CySA+ Study Notes 8

Question 1

attackers do recon against systems and think of ways to exploit, when they find path of potential vulnerability they move into attack phase.

Answer 1

Discovery Phase (Penetration Testing)

Question 2

(1) seek to gain access to target system, (2) escalate privileges, (3) and browse network for new systems that they can access, (4) then they install additional tools on compromised systems in efforts to gain deeper access to the network.

*** Proxies : ZAP, burp suite, Vega, etc …

*** Air Gapping : completely removing system from the network.

** Always-On Vpn : connect automatically.

Answer 2

Attack Phase (Penetration Testing)

Question 3

makes the network programmable, separate data plane and control plane, allows granular network configuration, facilitates faster response to security incidents …

Answer 3

SDN

Question 4

when systems are compromised by malware and joined to a botnet, they configured with the server names of C2 servers they contact to receive further instructions, then security analyst(s) alter DNS records to reroute botnet traffic.

Answer 4

DNS Sinkhole

Question 5

monitors user behavior, and flags any deviations from those patterns of the normal behavior.

*** Digital Signing of a message does not provide confidentiality.

Answer 5

UEBA

Question 6

??? provides domain owner ability to list server that are authorized to send mail from the domain.

??? provides email authentication by allowing mail servers to digitally sign legitimate outbound email message; uses public/private key pairs. Public keys are published through DNS.

??? provides domain owners ability to specify SPF and DKIM policies for their domains.

Answer 6

SPF / DKIM / DMARC

Question 7

detect security incidents, contain detected incidents, investigate contained incidents, remediate endpoints.

Answer 7

EDR

Question 8

Security Event : any activity that takes place on a system, network, or application that may have security implications.

Security Incident : any adverse security event that either caused or threatened to cause a violation of org.’s security policy.

Answer 8

info

Question 9

develop list of threats, assess threat based on likelihood, access threats based on impact, create a threat register.

*** Highest priority of Incident response team is to first isolate systems.

Answer 9

Threat Analysis

Question 10

??? have minimal potential to affect security, are normally handled by first responders, dont require after-hours response.

??? have significant potential to affect security, trigger incident response team activation, require prompt notification to management.

??? may cause critical damage to information or systems, justify an immediate full response, require immediate notification to senior management, demand full mobilization of incident response team.

Answer 10

Low Impact / Moderate Impact / High Impact