CYSA Flashcards
exam
Your company just launched a new invoicing website for use by your five largest vendors. You are the cyber security analyst and have been receiving numerous phone calls that the webpage is timing out and the website overall is performing slowly. You have noticed that the website received three million requests in just 24 hours and the service has now become unavailable for use. What do you recommend be implemented to restore and maintain the availability of the new invoicing system?
Intrusion Detection System • Whitelisting (CORRECT) • MAC filtering • VPN EXPLANATION By whitelisting the IP addresses for the five largest vendors, they will be the only ones who will be able to access the web server. This can be done by creating rules in the Access Control List (ACL) to deny ALL other users except these five vendors, thereby dropping large number of the requests from any other IP addresses, such as those from an attacker.
Michelle is preparing to run an nmap scan of a targeted network. She wants to perform a quick scan but knows that a SYN scan isn’t possible because she doesn’t have raw socket privileges on the system she is going to conduct her scan from. What flag should she use to set her scan type?
-sX • -sT (CORRECT) • -O • -sS EXPLANATION Nmap's TCP scan function is enabled using the -sT flag and is a quick way to scan when you are unable to get raw socket access to the scanner system. Fast scans are more frequently conducted using the -sS (SYN) scan, but it requires raw socket access.
You have been asked to scan your company’s website using the OWASP ZAP tool. When you perform the scan, you received the following warning:
“The AUTOCOMPLETE output is not disabled in HTML FORM/INPUT containing password type input. Passwords may be stored in browsers and retrieved.”
You begin to investigate further by reviewing a portion of the HTML code from the website that is listed below:
Enter your username: <br></br>
<br></br>
Enter your Password: <br></br>
<br></br>
Based on your analysis, what do you recommend?
You should implement a scanner exception to ensure you don’t receive this false positive again during your next scan
()
•
You recommend that your company should update the browser’s GPO to solve this issue
(CORRECT)
•
You tell the system administrator to disable SSL and implement TLS
•
You tell the developer to review their code and implement a bug/code fix
EXPLANATION
Since the passwords could be stored in the browser, updating the GPO for the company’s web browsers would be the best option.
Alexander needs to search for files that may have been deleted by a user. What two locations are most likely to contain those files on a Window system?
Registry, the recycle bin • Unallocated space, slack space • Recycle bin, unallocated space () • Slack space, the recycle bin (CORRECT) EXPLANATION Files that users have deleted are most likely to be found in the recycle bin or in slack space, which is the space left after a file has been written to a cluster, which may contain remnant data from previous files. Unallocated space is space that has not been partitioned and, thus, would typically not have been written to. Finally, the registry will not store files that have been deleted.
What is the proper threat classification for a security breach that employs brute-force methods to compromise, degrade, or destroy systems?
Impersonation • Attrition (CORRECT) • Loss or theft of equipment • Improper usage EXPLANATION Attrition attacks employ brute-force methods to compromise, degrade, or destroy systems, networks or services.
John discovers a service running on one of the ports known as a “well-known” port while running a port scanner. What range of ports could this service be running on?
1-65,534 • 1-128 • 1-1023 (CORRECT) • 1-512 EXPLANATION The well-known ports are numbered from 1-1023. Ports above this number are called ephemeral ports. While these ports are commonly associated with specific services, they can be used for any service. Users or applications just need to be made aware of what port to access the service on.
In what type of attack does the attacker begins with a normal user account and then seeks to gain additional access rights?
• Spearphishing • Remote code exploitation • Privilege escalation (CORRECT) • Cross-site Scripting EXPLANATION Privilege escalation attacks seek to increase the level of access that an attacker has to a target system.
What two techniques are commonly used by port and vulnerability scanners to perform services system identification?
Comparing response fingerprints and registry scanning
•
Banner grabbing and comparing response fingerprints
(CORRECT)
•
Using the oslookup utility and UDP response timing
•
Banner grabbing and UDP response timing
()
EXPLANATION
Service and version identification is often performed by grabbing service banners and checking responses for services to known fingerprints of those services. UDP response timing, along with other TCP/IP stack fingerprinting techniques, are used to identify operating systems, while oslookup is not an actual utility.
An new alert has been distributed throughout the information security community regarding a critical Apache vulnerability. What action could you take to ONLY identify the known vulnerability?
Perform a scan for the specific vulnerability on all web severs
(CORRECT)
•
Perform an unauthenticated vulnerability scan on all servers in the environment
•
Perform a web vulnerability scan on all servers in the environment
•
Perform an authenticated scan on all web servers in the environment
EXPLANATION
Since you wish to check for only the known vulnerability, you should scan for that specific vulnerability on all web servers. All web servers is chosen because Apache is a web server application.
What role does the offensive participants perform in a table top exercise (TTX)?
System administrators • Blue team • Red Team (CORRECT) • Security analysts EXPLANATION The red team performs the role of the attacker during a table top exercise (TTX) to help the security team become better at defending the network. This red team action can be done as part of a table top exercise or as part of a larger on-network penetration test.
What popular open source port scanning tool is commonly used for host discovery and service identification?
nmap (CORRECT) • dd • Windows Defender • services.msc EXPLANATION Nmap is a popular open source port scanning utility.
What should a vulnerability report include if a cybersecurity analyst wants it to reflect the assests scanned accurately?
Virtual hosts (CORRECT) • Organizational governance • Processor utilization () • Log disposition EXPLANATION Vulnerability reports should include not just physical hosts but also virtual hosts. A common mistake of new cyber security analysts is to only include physical hosts, thereby missing a large number of assets on the network.
The service desk has been receiving a large number of complaints from external users that a web application is responding slow to requests and frequently receives a “connection timed out” error when they attempt to submit information into the application. What software development best practice should have been implemented in order to have prevented this issue from occurring?
fuzzing • stress testing (CORRECT) • input validation • regression testing EXPLANATION Stress testing is a software testing activity that determines the robustness of software by testing beyond the limits of normal operation. Stress testing is particularly important for "mission critical" software, but is used for all types of software. This stress testing is an important component in the capacity management process of IT service management and is used to ensure adequate resources are available to support the needs of the end user once the service or application goes into the production environment.
You are conducting an incident response and have traced the source of the attack to some compromised user credentials. After performing log analysis, you have discovered that the attack successfully authenticated from an unauthorized foreign country. You management is now asking for you to implement a solution to help mitigate an attack using compromised credentials from occuring in the future. What should you implement?
Self-service password reset • Context-based authentication (CORRECT) • Password complexity • Single sign-on EXPLANATION Context-based authentication can take a number of factors into consideration before permitting access to a user, including their location (country, state, etc), time of day, and other key factors to minimize the threat of compromised credentials being utilized in an attack.
You are a cyber security analyst and have been asked to review the following packet of information:
23:12:23.154234 IP 172.18.10.3:25 > 192.168.10.45:3389 Flags [P.],
Seq 1834:1245, ack1, win 511, options [nop,nop],
TS val 263451334erc 482862734, length 125
After looking over the information on the packet, you discovered there is an unauthorized service running on the host.
What ACL should be implemented to prevent further access to the unauthorized service while maintaining full access to the approved services running on that host?
DENY TCP ANY HOST 172.18.10.3 EQ 25 • DENY TCP ANY HOST 192.168.10.45 EQ 3389 (CORRECT) • DENY IP HOST 192.168.10.45 ANY EQ 25 • DENY IP HOST 172.18.10.3 HOST 192.168.10.45 EQ 3389 EXPLANATION Since the Questions asks you to prevent access to the unauthorized service, we need to block port 3389 from accepting connections on 192.168.10.45 (the host). This option will deny ANY workstation from connecting to this machine (host) over port 3389 (the Remote Desktop Protocol service, which is unauthorized).
Your organization needs to institute an organizational vulnerability management program due to new regulations. The CIO assigns this new function to the information security team. What framework would BEST support the program?
SANS • SDLC • OWASP • NIST (CORRECT) EXPLANATION NIST (National Institute of Standards and Technology) produced a useful patch and vulnerability management program framework in its Special Publication (NIST SP 800-40).
What regulation protects the privacy of student educational records?
FERPA (CORRECT) • GLBA • HIPAA • SOX EXPLANATION The Family Educational Rights and Privacy Act (FERPA) requires that educational institutions implement security and privacy controls for student educational records.
Based on some old SIEM alerts, you have been asked to perform some forensic analysis on a particular host. You have noticed that some SSL network connections are occurring over ports other than port 443. Additionally, the SIEM alerts state that copies of svchost.exe and cmd.exe have been found in the %TEMP% folder on the host, as well as showing that RDP connections have previously connected with an IP address that is external to the corporate intranet. What threat might you have uncovered during your analysis?
APT (CORRECT) • Ransomware • DDoS • Software vulnerability EXPLANATION The provided indicators of compromise appear to be from an Advanced Persistent Threat (APT). These attacks tend to go undetected for several weeks or months, and utilize secure communication to external IPs as well as Remote Desktop Protocol connections to provide the attackers with access to the infected host.
If your DNS server allows __________ and is not properly secured, attackers may be able to get a full listing of your internal DNS information.
Split horizon • FQDN resolution • Remediate the threat • Zone tranfers (CORRECT) EXPLANATION DNS zone transfers provide a full listing of DNS information. Improperly secured DNS servers may allow attackers to gather this data by performing a zone transfer.
What port is most likely to be used in a web-based attack?
3389 • 389 • 443 (CORRECT) • 21 EXPLANATION Port 389 is used by LDAP, Port 21 is used by FTP, and port 3389 is used by RDP. Web-based attacks would likely appear on port 80 (HTTP) or port 443 (HTTPS)
Cybersecurity risks results from the combination of a threat and a(n) _____________.
Exploit • Risk • Malicious Actor • Vulnerability (CORRECT) EXPLANATION Cybersecurity risks result from the combination of a threat and a vulnerability. A vulnerability is a weakness in a device, system, application, or process that might allow an attack to take place. A threat in the world of cybersecurity is an outside force that may exploit a vulnerability
Ellen is asked for a code that is sent to her via text (SMS) message during her login process. What concerns should she raise to the manager of her organization’s AAA services?
SMS is secure, and she should not raise a concern.
•
SMS messages may be accessible to attackers via VoIP or other systems.
(CORRECT)
•
SMS should be encrypted to be secure.
•
SMS should be paired with a third factor.
EXPLANATION
NIST?s SP 800-63-3 recommends that SMS messages be deprecated as a means of delivering a second factor for multifactor authentication because they may be accessible to attackers. SMS is unable to be encrypted (at least without adding additional applications to phones), and a third factor is typically not a user-friendly recommendation.
William is evaluating the potential impact of a confidentiality risk and determines that the disclosure of information contained on a system could have a limited adverse effect on the organization. Using FIPS 199, how should he classify the confidentiality impact?
Low (CORRECT) • Moderate • Higjh • Medium EXPLANATION FIPS 199 classifies any risk where ?the unauthorized disclosure of information could be expected to have a limited adverse effect? as a low impact confidentiality risk.
What security control provides Windows administrators with an efficient way to manage system configuration settings across a large number of devices?
HIPS • Anti-malware • GPO (CORRECT) • Patch management EXPLANATION Patch management, host intrusion prevention systems (HIPS), and antimalware software all good host security controls, but only Group Policy Objects (GPOs) provide the ability to configure settings across multiple Windows devices.
Which of the folllowing is NOT a part of the vulnerability management lifecycle?
Detection • Remediation • Testing • Investigating (CORRECT) EXPLANATION The three phases of the vulnerability management lifecycle are detection, remediation, and testing.
Which language would require the use of a decompiler during reverse engineering?
Ruby • Objective-C (CORRECT) • Pyhton • Javascript EXPLANATION Ruby, Python, and Javascript are interpreted languages and do not require the use of a decompiler to view the source code.
Barbie would like to implement a control that prevents unauthorized users from connecting to her company’s wireless network. What security control best meets this requirement?
Segmentation • IPS • Firewall • NAC (CORRECT) EXPLANATION Network Access Control (NAC) prevents unauthorized users from connecting to a network. Firewalls and intrusion prevention systems (IPS) are meant to restrict access from external sources and block known attacks. They would not keep out an intruder who is already in range of the wireless network. Network segmentation would limit the access that an intruder has to network resources but would not block the connection.
Chris needs to ensure that accessing a drive to analyze it does not change the contents of the drive. What tools should he use?
Hardware write blocker (CORRECT) • Forensic drive duplicator • Software write monitor • Degausser EXPLANATION Hardware and software write blockers are designed to ensure that forensic software and tools cannot change a drive inadvertently by accessing it. Forensic drive duplicators copy drives and validate that they match the original, software write monitors are not used for forensic use like this, and a degausser is used to wipe magnetic media.
What is NOT considered part of the Internet of Things?
A Windows 2016 server configured as a domain controller (CORRECT) • Internet-connected television • ICS • SCADA systems EXPLANATION Supervisory control and data acquisition (SCADA) systems and industrial control systems (ICS) are examples of IoT implementations.
You are working as a cyber security analyst and you just received a report that many of your servers are experiencing slow response times as a result of what appears to be a DDoS attack. What action do you recommend to solve this issue?
Inform management of the issue being experienced
(CORRECT)
•
Take no action, but continue to monitor the critical systems
•
Shutdown all of the interfaces on the affected servers
•
Inform users regarding the affected systems
EXPLANATION
During an incident response, the cyber security analyst should ensure management understands the current status of an incident and recommend the best way ahead. It is up to management to choose the plan of remediation based on a weighing of numerous factors, such as cost, risk, resourcing, threat, etc.
A triple-homed firewall normally connects the Internet, a private network, and a _________ network.
GPO • Subnetted • NIDS • DMZ (CORRECT) EXPLANATION Demilitarized zone (DMZ) networks are used to host systems that require access from external hosts.
Nicole is investigating a security incident at a government agency and discovers that attackers obtained PII. What is the information impact of this incident?
Privacy breach (CORRECT) • None • Integrity breach • Proprietary breach EXPLANATION In a privacy breach, sensitive personally identifiable information (PII) was accessed or exfiltrated.
You have been asked to recommend a few technologies that are PKI X.509 compliant for use in some secure functions in the organization. What technology would NOT meet the compatibility requirement?
3DES (CORRECT) • AES • PKCS • SSL/TLS EXPLANATION 3DES is an older encryption method and is no longer considered secure. Public Key Infrastructure (PKI) relies on X.509 and its associated secure technologies, such as AES, PKCS, and SSL/TLS, in order to perform secure functions.
In which tier of the NIST cybersecurity framework does an organization understand its dependencies and partners?
Adaptive • Repeatable (CORRECT) • Risk informed • Partial EXPLANATION In the repeatable tier (Tier 3) of the NIST CSF, the organization understands its dependencies and partners and receives information from these partners that enables collaboration and risk-based management decisions within the organization in response to events.
