 117

Man in the middle software that sits between a client and server and allows requests/responses to be analyzed and modified

Question 118

Burp Suite

Answer 118

Proprietary tool for performing security testing of web applications that supports the entire testing process, from initial mapping and analysis of attack surface to finding and exploiting security vulnerabilities

Question 119

Arachni

Answer 119

Open source web application scanner with a GUI, makes findings a lot easier to take in

Question 120

Nikto

Answer 120

Widely used vulnerability scanner that can identify known web server vulnerabilities and misconfigurations, identify web appliances running on a server, and identify potential known vulnerabilities in those web applications

Command-line only, so data can be challenging to digest

Question 121

osquery

Answer 121

Open-source tool that converts an OS to a relational database so that you can perform easy analytics using SQL queries

Question 122

Fuzzing

Answer 122

Dynamic code analysis technique that involves sending a running application random and unusual input to evaluate how the application responds

Question 123

Debugger

Answer 123

Dynamic testing tool used to analyze software as it executes

Question 124

Programmers make code more difficult to analyze by ____.

Answer 124

Using an obfuscator

Question 125

IDA

Answer 125

Interactive Disassembler
Popular cross-platform disassembler and decompiler used by reverse engineers

Question 126

_____ makes it easier to identify individual functions within the process, track variables, and to find branching logic

Answer 126

Pseudocode

Question 127

Decompiler

Answer 127

Reverse engineering tool that converts machine code or assembly language to code in a specific higher-level language or psuedocode

Question 128

Disassembler

Answer 128

Type of reverse engineering software that converts machine language code into assembly language code

Question 129

UAT

Answer 129

User Acceptance Training
Beta testing by the end users that proves a program is usable and fit-for-purpose in real-world conditions

Question 130

Formal verification method

Answer 130

Process of validating software design through mathematical modeling of expected inputs and outputs

Question 131

Why is it not recommended to use regedit for registry analysis? What should we use instead?

Answer 131

regedit doesn’t display last modification time of a value by default. Changes to registry are a major IoC so not knowing when a change happened is not good.
Use regdump, which will dump contents of registry to a text file for analysis

Question 132

The four severity categories for Windows Event Logs

Answer 132

Information- successful events
Warning- not necessarily a problem but could end up one
Error- significant problems which could inhibit functionality
Audit success/failure- only in security logs

Question 133

winlogon.exe

Answer 133

Manages access to user desktop and loading user profile through userinit.exe

Question 134

System (Windows process)

Answer 134

Special kind of process that hosts threads that only run in kernel mode
PID is ALWAYS 4

Question 135

csrss.exe

Answer 135

Client Server Runtime Subsystem
User mode side of Windows subsystem, and responsible for process thread creation and deletion. Always running, CRITICAL to system operation. If terminated, will result in system failure.

Question 136

wininit.exe

Answer 136

Windows Initialization Process
Responsible for launching services.exe, lsass.exe, and lsaiso.exe within session 0

Question 137

smss.exe

Answer 137

Responsible for creating new sessions

Question 138

services.exe

Answer 138

Service Control Manager (SCM)- handles system services like svchost.exe, dllhost.exe, and many others

Question 139

svchost.exe

Answer 139

Service Host- responsible for hosting and managing Windows services.
These services are implemented as DLLs stored in the Registry.
When it calls upon a service it uses the -k flag.

Question 140

lsass.exe

Answer 140

Local Security Authority Subsystem- enforces security policy on system. Handles authentication/authorization services for the system, and writes to Windows Security Log

Question 141

File signatures for Windows Portable Executable files will always start with ____ in HEX.

Answer 141

4D 5A

Question 142

File signatures for Windows Portable Executable files will always start with ____ in ASCII.

Answer 142

MZ

Question 143

File signatures for Windows Portable Executable files will always start with ____ in Base64 encoding.

Answer 143

TV

Question 144

Memory Analysis Tools allow us to _____.

Answer 144

Reverse engineer code used by the processes
Discover how processes interact with the file system and Registry
Examine network connections
Retrieve cryptographic keys
Extract strings

Question 145

When service interruptions occur, to determine if this was malicious or an accident, you must consider ________

Answer 145

Are security services prevented from running?
Is the process running the service compromised?
Is the service disabled by a DDoS?
Is there excessive bandwidth usage?

Question 146

Defensive Capabilities: The Six Ds

Answer 146

Detect
Destroy (probably only in a government agency, hack back is illegal)
Degrade
Disrupt
Deny
Deceive

Question 147

explorer.exe

Answer 147

Windows Explorer
Gives users access to their folders and files
Provides functionality to start menu, task bar, etc

Question 148

What are some reasons why an attacker may target the Windows Registry?

Answer 148

Achieve persistence- modifying Registry Key entries
Delete Registry Keys to clean up prior activity
Modify Registry Keys to conceal payloads/commands used to maintain persistence

Question 149

In virtualized environments, process and memory analysis can be performed by ______ or _______.

Answer 149

Analyzing save state files
VM introspection

Question 150

Mitigations for nonstandard port usage

Answer 150

Configure firewalls to allow only whitelisted ports to communicate on ingress/egress interfaces
Config documentation should also show which server ports are allowed on any given host type
Configure detection rules to alert on mismatched protocol usage over a standard port

Question 151

Sysinternals

Answer 151

Suite of tools designed to assist with troubleshooting issues with Windows
Many of these tools are suited to investigating security issues

Question 152

VM Introspection (VMI)

Answer 152

Uses tools installed to the hypervisor to retrieve pages of memory for analysis

Question 153

Staging Areas

Answer 153

Place where an adversary begins to collect data in preparation for exfiltration. Data is often compressed and encrypted.
Temp files or folders
User profile locations
Data masked as logs
Alternate Data Streams

Question 154

How can you detect and mitigate against a pass the hash attack?

Answer 154

Detecting these attacks can be very difficult as it can’t be differentiated from legitimate authentication
Most AV will block tools that allow this such as Mimikatz
Restrict and protect high privileged accounts (Domain admin, local admin)
Restrict inbound traffic to workstations using firewall

Question 155

The Five Data Breach Categories

Answer 155

Data Exfiltration
Insider Data Exfiltration
Device Theft/Loss
Accidental Data Breach
Integrity/Availability Breach (corruption of data, destruction of system, etc)

Question 156

who

Answer 156

Linux command that displays a list of users who are currently logged into the computer

Question 157

Service Analysis Tools for Windows

Answer 157

Tools that can help identify suspicious service activity even when antimalware fails to identify it
Task Manager
Windows Services Manager (services.msc)
net start (command line)
Get-Service (Powershell)

Question 158

net stat

Answer 158

Windows command to start a network service or list running network services.

Question 159

Abnormal Process Behavior

Answer 159

Indicators that a legitimate process has been corrupted with malicious code
Process making changes to registry file without permission
Accessing data files in temp locations
Using the network for malicious activity

Question 160

Data Plane

Answer 160

Responsible for:
Forwarding traffic
Encrypting traffic
NAT
Filtering traffic with ACLs

Question 161

Control Plane

Answer 161

Makes decisions about how traffic should be prioritized and secured, and where it should be switched

Question 162

Management Plane

Answer 162

Monitors traffic conditions and network status

Question 163

Certificate Management

Answer 163

Install, update, validate trusted root certificates
Deploying, updating, revoking subject certificates
Preventing use of self-signed certificates
SSH Key Management

Question 164

certutil

Answer 164

Windows utility that allows you to display certificate authority configuration info, configure certificate services, verify certificate’s key pair and certificate chains

Question 165

OpenSSL

Answer 165

Library of software functions supporting the SSL/TLS protocol
Has commands to create/view digital certificates, generate private keys, test TLS/SSL functions

Question 166

CIS

Answer 166

Center for Internet Security
Not-for-profit org that publishes well-known “Top 18 Critical Security Controls”

Question 167

What are the five most critical security controls on the CIS Top 18?

Answer 167

1- Inventory and control of authorized devices
2- Inventory and control of authorized software
3- Data protection
4- Secure configuration of assets and software
5- Account management

Question 168

CPE

Answer 168

Common Platform Enumeration
Scheme for identifying hardware devices, operating systems, and applications

Question 169

CAPEC

Answer 169

Common Attack Pattern Enumeration and Classification
Knowledge base maintained by MITRE

Question 170

How can you mitigate a DDoS attack?

Answer 170

Real time log analysis to ID suspicious traffic and redirect to sinkhole or black hole
Use geolocation/IP reputation data to redirect/ignore suspicious traffic
Aggressively close slower connections by reducing timeouts on affected servers
Use caching and backend infrastructure to offload processing to other servers
Utilize enterprise DDoS protection services

Question 171

lsof

Answer 171

Linux tool that retrieves a list of all files currently open on the OS
Quickly get a list of all resources a process is currently using

Question 172

When to investigate a process

Answer 172

Don’t recognize process name
Name similar to legit process (scvhost vs svchost)
Appears without an icon, version info, description, company name
Unsigned, especially if it claims to be from a well known company
Digital signature doesn’t match identified publisher
Doesn’t have parent/child relationship with principal Windows process
Hosted by utilities like Explorer, Notepad, Task Manager, etc
Packed or compressed (highlighted purple in Process Explorer)

Question 173

Windows Registry

Answer 173

Contains info that Windows continually references during operation, which is necessary info for configuration:
User profiles
Installed applications
Types of documents users/apps can create
Hardware on system
Ports being used

Question 174

Code review

Answer 174

Process of peer review of uncompiled source code by other developers

Question 175

Malware injection on Windows vs on Linux

Answer 175

Windows- shimmed/injected into a host process by making it load the malicious code as a DLL
Linux- often injected into Shared Objects (.so files)

Question 176

Vulnerability reports should include both ____ and ____ on the target network

Answer 176

Physical hosts AND virtual hosts

Question 177

TLS

Answer 177

Transport Layer Security (TLS) is a widely adopted security protocol designed to facilitate privacy and data security for communications over the internet. A primary use case of TLS is encrypting the communication between web applications and servers, such as web browsers loading a website.

Question 178

SSL

Answer 178

Secure Sockets Layer; all three versions are considered obsolete and insecure

Question 179

GPO

Answer 179

Group Policy Object
A group policy is used to manage Windows systems in a Windows network domain environment utilizing a Group Policy Object (GPO). GPOs can include many settings related to credentials, such as password complexity requirements, password history, password length, and account lockout settings. You can force a reset of the default administrator account password by using a group policy update.

Question 180

An analyst suspects that a trojan has victimized a Linux system. Which command should be run to determine where the current bash shell is being executed from on the system?

Answer 180

which bash
By executing the “which bash” command, the system will report the file structure path to where the bash command is being run. If the directory where bash is running is different from the default directory for this Linux distribution, this would indicate a compromised machine.

Question 181

What DLP remediation quarantines and replaces the original file with one describing the policy violation and how the user can release it?

Answer 181

Tombstone

Question 182

eFuse

Answer 182

Intel-designed mechanism to allow software instructions to blow a transistor in the hardware chip. One use of this is to prevent firmware downgrades, implemented on some game consoles and smartphones. Each time the firmware is upgraded, the updater blows an eFUSE. When there is a firmware update, the updater checks that the number of blown eFUSEs is not less than the firmware version number.

Question 183

The Seven Phases of Waterfall Method

Answer 183

planning
requirements
design
implementation
testing
deployment
maintenance

Question 184

Which term defines the collection of all points from which an adversary could interact with a system and cause it to function in a way other than how it was designed?

Answer 184

Attack Surface

Question 185

What is the best mitigation against an adversary using covert channels?

Answer 185

Advanced IDS and user behavior analytics tools are the best option, but they will not detect everything

Question 186

Covert storage channel

Answer 186

A system feature that enables one system entity to signal information to another entity by directly or indirectly writing a storage location that is later directly or indirectly read by the second entity

Question 187

What is the best mitigation against data exfiltration?

Answer 187

Strong encryption of data both at rest and in transit

Question 188

Service Analysis Tools for Linux

Answer 188

cron
systemctl
ps
top

Question 189

Session Layer

Answer 189

Layer 5
Establishes connection between source and destination
Data divided into packets
Sessions are unique- data cannot travel across different sessions

Question 190

How does a Golden Ticket attack work?

Answer 190

Attacker accesses NTDS.DIT
Attacker dumps NTDS.DIT, exposing krbtgt
Uses krbtgt to craft Golden Ticket
Uses Golden Ticket to assume admin rights

Question 191

PsExec

Answer 191

Tool developed for sys admins as alternative to Telnet and other remote access services. Can be used by attackers for privilege escalation

Question 192

What are some IoCs that a C2 server is using DNS as a communication channel?

Answer 192

Same query repeated several times when a bot is checking into a control server for more orders
Commands sent within request or response queries will be longer and more complicated than normal
Atypical query types being used (TXT, MX, CNAME, NULL)

Question 193

SPI

Answer 193

Sensitive Personal Information (opinions, beliefs, etc)

Question 194

File System Viewer

Answer 194

Tool that allows you to search the file system for keywords quickly, including system areas such as Recycle Bin, NTFS shadow copy and system volume information

Question 195

Port Forwarding as used by an attacker

Answer 195

Attacker uses a host as a pivot and is then able to access one of its open TCP/IP ports to send traffic to a port of a host on a different subnet

Question 196

What is one of the best mitigation techniques to prevent rogue devices on a network?

Answer 196

Use digital certificates on endpoints and servers to authenticate, and encrypt traffic using IPSec or HTTPS

Question 197

How can SSH be used to pivot by attackers

Answer 197

Using the -D flag sets up a local proxy and port forwarding
Attackers can chain proxy servers together in order to continue pivoting from host to host until they reach a mission critical host or server

Question 198

df

Answer 198

Linux tool that retrieves how much disk space is being used by all mounted file systems and how much space is available for each

Question 199

du

Answer 199

Linux tool that enables you to retrieve how much disk space each directory is using based on the specific directory

Question 200

dir

Answer 200

Windows command with some advanced functionality for file system analysis

Question 201

dir /A(x)

Answer 201

Filters all file/folder types that match (x), such as dir /AH displays only hidden files and folders

Question 202

dir /Q

Answer 202

Shows who owns each file in addition to standard info

Question 203

dir /R

Answer 203

Displays alternate data streams for a file

Question 204

Network IoCs

Answer 204

Port scanning or sweeps
Non standard port usage
Covert channels
Rogue Devices
Traffic Spikes

Question 205

nc

Answer 205

netcat
Swiss Army Knife of network administration
Made for reading from or writing to network connections
Port scanning
Remote administration
File transfer
Attackers can use for port listening or to create a backdoor

Question 206

Pass the Hash

Answer 206

Network based attack where the attacker steals hashed user credentials and uses them as-is to try to authenticate to the same network the hashes came from
Attacker could obtain cached hash of local admin that had previously signed in and use this hash for privilege escalation
Only works if hash is stored on target system (user has signed in there before)

Question 207

How would you mitigate code injection against a web server?

Answer 207

Install a WAF to analyze inbound requests

Question 208

Compliance scans

Answer 208

Scan based on compliance template or checklist
Ensure controls and configuration settings are properly applied to a given host

Question 209

Full/Deep Assessment Scan

Answer 209

Comprehensive scan that forces the use of more plug-in types. Takes longer and there’s higher risk of causing service disruption

Question 210

Fast/Basic Assessment Scan

Answer 210

Analyzes hosts for unpatched software vulnerabilities and configuration issues

Question 211

ANN

Answer 211

Artificial Neural Network

Question 212

Data Enrichment

Answer 212

Process of incorporating new updates and information to an organization’s existing database to improve accuracy

Question 213

SOAR

Answer 213

Security Orchestration Automation and Response
Security tools that facilitate incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment
Primarily used for incident response

Question 214

Next-Gen SIEM

Answer 214

SIEM with an integrated SOAR

Question 215

Playbook

Answer 215

Checklist of actions to perform to detect and respond to a specific type of incident

Question 216

Runbook

Answer 216

Automated version of a playbook that leaves clearly defined interaction points for human analysis

Question 217

Data Owner

Answer 217

Senior executive w/ ultimate responsibility for maintaining CIA of the information asset

Question 218

Data Custodian

Answer 218

Role responsible for handling the management of the system on which the data assets are stored

Question 219

Privacy Officer

Answer 219

Responsible for the oversight of any PII/SPI/PHI assets managed by the company

Question 220

Trusted Foundry

Answer 220

Microprocessor manufacturing utility that is part of a validated supply chain (one where hardware and software does not deviate from its documented function)

Question 221

Trusted Firmware Updates

Answer 221

Firmware update that is digitally signed by the vendor and trusted by the system before installation

Question 222

What two strategies are the most effective in reducing the risk to an embedded ICS from a network-based compromise?

Answer 222

Segmentation
Disabling unused services

Question 223

You have been asked to conduct a forensic disk image on an internal 500 GB hard drive. You connect a write blocker to the drive and begin to image it using dd to copy the contents to an external 500 GB USB hard drive. Before completing the image, the tool reports that the imaging failed. What is most likely the reason for the image failure?

Answer 223

There are bad sectors on the destination drive

Question 224

grep -i

Answer 224

Treats the specified search pattern as case insensitive

Question 225

IdP

Answer 225

Identity Provider
Provides the validation of the user’s identity when using SAML for authentication

Question 226

You just finished conducting a remote scan of a class C network block using the following command “nmap -sS 202.15.73.0/24”. The results only showed a single web server. What technique would allow you to gather additional information about the network?

Answer 226

Perform a scan from on-site
If the organization’s network is set up correctly, scanning from off-site will be much more difficult as many of the devices will be hidden behind the firewall. By conducting an on-site scan, you can conduct the scan from behind the firewall and receive more detailed information on the various servers and services running on the internal network.

Question 227

Rory is about to conduct forensics on a virtual machine. What process should he conduct to ensure that all of the data is acquired forensically?

Answer 227

Suspend the machine and copy the contents of the directory it resides in

Question 228

What are the UEFI boot phases?

Answer 228

SEC- Security
PEI- Pre-EFI Initialization
DXE- Driver Execution Environment
BDS- Boot Device Select
TSL- Transient System Load
RT- Runtime

Question 229

Securing Management Interfaces on a Network

Answer 229

Should only be exposed to an isolated or dedicated network used for management and configuration

Question 230

What are the two most important factors when determining a containment strategy?

Answer 230

Ensuring the safety and security of all personnel
Prevent further exfiltration of data or prevent the ongoing intrusion from spreading

Question 231

Purging

Answer 231

Eliminates information from being feasibly recovered even in a laboratory environment
Includes degaussing, encryption of data with the destruction of its encryption key, and other non-destructive techniques

Question 232

Why is a beacon’s protocol not typically used as a means of identifying a malware beacon?

Answer 232

A beacon can be sent over numerous protocols, including ICMP, DNS, HTTP, and numerous others. Unless you specifically knew the protocol being used by the suspected beacon, filtering out beacons by the protocol seen in the logs could lead you to eliminate malicious behavior prematurely.

Question 233

Private IP address ranges

Answer 233

10.x.x.x
172.16-31.x.x
192.168.x.x

Question 234

Once law enforcement is involved in an event, _________

Answer 234

Admins and analysts should not perform any actions on the network until they receive law enforcement guidance
Employees should receive guidance from law enforcement on what they should and should not say to people outside of the investigation

Question 235

War walking

Answer 235

Walking around a building while attempting to locate wireless networks and devices

Question 236

Banner Grabbing

Answer 236

Attacker establishes a connection with a remote machine first (telnet, nc, proprietary connection)
Then sends a bad request
Causes a vulnerable host to respond with a banner message that reveals compromising information such as OS type, software version, etc

Question 237

Which technology can degrade an adversary’s effort during the C2 phase of the kill chain?

Answer 237

NIPS would either shut it down or block it

Question 238

Cybersecurity analysts are experiencing some issues with their vulnerability scans aborting because the previous day’s scans are still running when the scanner attempts to start the current day’s scans. What could help resolve the issue?

Answer 238

Reduce the frequency of scans (once every 48 hours, once every week)
Reduce the scope of scans (scan less systems or vulnerability signatures)
Add additional vulnerability scanners to the process

Question 239

Adversarial Attack Vectors according to MITRE

Answer 239

Cyber- use of hardware or software IT systems
Human- social engineering, coercion, impersonation, force
Physical- gaining local access

Question 240

Jumpbox

Answer 240

System on a network used to access and manage devices in a separate security zone

Question 241

What method should a cybersecurity analyst use to locate any instances on the network where passwords are being sent in cleartext?

Answer 241

Full packet capture

Question 242

You have installed multiple VMs on a single physical server. You need to ensure that the traffic is logically separated between each VM. How can you implement this requirement?

Answer 242

Configure a virtual switch on the physical server and create VLANs

Question 243

What type of malware changes its binary pattern in its code on specific dates or times to avoid detection by antimalware software?

Answer 243

Polymorphic virus

Question 244

You have reason to believe that systems on the network have been compromised by an APT. You’ve noticed many file transfers outbound to a remote site via TLS-protected HTTPS sessions from unknown systems. What technique can be used to detect the APT?

Answer 244

Endpoint forensics

Question 245

Cryptographic Erase

Answer 245

Sanitizes a self-encrypting drive by erasing the media encryption key and then reimaging the drive

Question 246

What is the most efficient way to sanitize a self-encrypting drive?

Answer 246

Perform a cryptographic erase

Question 247

Zero-Fill

Answer 247

Overwrites a storage device by setting all bits to the value of 0 but is not effective on SSDs or Hybrid Drives

Question 248

Bus Encryption

Answer 248

Data is encrypted by an application prior to being placed on the data bus

Question 249

Tokenization

Answer 249

Deidentification method where a unique token is substituted for real data

Question 250

Aggregation/Banding

Answer 250

Deidentification technique where data is generalized to protect the individuals involved
“90% of subjects did not experience side effects”

Question 251

SDLC

Answer 251

Software Development Lifecycle

Question 252

Waterfall Method

Answer 252

Software development model where the phases of the SDLC cascade so that each phase will start only when all tasks from the previous phase are complete

Question 253

Agile Method

Answer 253

Software development model that focuses on iterative and incremental development to account for evolving requirements and expectations

Question 254

OWASP Software Security Assurance Process

Answer 254

Security framework for secure application development

Question 255

Black Box Testing

Answer 255

Blind Testing
Security analyst receives no privileged information about the software

Question 256

BIOS

Answer 256

Basic Input/Output System
The software used to start your computer
Initializes CPU and memory
Conducts a Power on Self Test (POST)
Looks for a boot loader and starts the OS
Tells the computer how to do its most basic functions (handle input from keyboard)

Question 257

UEFI

Answer 257

Unified Extensible Firmware Interface
Defines a software interface between an OS and platform firmware

Question 258

White Box Testing

Answer 258

Full Disclosure Testing
Security analyst receives privileged info about the software such as source code and credentials

Question 259

Gray Box Testing

Answer 259

Security analyst receives partial disclosure of information about software

Question 260

OWASP

Answer 260

Open Web Application Security Project
Charity and community that publishes a number of secure application development resources

Question 261

SANS Institute

Answer 261

Sys Admin, Network, and Security Institute
Company specializing in cybersecurity and secure web application development training
Sponsors GIAC (Global Information Assurance Certification)

Question 262

Arbitrary Code Execution

Answer 262

Vulnerability that allows attacker to run their own code

Question 263

Remote Code Execution

Answer 263

Vulnerability that allows an attacker to transmit code from a remote host for execution on a target host over the internet

Question 264

Buffer

Answer 264

Temporary storage area that a program uses to store data
Think of system memory as a table. There are glasses for water at each spot. Each glass can only contain so much water, and if it exceeds that, it can make a mess on the table. The glasses are buffers.

Question 265

Integer overflow

Answer 265

An attack in which a computed result is too large to fit in its assigned storage space, which may lead to crashing or data corruption, and may trigger a buffer overflow

Question 266

Race Conditions

Answer 266

Software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order/timing intended by the developer

Question 267

TOCTTOU

Answer 267

Time of Check to Time of Use
Potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource

Question 268

RTOS

Answer 268

Real Time Operating System
Prioritizes execution of operations to ensure consistent response for time-critical tasks
For systems that cannot tolerate reboots or crashes and must have response times that are predictable to within microsecond tolerances

Question 269

HMI

Answer 269

Human Machine Interface
Input and output controls on a PLC to allow a user to configure and monitor the system

Question 270

SCADA

Answer 270

Supervisory Control and Data Acquisition
Type of industrial control system that manages large scale, multisite devices and equipment spread over geographic region

Question 271

BAS

Answer 271

Building Automation Systems
Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers

Question 272

CAN

Answer 272

Controller Area Network
Digital serial data communications network used within vehicles

Question 273

Syslog Severity Levels

Answer 273

0- Emergency
1- Alert
2- Critical
3- Error
4- Warning
5- Notice
6- Informational
7- Debug
“Everyone Always Complains Even When Nothing Is Different”

Question 274

HTTP Response Codes- 5xx Range

Answer 274

Server-side issue
500- general error
502- bad gateway has occurred when the server is acting as a proxy
503- overloading of server is causing service unavailability
504- gateway timeout which means there’s an issue with the upstream server

Question 275

A firmware exploit gives an attacker an opportunity to ______

Answer 275

Run any code at the highest level of CPU privilege

Question 276

HSM

Answer 276

Hardware Security Module
High end cryptographic hardware used in large environments
Provides secured backup storage for keys
Uses cryptographic accelerators to offload CPU overhead from other devices

Question 277

ROT

Answer 277

Hardware Root of Trust
TPM and HSM fall into this category
Designed to be difficult to change or avoid

Question 278

What does UEFI do to provide better boot security?

Answer 278

Secure Boot
Measured Boot
Attestation

Question 279

Secure Boot

Answer 279

UEFI checks booting programs for known-good digital signature, will not run it if they don’t match

Question 280

Measured Boot

Answer 280

a feature where a log of all boot actions is taken and stored in a trusted platform module for later retrieval and analysis by anti-malware software on a remote server.

Question 281

Attestation

Answer 281

As part of UEFI, report is digitally signed using TPM’s private key, showing the data presented is valid

Question 282

Atomic Execution

Answer 282

Certain operations that should only be performed once or not at all, such as initializing a memory location

Question 283

SoC (not the team)

Answer 283

System-on-Chip
Type of embedded application commonly used in mobile devices which contains integrated CPU, memory, graphics, audio, network, storage controllers, and software on one chip

Question 284

FPGA

Answer 284

Field Programmable Gate Array
A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture

Question 285

The Magic Number

Answer 285

A type of file signature, the first two bytes of a binary header that indicates its file type

Question 286

WAF

Answer 286

Web Application Firewall
Designed specifically to protect software running on web servers and their backend databases from code injection and DoS attacks
Used to prevent things like injection attacks and XSS

Question 287

UTC

Answer 287

Coordinated Universal Time
A time standard that is useful when your SIEM is collecting data from logs in multiple time zones

Question 288

Behavioral Analysis

Answer 288

Network monitoring stem that detects changes in normal operating data sequences and identifies abnormal sequences
Generates alerts when there are deviations from a defined tolerance level from a given baseline
(Uses customer data)

Question 289

Anomaly Analysis

Answer 289

Network monitoring system that uses a baseline of acceptable outcomes or event patterns to identify events that fall outside of the acceptable range
Generates alerts on any event or outcome that doesn’t follow a set pattern or rule.
(Uses prescribed patterns like an RFC or industry standard)

Question 290

Regex- [ ]

Answer 290

Matches a single instance of a character within
[a-z], [A-Z], [0-9], [a-zA-Z0-9] for alphanumeric characters

Question 291

Regex- +

Answer 291

Quantifier, matches one or more occurrences
Ex- /apples+/ would match apples and applessss

Question 292

Regex- *

Answer 292

Matches zero or more occurrences
Ex- /apples*/ would match apples, applessss but also apple

Question 293

DNS Harvesting

Answer 293

Using OSINT to gather info about a domain, such as subdomains, hosting provider, administrative contacts, etc

Question 294

Regex- |

Answer 294

The OR logical operator

Question 295

Regex- ( )

Answer 295

Defines a group

Question 296

Regex- ^

Answer 296

Will only match at the start of a line when searching

Question 297

Regex- $

Answer 297

Will only match at the end of a line when searching

Question 298

Digital Forensics- Live Acquisition of Disk Image and drawbacks

Answer 298

Capturing contents of disk drive while computer is still running
Contents can be change during acquisition (ex- user is connected remotely and making changes at the same time as investigator)

Question 299

Digital Forensics- Static Acquisition by Shutting Down and drawbacks

Answer 299

Computer shutdown through OS properly and then the disk is acquired
Malware may detect shutdown and perform anti-forensics

Question 300

What command can be used on Linux systems to create a forensic copy? How is it formatted?

Answer 300

dd command- specify input file (if) and output file (of)
dd if =/dev/sda of=/mnt/flashdrive/evidence.dd

Question 301

Scalpel

Answer 301

Open source command line tool for file carving that is used as part of The Sleuth Kit

Question 302

NetFlow

Answer 302

Cisco developed means of reporting network flow information to a structured database
Creates flows and groupings for later review
Provides METADATA not FPC so will not provide a complete record of what happened

Question 303

Intelligence Cycle

Answer 303

Requirements (Planning and Direction)
Collection and Processing
Analysis
Dissemination
Feedback
(repeat)

Question 304

Regex- ?

Answer 304

Matches 0 or 1 occurrences
Ex- /apples?/ would match apple or apples but not applessss

Question 305

UEBA

Answer 305

User and Entity Behavior Analytics
System that can provide automated identification of suspicious activity by user accounts and computer hosts
Compares against baseline data
Heavily reliant on AI or machine learning

Question 306

Regex- { }

Answer 306

Matches the number of times within the curly braces such as
\d{3} matching 3 digits
\d{7-10} matching 7 to10 digits

Question 307

Four Phases of Digital Forensics

Answer 307

Identification
Collection
Analysis
Reporting

Question 308

File Carving

Answer 308

Extracting data from a computer when that data has no associated file system metadata (someone tried to delete it)
Attempts to piece together data fragments from slack space to reconstruct deleted files or at least parts of those files

Question 309

Best practices for securing network appliances

Answer 309

Disable web admin interfaces and use SSH shells for access
Use ACLs to restrict access to designated host devices
Monitor the number of designated interfaces
Deny internet access for remote management (connect to VPN to get on LAN first)

Question 310

Jitter

Answer 310

Adversary’s use of random delay to try and throw off detecting connection attempt intervals. Used in beaconing to C2 servers

Question 311

A cybersecurity analyst is working at a college that wants to increase its network’s security by implementing vulnerability scans of centrally managed workstations, student laptops, and faculty laptops. Any proposed solution must scale up and down as new students and faculty use the network. Additionally, the analyst wants to minimize the number of false positives to ensure accuracy in their results. The chosen solution must also be centrally managed through an enterprise console. What scanning topology would be best able to meet these requirements?

Answer 311

Active scanning engine installed on the enterprise console

Question 312

SNMP Sweep

Answer 312

Scans a range of IP addresses, shows which IP addresses are in use, and provides the following information: DNS name. System Name. Location.

Question 313

An SNMP sweep is being conducted, but the sweep receives no-response replies from multiple addresses that are believed to belong to active hosts. What does this indicate to a cybersecurity analyst?

Answer 313

This could mean:
The machines are unreachable
The community string being used is invalid
The machines are not running SNMP servers

Question 314

You analyze a workstation suspected of being involved in an incident and discover several unknown processes running, but netflow analysis reveals no attempted lateral movement to other workstations on the network. Which containment strategy would be most effective to use in this scenario?

Answer 314

Isolate the workstation by disabling the switch port and resetting the user’s credentials
Workstation should be imaged for analysis and then remediated or reimaged

Question 315

During which incident response phase is the preservation of evidence performed?

Answer 315

Containment, eradication, and recovery

Question 316

Which of the following is the most difficult to confirm with an external vulnerability scan?
Unpatched web server
CSRF
Blind SQL Injection
XSS

Answer 316

Blind SQL injection

Question 317

DEP

Answer 317

Data Execution Prevention
Windows built-in memory protection resource
This prevents code from being run in pages that are marked as nonexecutable. DEP, by default, only protects Windows programs and services classified as essential, but it can be used for all programs and services, or all programs and services except the ones on an exception list.

Question 318

Why is reverse engineering used?

Answer 318

To determine how a piece of malware operates
To allow an attacker to spot vulnerabilities in an executable
To commit industrial espionage

Question 319

secpol.msc

Answer 319

Security policy auditor in Windows

Question 320

sc.exe

Answer 320

Service controller

Question 321

Jorge and Marta are working on a programming project together. During a code review, Marta explains her code to Jorge while looking at the code on her computer. What code review technique is being used?

Answer 321

Over the shoulder

Question 322

Pair programming

Answer 322

Alternates between programmers, with one strategizing and reviewing it while the other enters the computer’s code

Question 323

Reviewing DNS logs, you see output for several domains that look like a random string of characters. What could be happening here?

Answer 323

Fast flux DNS is being used for an attacker’s C2

Question 324

You are conducting a quick nmap scan of a target network. You want to conduct an SYN scan, but you don’t have raw socket privileges on your workstation. What should you use instead?

Answer 324

nmap -sT (TCP connect scan)

Question 325

Cognitive password

Answer 325

a form of knowledge-based authentication that requires a user to answer a question, presumably something they intrinsically know, to verify their identity (high scool, pet’s name, etc)

Question 326

While studying for your CompTIA CySA+ course at Dion Training, you decided to install a SIEM to collect data on your home network and its systems. You do not want to spend any money purchasing a license, so you decide to use an open-source option instead. Which SIEM solution uses an open-source licensing model?

Answer 326

OSSIM

Question 327

Aymen is creating a procedure for the remediation of vulnerabilities discovered within his organization. He wants to ensure that any vendor patches are tested before deploying them into the production environment. What type of environment should his organization establish?

Answer 327

Staging

Question 328

tcpdump -e

Answer 328

Includes the ethernet header during packet capture

Question 329

What utilizes a well-written set of carefully developed and tested scripts to orchestrate runbooks and generate consistent server builds across an enterprise?

Answer 329

Infrastructure as Code

Question 330

What proprietary tool is used to create forensic disk images without making changes to the original evidence?

Answer 330

FTK Imager

Question 331

DES

Answer 331

A cipher that is outdated and should not be used for any modern applications

Question 332

You see the following in a user’s terminal history:

for i in seq 255; ping -c 1 10.1.0.$i; done

What action was performed?

Answer 332

User conducted a ping sweep of the subnet

Question 333

What protocol is commonly used to collect information about CPU utilization and memory usage from network devices?

Answer 333

SNMP

Question 334

You are conducting a code review of a program and observe the calculation of 0xffffffff + 1 was attempted, but the result was returned as 0x0000000. Based on this, what type of exploit could be created against this program?

Answer 334

Integer overflow attack

Question 335

getfacl

Answer 335

Allows backups of directories to include permissions, saved to a text file.

Question 336

setfacl

Answer 336

Used to restore the permissions from the backup created.

Question 337

What technique would best mitigate malware that utilizes a fast flux network for its command and control infrastructure?

Answer 337

Utilize a secure recursive DNS resolver to a third-party secure DNS resolver

Question 338

What kind of information would a French citizen’s race or ethnic origin classify as?

Answer 338

SPI

Question 339

You have been hired as a cybersecurity analyst for a privately-owned bank. Which regulation would have the greatest impact on your bank’s cybersecurity program?

Answer 339

GLBA

Question 340

Technical View

Answer 340

Focuses on technologies, settings, and configurations

Question 341

Operational View

Answer 341

Looks at how a function is performed or what it accomplishes

Question 342

Logical View

Answer 342

Describes how systems interconnect

Question 343

SIFT

Answer 343

SANS Investigative Forensics Toolkit
Group of free, open-source incident response and forensic tools designed to perform detailed digital forensic examinations in various settings.

Question 344

FTK, EnCase, and Helix are _________

Answer 344

COMMERCIALLY AVAILABLE forensics tools

Question 345

Which nmap scan type is useful for probing firewall rules?

Answer 345

TCP ACK
Whether ports are open or closed, the target is required to respond with an RST packet. Firewalls that block the probe usually make no response or send back an ICMP destination unreachable error. This distinction allows Nmap to report whether the ACK packets are being filtered.

Question 346

A web developer wants to protect their new web application from an on-path attack. What control would best prevent an attacker from stealing tokens stored in cookies?

Answer 346

Setting the secure attribute on the cookie
When a cookie has the Secure attribute, the user agent includes the cookie in an HTTP request only if transmitted over a secure channel (typically HTTPS).

Question 347

net view

Answer 347

Displays a list of domains, computers, or resources that are being shared by the specified computer. Used without parameters, net view displays a list of computers in your current domain.

Question 348

Who does a User-Agent request a resource from when conducting a SAML transaction?

Answer 348

Service Provider (SP)

Question 349

Formal Verification Methods

Answer 349

Use a mathematical model of the inputs and outputs of a system to prove that the system works as specified in all cases.

Question 350

What two technologies could be used to ensure that users who log in to a network are physically in the same building as the network they are attempting to authenticate on?

Answer 350

GPS Location
NAC

Question 351

What analysis technique would most likely identify a buffer overflow vulnerability in an application during development?

Answer 351

Static Code Analysis

Question 352

Deperimeterization

Answer 352

A strategy that strengthens an organization’s security posture by implementing multiple levels of protection, including inherently secure computer systems and protocols, high level encryption, and authentication. Called such since it implies the organization no longer relies on its network perimeter for security.
Essentially instead of walled cities we have a heavier police presence

Question 353

An attacker has compromised a virtualized server. You are conducting forensic analysis as part of the recovery effort but found that the attacker deleted a virtual machine image as part of their malicious activity. What challenge do you now have to overcome as part of the recovery and remediation efforts?

Answer 353

The attack widely fragmented the image across the host file system

Question 354

CVSS Attack Vector: A

Answer 354

Adjacent
Attacker must launch the attack from the same shared physical (such as Bluetooth or Wi-Fi network), logical network (such as a local subnet), or a limited administrative domain (such as a VPN or MPLS)

Question 355

Shawn needs to boot a system to remediate it. The system was compromised by an attack and had a malicious program installed by creating a RunOnce key in the registry. What can Shawn do to boot the computer and prevent the RunOnce from executing the malicious program listed in the registry key?

Answer 355

Boot with Safe Mode

Question 356

Safe Mode

Answer 356

When booting in Safe Mode, Run and RunOnce are ignored by the Windows system.

Question 357

Tripwire

Answer 357

File integrity monitoring program

Question 358

%3A

Answer 358

Hex-code for :

Question 359

Hashing algorithms provide ________ while encryption algorithms can ensure ___________

Answer 359

Hashing algorithms provide INTEGRITY while encryption algorithms can ensure CONFIDENTIALITY

Question 360

Slack Space

Answer 360

Slack space is the space left after a file has been written to a cluster. Slack space may contain remnant data from previous files after the pointer to the files was deleted by a user.

Question 361

Files that users have deleted are most likely to be found in the _____ or _______

Answer 361

Recycle bin or slack space

Question 362

Regex .

Answer 362

Wildcard- any single character except newline

Question 363

Regex \

Answer 363

Escape the next character- only used with metacharacters
Example- if you wanted to treat a . as a period and not as a wildcard you’d use .

Question 364

Regex \t

Answer 364

This is how to express a tab in Regex

Question 365

Regex \n

Answer 365

This is how to express a new line in Regex

Question 366

Regex- how to negate a character set

Answer 366

Add ^ as the first character inside a character set
Ex- /[^aeiou]/ matches any one consonant
Ex- /see[^mn]/ would match seek, but not seem or seen

Question 367

Regex \d

Answer 367

Digit, equivalent of [0-9]

Question 368

Regex \w

Answer 368

Word character, equivalent of [a-zA-Z0-9_]

Question 369

Regex \s

Answer 369

Whitespace, equivalent of [\t\n]

Question 370

Regex \D

Answer 370

Exclude digits [^0-9]

Question 371

Regex \W

Answer 371

Exclude word characters [^a-zA-Z0-9_]

Question 372

Regex \S

Answer 372

Exclude whitespace [^\t\n]

Question 373

As part of the recon stage of a penetration test, Kumar wants to retrieve info about an organization’s network infrastructure without causing an IPS alert. What is his best course of action?

Answer 373

Perform a DNS brute force attack. This queries a list of IPs and typically bypasses IPS systems that do not alert on DNS queries.

Question 374

Your organization’s primary operating system vendor just released a critical patch for your servers. Your system administrators have recently deployed this patch and verified the installation was successful. This critical patch was designed to remediate a vulnerability that can allow a malicious actor to execute code on the server over the Internet remotely. You ran a vulnerability scan of the network and determined that all servers are still being reported as having the vulnerability. You verified all your scan configurations are correct. Why might the scan report still show the servers as vulnerable?

Answer 374

The scan is returning a false positive
The critical patch did not remediate the vulnerability

Question 375

Data retention policies highlight _____ and _____.

Answer 375

The types of information an organization will maintain
The length of time they will maintain it

Question 376

According to Lockheed Martin’s white paper “Intel Driven Defense,” what technology could DEGRADE an adversary’s effort during the actions on the objectives phase of the kill chain?

Answer 376

Purposely manipulating service quality to decrease their transfer speeds

Question 377

You have been asked to review the SIEM event logs for suspected APT activity. You have been given several indicators of compromise, such as a list of domain names and IP addresses. What is the BEST action to take to analyze the suspected APT activity?

Answer 377

Analyze the trends of the events while manually reviewing them to see if any indicators match

Question 378

What phase of the software development lifecycle is sometimes known as the acceptance, installation, and deployment phase?

Answer 378

Training and transition

Question 379

What is the default nmap scan type when you do not provide a flag when issuing the command?

Answer 379

A TCP SYN scan, though it substitutes a connect scan if the user does not have proper privileges to send raw packets.

Question 380

By default, what file contains an Apache server’s logs?

Answer 380

access_log

Question 381

James is working with the software development team to integrate real-time security reviews into some of their SDLC processes. Which programming methodology would best meet this requirement?

Answer 381

Pair programming, as it utilizes two developers working on one workstation, where one developer reviews the code being written in real-time by the other developer.

Question 382

Your company is adopting a cloud-first architecture model. Management wants to decommission the on-premises SIEM your analysts use and migrate it to the cloud. What is an issue with using this approach?

Answer 382

If there are legal or regulatory requirements that require the company to host their security audit data on-premises, then moving to the cloud will not be possible without violating applicable laws. For example, some companies must host their data within their national borders, even if migrating to the cloud.

Question 383

The three phases of the vulnerability management lifecycle

Answer 383

Detection, remediation, testing

Question 384

An employee contacts the service desk because they cannot open an attachment they receive in their email. The service desk agent conducts a screen-sharing session with the user and investigates the issue. The agent notices that the attached file is named Invoice1043.pdf, and a black pop-up window appears and then disappears quickly when the attachment was double-clicked. What most likely caused this?

Answer 384

The attachment is using a double file extension to mask its identity

Question 385

Where should a forensic analyst search to find a list of the wireless networks that a laptop has previously connected to with a company-owned laptop?

Answer 385

Search the registry for a complete list

Question 386

_____ integrate more than one form of attack to accomplish their goal.

Answer 386

Chained exploits

Question 387

An organization wants to choose an authentication protocol that can be used over an insecure network without implementing additional encryption services. What should they use?

Answer 387

Kerberos

Question 388

Regex ? when used with a Quantifier

Answer 388

Instructs Quantifier to use a lazy strategy for making choices, ie match as little as possible before giving control to the next expression part

Question 389

How would you use the tcpdump command to create a packet capture filter for all traffic going to AND from the server located at 10.10.1.1?

Answer 389

tcpdump -i eth0 host 10.10.1.1
The host option specifies a filter to capture ALL traffic to or from a designated IP address

Question 390

You are analyzing a Linux server that you suspect has been tampered with by an attacker. You went to the terminal and typed “history” and see the output:
echo 127.0.0.1 diontraining.com&raquo_space; /etc/hosts

What actions were performed?

Answer 390

The attacker routed traffic destined for the diontraining.com domain to the localhost

Question 391

Linux permissions are read as _____, _______, ______ when expressed numerically

Answer 391

Owner, group, other

Question 392

Linux numerically expressed permissions

Answer 392

Read = 4
Write = 2
Execute = 1

Question 393

%40

Answer 393

Hex code for @ symbol

Question 394

When using the netstat command during analysis, what connection status message indicates that an active connection is created between two systems?

Answer 394

ESTABLISHED

Question 395

What is the default macOS file system for the drive?

Answer 395

HFS+
Hierarchical File System Plus

Question 396

DKIM

Answer 396

Domain Keys Identified Mail
Provides a cryptographic authentication mechanism that can replace or supplement SPF. Organization uploads a public key as a TXT record in the DNS server

Question 397

SPF

Answer 397

Sender Policy Framework
Uses a DNS record published by an organization hosting an email service. The SPF record identifies the host authorized to send emails from that domain and there must be only one per domain. SPF does not provide a cryptographic authentication mechanism like DKIM does though.

Question 398

DMARC

Answer 398

Domain Based Massage Authentication, Reporting and Conformance Framework
Can ensure that SPF and DKIM are being utilized effectively. DMARC relies on DKMI for the cryptographic authentication mechanism.

Question 399

NAC

Answer 399

Network Access Control
An approach to computer security that attempts to unify endpoint security technology (such as antivirus, host intrusion prevention, and vulnerability assessment), user or system authentication, and network security enforcement.
When a remote workstation connects to the network, NAC will place it in into a segmented portion of the network, scan it for malware and validate its security controls, and then based on the results of those scans either connect it to the company’s networks or place the workstation into a separate quarantined portion of the network for further remediation.

Question 400

Hybrid password attack

Answer 400

Combining the dictionary and brute force methods into a single tool

Question 401

nbtstat -c

Answer 401

Shows the contents of the NetBIOS name cache and shows a list of name to IP address mappings

Question 402

Which sources are most commonly used to gather information about technologies a target organization uses during intelligence gathering?

Answer 402

OSINT searches of support forums and social engineering

Question 403

Regex ()

Answer 403

Creates a group
(abc) would match abcdefg
(abc)+ would match both abc and abcabcabc
(in)?dependent would match independent and dependent

Question 404

Data Wiping/Clearing

Answer 404

Occurs by using a software tool to overwrite the data on a hard drive to destroy all electronic data on a hard disk or other media

Question 405

Which technique would provide the largest increase in security on a network with ICS, SCADA, and IoT devices?

Answer 405

User and entity behavior analytics to establish baseline behavior

Question 406

Port 515

Answer 406

Print services, listening for incoming connections

Question 407

Port 631

Answer 407

IPP- Internet Printing Protocol

Question 408

Port 9100

Answer 408

Printer related

Question 409

Ports 1433 and 1434

Answer 409

Microsoft SQL

Question 410

Port 1521

Answer 410

Oracle database

Question 411

Port 6667

Answer 411

IRC

Question 412

Port 5900

Answer 412

VNC desktop sharing

Question 413

Port 3306

Answer 413

MySQL

Question 414

Port 8443

Answer 414

Common alt port for HTTPS

Question 415

Ports 1812 and 1813

Answer 415

RADIUS

Question 416

Ports 544 and 2105

Answer 416

Kerberos

Question 417

PCI DSS requires that merchants and service providers present a clean scan results that shows no ____________ in order to maintain compliance.

Answer 417

Critical or high vulnerabilities

Question 418

Why are banner grabbing scans notorious for resulting in false positive reports?

Answer 418

The only validation they do is check the version number of an operating system or application against a list of known vulnerabilities. This approach is unable to detect any remediation activities that may have taken place that do not alter the version number.

Question 419

You are conducting the recovery process after your organization experienced a security incident. You plan to apply patches to all systems in the environment. Which systems should be your highest priority for patching?

Answer 419

Systems involved in the incident

Question 420

The Windows Registry, Master File Tables, and INDX files all contain ______, including _______

Answer 420

Information about files
Removed or deleted files

Question 421

What does the nmap response “filtered” mean in port scan results?

Answer 421

nmap cannot tell whether the port is open or closed

Question 422

What is the minimum scanning requirement for environments subject to HIPAA?

Answer 422

No scanning is required, though you should do it anyway

Question 423

Continuous Scanning

Answer 423

Configuring vulnerability scanner to start a new scan immediately after the prior scan completes

Question 424

What is the most useful metric for determining the effectiveness of a vulnerability remediation program?

Answer 424

Time to resolve critical vulnerabilities

Question 425

Shadow Rules

Answer 425

A rule that will never trigger because it is placed beneath a broader rule. Example- rule 1 allows any traffic over the internet to ports 80 or 443. Rule 2 is listed below it and is meant to block any traffic to Blocked hosts but since rules trigger in order, it won’t fire.
Rule 1: allow TCP any (source) any (ports) Internet (destination network) 80, 443 (destination ports)
Rule 2: deny TCP any (source) any (ports) Blocked_Hosts (dest) 80, 443 (dest ports)

Question 426

After finishing a forensic case, you need to wipe the media that you are using to prepare it for the next case. What method is best suited to preparing the hard drive if you want to be in compliance with NIST SP 800-88?

Answer 426

Zero-write the device

Question 427

On Linux systems that use the Bash shell, where can you find a log of recently performed actions?

Answer 427

$home/.bash_history

Question 428

During the analysis of an incident on the network you discover that the attacker used a stolen cookie to access a web application. What type of attack most likely occurred?

Answer 428

Session hijacking

Question 429

During a recon exercise, Mika uses the following command:
nc -v 10.0.2.9 8080
www.example.com [10.0.2.9] 8080 (http-alt) open
GET / HTTP/1.0

What is she doing?

Answer 429

HTTP Banner grabbing using netcat

Question 430

netcat -z

Answer 430

Used for port scanning when a better port scanning tool is unavailable

Question 431

Open redirect attack

Answer 431

An open redirect vulnerability occurs when an application allows a user to control a redirect or forward to another URL. If the app does not validate untrusted user input, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker’s phishing site.

Question 432

Where in a Linux system can you look to find information on when users were created?

Answer 432

/var/log/auth.log

Question 433

nmap -P0

Answer 433

Turns off pings

Question 434

nmap -T

Answer 434

Set scan timing
-T0 “paranoid”
-T1 “sneaky”

Question 435

A log showing a successful user authentication is classified as what type of occurrence according to NIST?

Answer 435

An event- anything that is an observable occurrence

Question 436

MISP

Answer 436

Malware Information Sharing Platform
An open source threat information platform used to facilitate the collection and sharing of threat information

Question 437

OpenCTI

Answer 437

An open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It is a platform meant for processing and sharing knowledge for cyber threat intelligence purposes.

Question 438

Snort

Answer 438

Open source, rule based NIDS/NIPS

Question 439

Snort rule format

Answer 439

Action, Protocol, Source IP, Source Port, Direction (unidirectional or bidirectional), Destination IP, Destination Port, Options

Question 440

Snort rule actions

Answer 440

Alert
Log
Drop
Reject

Question 441

Snort rule protocol options

Answer 441

IP, TCP, UDP and ICMP
To specify other protocols you’d do it by port number

Question 442

Snort rule Msg field

Answer 442

Quick identifier of the rule that will appear in the console/log. Usually a one liner that summarizes the event.

Question 443

Snort SID

Answer 443

Snort Rule ID
<100- Reserved rules
100-999,999- rules that come with the build
>=1,000,000- rules created by user

Question 444

Snort rule reference

Answer 444

Each rule can have additional information or reference to explain the purpose of the rule or threat pattern. That could be a common vulnerabilities and exposures ID or external information. Having references for the rules will always help analysts during the alert and incident investigation.

Question 445

Snort rule rev

Answer 445

Snort rules can be modified and updated for performance and efficiency issues. Rev option help analysts to have the version information of each rule. Therefore it will be easy to understand rule improvements.

Question 446

Snort rule content option

Answer 446

Payload data. It matches specific payload data by ASCII, hex, or both. It is possible to use this option multiple times in a single rule. However, the more you create specific pattern match features, the more it takes time to investigate a packet.

Question 447

Snort rules- how to disable case sensitivity

Answer 447

Use the nocase option

Question 448

Snort rules- how to filter SYN, ACK, FIN, etc

Answer 448

Use the flags option. Example for SYN:
alert tcp any any <> any any (msg: “FLAG TEST”; flags:S; sid: 1000001; rev:1;)

Question 449

Snort rules- how to filter by packet payload size

Answer 449

Use the dsize option. Examples:
dsize:100<>300
dsize:>100
dsize:<100

Question 450

Where are Snort rules that you create stored?

Answer 450

/etc/snort/rules/local.rules

Question 451

SQL injection is prevented through ___ and ____

Answer 451

input validation
least privilege

Question 452

Credential Stuffing

Answer 452

Brute force attack where stolen credentials are tested against multiple websites

Question 453

Directory traversal using percent encoding

Answer 453

%2e%2e%2f is the encoding of ../

Question 454

Active vulnerability scanning

Answer 454

Scan type that analyzes the responses from probes sent to a target
Consumes network bandwidth and processor resources

Question 455

Credentialed scanning

Answer 455

Uses a service account and since it can access privileged areas it is more likely to find vulnerabilities

Question 456

Non-credentialed scanning

Answer 456

Can use default passwords still. Less likely to find vulnerabilities than credentialed

Question 457

Agent-Based scanning pros and cons

Answer 457

Scanner installed locally. Reduces impact on network, but could be compromised by malware

Question 458

Passive vulnerability scanning pros and cons

Answer 458

Scan type that analyzes only intercepted network traffic rather than sending probes to a target
Least likely to create impact on network/hosts
Least likely to properly identify vulnerabilities

Question 459

SDN

Answer 459

Software Defined Networking
APIs and compatible hardware allowing for programmable network appliances and systems
Create more complex networks due to size, scope, and ability to rapidly change

Question 460

802.1x

Answer 460

Standard for encapsulating EAP communications over a LAN or WLAN and that provides port-based authentication

Question 461

nmap -sN

Answer 461

Null scan
Conducts a scan by sending a packet with the header bit set to zero
Most IDS/IPS will flag this as malicious

Question 462

nmap sparse scan

Answer 462

–scan-delay <time>
Issues probes with significant delays to become stealthier and avoid detection by an IDS or IPS</time>

Question 463

nmap -sL

Answer 463

List scan
Lists the IP addresses from a target range and performs a reverse DNS query to discovery any host names associated with them

Question 464

Reconstitution

Answer 464

Method of restoring a system that cannot be sanitized using manual removal, reinstallation, and monitoring processes

Pulling out exact, small bits of data, like performing surgery with a scalpel

Question 465

nmap -sU

Answer 465

UDP scan
Sends a UDP packet to a target and waits for a response or timeout

Question 466

namp -sX

Answer 466

Christmas Tree Scan
Conducts scan by sending packet with FIN, PSH and URG flags set to one
Lights up IDS “like a Christmas Tree” and is really just a way of seeing if blue team is paying attention

Question 467

nmap -sF

Answer 467

Sends unexpected FIN packet
Most IDS/IPS will flag as malicious

Question 468

nmap -sT

Answer 468

TCP connect, conducts full three-way handshake
This is the default if you don’t have root or admin privileges

Question 469

nmap -oG

Answer 469

Save output to a greppable format

Question 470

nmap -oX

Answer 470

Save output to XML file

Question 471

nmap -oN

Answer 471

Save output normally

Question 472

SLE

Answer 472

Single loss expectancy
Asset Value x Exposure Factor = SLE
50,000 x 0.05 (20% likelihood) = $2500

Question 473

WMIC

Answer 473

Windows Management Instrumentation Command-Line
Program used to review log files on a remote Windows machine, provide users with a terminal interface, and enables admins to run scripts to manage machines remotely

Question 474

Windows Performance Monitor

Answer 474

Provides a live view of memory usage per running application or service.

Question 475

resmon

Answer 475

A Windows tool to both see real-time data and graph it over time

Question 476

Binary Diffing

Answer 476

Looks at multiple potentially related binaries that have anti-reverse engineering tools run on them and looks for similarities, helping the tool identify malware families despite the protections that malware authors begin.

Question 477

How is integrated intelligence most commonly used in a firewall system?

Answer 477

Threat intelligence is used to provide IP information for rules.

Question 478

What does execution of wmic.exe, PowerShell.exe, or winrm.vbs most likely indicate if you discover one or more was run on a typical end users workstation?

Answer 478

Remote execution of code

Question 479

Well monitoring a SIEM, you notice that all of the log sources from your organization’s New York branch have stopped reporting for the past 24 hours. What type of detection rules or alerts should you configure to make sure you are aware of this sooner next time?

Answer 479

Availability rules or alerts

Question 480

Where can you find sudo events on Linux systems?

Answer 480

/var/log/auth.log

Question 481

What type of information can you determine from Tripwire logs on a Linux system if it is configured to monitor a directory?

Answer 481

If files in the directory have changed

Question 482

If you want to validate the application files you’ve downloaded from a vendor, what information should you request from them?

Answer 482

MD5 Hash

Question 483

If you want to run John the Ripper against a Linux system’s passwords, what do you need to attempt password recovery on the system?

Answer 483

Both /etc/passwd and /etc/shadow

Question 484

AccessEnum

Answer 484

Sysinternals tool. GUI based, gives a full view of file system and registry settings and can display either files with permissions that are less restrictive than the parent or any files with permissions that differ from the parent

Question 485

AccessChk

Answer 485

A command line program that can check the rights a user or group has to resources

Question 486

What type of segmentation is where you place untrusted systems that want to connect to the network into the guest network segment?

Answer 486

Proactive network segmentation

Question 487

If your company is required to be compliant with PCI DSS, and it experiences a card data breach, what type of disclosure will they be required to provide?

Answer 487

Notification to their acquiring bank

Question 488

What should you do to restore systems after a long term APT compromise?

Answer 488

Rebuild and patch the system using original installation media and application software using your organization’s build documentation

Question 489

What steps should you take before sending a drive containing a forensic image

Answer 489

Encrypt the raw file and transfer a hash and key under separate cover

Question 490

Purpose Limitation

Answer 490

Ensuring that information is used only for disclosed purposes

Question 491

Why should you not use ARP tables to enumerate hosts? What should you use instead?

Answer 491

This is a difficult method and prone to error.
Better methods include use of asset management tool, running a discovery scan, or using results of other recent scans.

Question 492

You are configuring vulnerability scanning for a new web server that your organization is deploying on its DMZ Network. The server hosts the company’s public website. What type of scanning should you configure for best results?

Answer 492

Internal and external scanning

Question 493

Port 389

Answer 493

LDAP

Question 494

Ports 137 and 139

Answer 494

NetBIOS

Question 495

Fagan Inspection

Answer 495

Highly formalized, rigorous code review process that involves six phases

Question 496

During which SDLC phase is security architecture completed?

Answer 496

Design

Question 497

Disposition

Answer 497

SDLC phase that is designed to ensure that data is properly purged at the end of an application life cycle

Question 498

What is typically the final testing done before code is released to production?

Answer 498

UAT- User acceptance training

Question 499

You want to prevent email impersonation of individuals inside your company. What technology can help prevent this?

Answer 499

DMARC
While SPF and DKIM can help, combining them to limit trusted senders to only a known list and proving that the domain is the domain that is sending the email combine in the form of DMARC to prevent email impersonation when other organizations also DMARC.

Question 500

You want to determine whether other Windows systems on your network are infected with the same malware package that you discovered on the workstation you are analyzing. You have removed the system from the network by unplugging its network cable, as required by corporate policy. You know that the system has previously exhibited beaconing behavior and want to use that behavior to identify other infected systems. How can you safely create a fingerprint for this beaconing without modifying the infected system?

Answer 500

Plug the system into an isolated switch and use a span port or tap and Wireshark / tcpdump to capture traffic.

Question 501

Senior management at the company that you work for is concerned about rogue devices on the network. If you want to identify rogue devices on your wired network, what solution will quickly provide the most accurate information?

Answer 501

Router and switch-based MAC address reporting

Question 502

John the Ripper’s incremental mode

Answer 502

Most powerful mode, it will try all possible character combinations as defined by the settings you enter at the start

Question 503

During a forensic investigation, you discover that you need to capture a virtual machine that is part of the critical operations of your company’s website. If you cannot suspend or shut down the machine for business reasons, what imaging process should you follow?

Answer 503

Copy the virtual disk files and then use a memory capture tool.

Question 504

Signal

Answer 504

Designed for secure end-to-end messaging.
Using a distinct messaging tool for incident response can be helpful to ensure that staff separates incident communication from day-to-day operations.

Question 505

What is the default macOS drive format?

Answer 505

APFS

Question 506

Eraser

Answer 506

A tool used to securely wipe files and drives.
If eraser is not typically installed on your organization’s machines, you should expect that the individual being investigated has engaged in some anti-forensic activities including wiping files that may have been downloaded or used against company policy

Question 507

COBIT

Answer 507

Control Objectives for Information and Related Technologies. Consists of four domains:
Plan and Organize
Acquire and Implement
Deliver and Support
Monitor and Evaluate

Question 508

What is the current ISO standard governing cybersecurity requirements?

Answer 508

ISO 27001

Question 509

Exposure factor

Answer 509

Percentage of asset expected to be impacted if the risk materializes

Question 510

What is the minimum password length required by PCI DSS?

Answer 510

7 characters

Question 511

PCI DSS requires that networks be scanned __________

Answer 511

Quarterly or after any significant change in the network

Question 512

You have been asked to deploy a secure wireless network in parallel with a public wireless network inside your organization’s buildings. What type of segmentation should you implement to do so without adding additional costs and complexity?

Answer 512

Logical segmentation

Question 513

FIPS 140

Answer 513

US government standard for information processing, and FIPS 140-2 is used to approve cryptographic modules

Question 514

OpenFlow

Answer 514

Used to allow software defined network controllers to push changes to switches and routers, allowing flow control, network traffic partitioning, and testing of applications and configurations.

Question 515

Packers

Answer 515

Tools that self-extract when run, making the code harder to reverse engineer

Question 516

Crypters

Answer 516

Use actual encryption or simply obfuscate the code, making it harder to interpret or read

Question 517

Protectors

Answer 517

Software that is intended to prevent reverse engineering and often include packing and encryption techniques as well as other protective technologies

Question 518

DGA

Answer 518

Domain Generation Algorithm
Creates procedurally generated domain names for malware command and control hosts

Question 519

What are the two most commonly used methods for preventing Linux buffer overflow attacks?

Answer 519

ASLR and the NX bit

Question 520

What Linux command is best suited to determine if an attacker has modified a Linux executable using static libraries?

Answer 520

file, which shows a file’s format, encoding, what libraries it is linked to, and file type

Question 521

What tool will provide the fastest results in most circumstances when cracking passwords from a Windows system?

Answer 521

Ophcrack, which uses a rainbow table

Question 522

What type of acquisition is when you only collect specific files of interest?

Answer 522

Logical acquisition

Question 523

You want to access Chrome logs as part of a forensic investigation. What format is information about cookies, history, and saved form-fill information saved in?

Answer 523

SQLite

Question 524

What Windows utility can be used to get the MD5 Hash of a file?

Answer 524

certutil
certutil -hashfile [file location] md5

Question 525

A sudden resumption of traffic headed “in” after sitting at zero likely indicates ____

Answer 525

A network link or route has been repaired

Question 526

What framework best helps organizations design IT processes that fit together seamlessly?

Answer 526

ITIL

Question 527

What is the key difference between virtualization and containerization?

Answer 527

Virtualization lets you run multiple operating systems on a single physical system, whereas containerization lets you run multiple applications on the same system.

Question 528

Facebook Connect, CAS, Shibboleth, and ADFS are all examples of what?

Answer 528

Single sign on implementations

Question 529

phpinfo file

Answer 529

A testing file often used by web developers during the initial configuration of a server.
Best practice is to remove this file before the server is moved into production or made publicly accessible.

Question 530

Linux NX bit

Answer 530

Stands for no execute, used to mark certain areas of memory as non executable