Deck3 Flashcards
A hacktivist group claims responsibility for infecting a manufacturer’s systems by planting an infected USB drive at the company’s office. The manufacturer’s distributor, several vendors, and hundreds of customers were all eventually infected with the malware that stole important credential information.
Which term describes this attack strategy?
A)Cloud-based
B)Direct access
C)Supply-chain
D)Social media
A supply-chain attack is not an attack on a target directly but on a more vulnerable company or resource within its supply chain that helps the organization conduct business or create a product. An increasing number of hacks are being carried out this way.
Direct access is the most straightforward type of attack and usually the most preventable. It is a physical or local attack, such as an attacker exploiting an unlocked workstation and using a boot disk to install malicious tools or simply stealing a device.
In a cloud-based attack, hackers may try and exploit vulnerabilities in cloud-based web service providers to gain access to a tenant organization’s data.
Social media attacks occur when malware is attached to social media posts or presented as downloads on social media sites. At their most dangerous, hackers can make it so a compromised site automatically infects a vulnerable computer.
In order to log onto a system, you must first complete a CAPTCHA, then enter a code that is sent to your cell phone via SMS. What is that code an example of?
A)Passwordless
B)Cloud access security broker
C)Multi-factor authentication
D)Single sign-on
Passwordless authentication provides alternative mechanisms to authenticate users, using items that do not have to be remembered by the user. Examples of passwordless authentication include hardware tokens, smart cards, biometrics, and one-time passcodes sent to a cell phone.
CASB
A cloud access security broker (CASB) is a checkpoint where security policies are enforced, located between an organization’s users and its cloud providers. A CASB can ensure cloud security by comparing users, applications, and devices against multiple security policies.
In security operations, which of the following would provide well-defined operational guidelines for processes such as incident response, security policy, vulnerability management, and security awareness?
A)Windows registry
B)Logging levels
C)System processes
D)System hardening
System processes provide well-defined operational guidelines for processes such as incident response, security policy, vulnerability management, and security awareness, to name a few. A Security Operations Center (SOC) operates 24x7 maintain the organization’s security posture. The abovementioned system processes provide the guidelines that the SOC uses for its operations.
Windows Registry?
The Windows registry is a database that contains all the application settings and current configuration parameters for the hardware and software on a Windows system. Each machine running a Windows OS has a registry that contains keys (which identify applications, processes, hardware) and values (specific configuration data related to the key). For example, if a key was related to a printer, values associated with the key could include printing orientation, print history, default paper tray, and default paper size.
The Windows OS uses the registry database for storing all configuration settings. In Linux, each application and process has its own configuration file. The Linux file structure uses the /etc/ directory for configuration file locations.
Hardware architecture is also an important concept. If the hardware is not secure, it would be very difficult to build secure applications and databases and to have high availability. Physical access to critical hardware, such as servers, routers, wireless access points, and network switches, is often overlooked. It is not uncommon that administrative passwords are set to the default, firmware does not get updated, and encryption is not adequate for the device.
Which of the following has a Policy Engine, a Policy Administrator, and a Policy Enforcement Point?
A)Personally identifiable information (PII)
B)Cardholder data
C)Data loss prevention
D)Zero trust
Zero-trust architecture consists of a Policy Engine, a Policy Administrator, and a Policy Enforcement Point. The goal of zero trust is to continuously monitor the authentication and authorization of devices, users, and processes. The Policy Engine is responsible for granting or denying access based primarily on policy, but other factors can be taken into consideration. The Policy Administrator decides to open or close the communication path from the requestor to the resource, based on the decision of the Policy Engine. The Policy Enforcement Point establishes and terminates the connections.
Your company is governed by several regulations that state that you must use automated systems that provide CCE and CVE identifiers for vulnerability scans. Which of the following should you implement?
A)SCAP
B)SIEM
C)NAC
D)SNMP
You should implement Security Content Automation Protocol (SCAP), which provides Common Configuration Enumeration (CCE) and Common Vulnerabilities and Exposures (CVE) identifiers.
The team is analyzing a shell script that was run on a server. How can they recognize comments in the script?
A)line starts with a #
B)line starts with $
C)line start with a !
D)line starts with a @
Comments are ignored by the shell. They typically begin with the hash symbol (#) and continue until the end of the line.
The exclamation mark (!) is used with the Equal relational operator. != means Not Equal and returns true if the two operands are not equal. Otherwise, it returns false.
The dollar sign ($) is used to return the value of the last executed command.
The at symbol (@) can be used with the $ symbol to pass all of the parameters to the script.
Obtaining which of the following can reduce the likelihood of purchasing counterfeit equipment?
A)Fingerprint
B)OEM documentation
C)SLA
D)Hash value
One of the ways you can reduce the likelihood of purchasing counterfeit equipment is to insist on the inclusion of verifiable original equipment manufacturer (OEM) documentation. In many cases, this paperwork includes anti-counterfeiting features. Make sure you use the vendor website to verify all of the various identifying numbers in the documentation.
You have quarantined an instance of malware and would like to execute the payload to see what it does without spreading it through the network. What tool or process could be used to do this safely?
A)Cuckoo Sandbox
B)email header analysis
C)DKIM
D)pattern recognition
Cuckoo Sandbox is used to investigate suspicious files or websites. It not only analyzes files and websites but also traces API calls, dumps any related network traffic, and analyzes the processes running in memory. When you execute a malicious payload in a sandbox, the sandbox allows it to run while preventing the spread of any activity generated by the malicious payload.
You are a cyber security analyst. Your organization has several products and services implemented within their IT environment. Management finds it difficult to view security and operational metrics for all the products. You recommend that management approve implementing single pane of glass solution to resolve the visibility issue.
Which of the following statements is NOT true of implementing a single pane of glass solution?
A)It increases efficiency by eliminating the need to switch back and forth between separate IT operations management solutions.
B)It provides an easy-to-navigate GUI.
C)It provides a centralized display of security and operational metrics that is readily available to management.
D)It displays and sends data in real time from the centralized application whenever relevant events occur in the environment.
A single pane of glass solution does not display and send data in real time when relevant events occur in the environment. You would implement webhooks in an application to display and send data in real time when a relevant event occurs in the environment. Webhooks can be leveraged to automate certain workflows.
A single pane of glass solution provides a single management console that displays data from multiple sources. The glass in the term “single pane of glass” refers to a computer monitor or mobile screen where users can view meaningful data from multiple sources.
You are assisting a senior forensics investigator with a crime scene. While you are watching, he runs the following command:
user@kaplan:~# md5sum /dev/pw3
He receives the following output:
9b98b637a132974e41e3c6ae1fc9fc96 /dev/pw3
What is the long string of values in the output called?
A)Initialization vector
B)Hash value
C)Salt value
D)Encryption key
That value is the hash value, and it was derived by running the file against the now-deprecated MD5 hashing algorithm. This algorithm generates this value based on the contents of the file or volume against which it was run. Its value is in providing a way to determine, at a later time, if the file or volume has changed. To validate an image, a hash is generated for both the original and the copy. If the hashes match, then the images are identical. Both hashes should be recorded as part of the forensic log for the investigation.
It is not an encryption key. Encryption keys are used to encipher a message. MD5 does not perform encryption. It generates a value that can be used to determine the integrity of the file or volume.
It is not an initialization vector (IV). These are values used within certain encryption algorithms to add randomness to the calculations to prevent patterns in the output that can be used to reverse-engineer the encryption key.
A salt value is random data that is used as an additional input to a one-way function that “hashes” a password or passphrase. It is used to make cracking the hash more difficult.
Which network architecture concept allows for dynamic reconfiguration of a network as a reaction to changes in volume, types of traffic, and security incidents?
A)Secure Access Service Edge
B)Hybrid
C)Software-defined networking
D)On-premises
Software-defined networking (SDN) allows for dynamic reconfiguration of a network as a reaction to changes in volume, types of traffic, and security incidents.
On-premises network architecture allows an organization to maintain control of its architecture and resources by hosting it on-site. With on-premises, the organization can also host a private cloud on its hardware.
Hybrid cloud architecture is an environment where some items are stored in a public cloud and some items are stored in a private cloud. In short, a public cloud allows an organization to “rent space” (much like a tenant in an office building) from another organization in an Internet-accessible datacenter, place sharable resources in that space, and configure access to those resources. A private cloud is an Internet-accessible datacenter that serves only one tenant.
Secure Access Service Edge (SASE) is used to ensure security in a software-defined wide area network (SD-WAN) environment, particularly in a cloud environment. SASE is often associated with the zero-trust model.
Your organization’s reputation is staked on a book it publishes yearly. When you perform data classification, how should you classify this book and its contents?
A)intellectual property
B)corporate confidential data
C)PHI
D)personally identifiable information
Intellectual property is a tangible or intangible asset to which the owner has exclusive rights. Intellectual property law is a group of laws that recognizes exclusive rights for creations of the mind. This includes books and music.
Which of the following network architecture concepts consists of a Policy Engine, a Policy Administrator, and a Policy Enforcement point?
A)Hybrid
B)Zero-trust
C)Cloud
D)Secure Access Service Edge
Zero-trust architecture consists of a Policy Engine, a Policy Administrator, and a Policy Enforcement Point. The goal of zero trust is to continuously monitor the authentication and authorization of devices, users, and processes. The Policy Engine is responsible for granting or denying access based primarily on policy, but other factors can be taken into consideration. The Policy Administrator decides to open or close the communication path from the requestor to the resource, based on the decision of the Policy Engine. The Policy Enforcement Point establishes and terminates the connections.
