Domain 1 Flashcards
1
Q
is the art of exploiting human behavior by convincing someone to reveal information or perform an activity, these attacks can occur in person, via email, and over the phone
A
Social Engineering
2
Q
is the act of attempting to gather personal or sensitive information through fraudulent emails. is the most common form of social engineering attack related to computer security
A
Phishing
3
Q
is the act of attempting to gather personal or sensitive information through fraudulent SMS (short message services, better known as texting) works primarily due to the use of urgency and intimidation in the message
A
Smishing
4
Q
Is the act of attempting to gather personal or sensitive information through fraudulent phone calls, This video demonstrates the use of (***) to steal someone’s cell phone credentials
A
Vishing
5
Q
is unwanted commercial emails that are sent out in bulk via email
A
Spam
6
Q
SPIM is unwanted commercial emails that are sent out in bulk via instant messages
A
Spam Over Instant Messaging
7
Q
is a term created to refer to a phishing attack that targets a specific person or group of people with something in common
A
Spear Phishing
8
Q
is the act of attempting to gather personal or sensitive information from trash dumpstersAn attacker may gather a variety of information that can be useful in a social engineering attack10
A
Dumpster Diving
9
Q
is the act of secretly observing a person’s computer screen or keyboard to gather personal or sensitive informationThe attacker directly observes the individual entering sensitive information on a form, keypad, or keyboard
A
Shoulder Surfing
10
Q
is the act of directing internet users to a malicious website to gather personal or sensitive informatio
A
Pharming
11
Q
is the act of following an authorized person into a restricted area without providing credentialsAlso known as piggybacking
A
Tailgating
12
Q
Is the act of encouraging a person to disclose personal or sensitive information Calls to or from help desk and tech support units can be used to ____ ______
A
Eliciting Information
13
Q
is a type of phishing that targets high-profile individuals such as executivesThe sender must do some upfront research about the target as well as the subject in order to craft an e-mail that sounds convincing
A
Whaling
14
Q
The attacker adds a story to the beginning of the message
A
Prepending
15
Q
is the act of stealing personal information to impersonate the victim
A
Identity fraud
16
Q
The act of sending spoofed invoices from a trusted source or business executive
A
Invoice Scams
17
Q
The act of gaining access to a vast number of stored usernames and passwords, enabling an attacker a series of access passes to the system
A
Credential Harvesting
18
Q
The act of engaging with a computer system to gather information about its possible weaknesses
A
Reconnaissance
19
Q
is a false security threat that’s meant to entice a user to believe it’s real and disclose sensitive or personal information
A
Hoax
20
Q
The act of masquerading as a legitimate or trusted individual or entity
A
Impersonation
21
Q
The act of infecting a frequently visited website with malware
A
Watering Hole Attack
22
Q
also known as URL hijacking) is the act of presenting users with a fake site that has a similar URL
Best defense against this is to register those domains with all deviations of the designated site
A
Typosquatting
23
Q
A social engineering tactic where the attacker creates a false scenario to steal the victim’s personal information
An example is an attacker calling to verify personal information with the victim
A
Pretexting
24
Q
are an attempt to shift public opinion through the use of social media platforms
A
Influence Campaign
25
A military strategy that employs conventional warfare and unconventional means in the battlefield
Information is used to sway people toward a position favored by those spreading it
Hybrid Warfare
26
refers to websites that allow users to post and share content within a digital community
Social Media
27
Authority
•The attacker impersonates a high-level executive or an IT support person
Intimidation
•The attacker attempts to scare or threaten the victim
Consensus
•The attacker claims that others are performing the requested action
Principles (reasons for effectiveness)
28
Scarcity
•The attacker claims limited availability for a prize or reward
Familiarity
•The attacker poses as a familiar figure or builds rapport over time before conducting a social engineering attack
Trust
•The attacker uses his or her good relationship with the victim to conduct the social engineering attack
Urgency
•The attacker scares or threaten the victim to perform an action within a short amount of time
Principles
29
is term given to a program intended to damage a computer system
Malware
30
is malware designed to lock a victim’s computer or data until money is paid to the attacker
Ransomware
31
are malicious applications that misleads victims by appearing as a trusted file or application
Trojans
32
is a type of malware with the objective of spreading rapidly
Worm
33
are programs like spyware and adware that are downloaded along with the program the user consented to download
Potentially Unwanted Program (PUPS)
34
is a type of malware that uses a system’s software and applications to hide and execute its operations
Fileless Virus
35
gives instructions to the botnet and is the central management center to conduct cyber-attacks
Command and Control
36
Computer programs that automate a previously repetitive and task.
Bots
37
uses encryption to deny the victim access to his or her data
Also the name given to malware used to mine crypto
Cryptomalware
38
are malware designed to execute on a future date or event
Logic Bombs
39
is malware designed to steal a victim’s personal information online
Spyware
40
capture the victim’s keystrokes to steal credentials or personal information
Keylogger
41
are malicious programs that installs a backdoor on the victim’s computer
Remote Access Trojans (RAT)
42
are malicious programs that allow attackers to control a victim’s computer remotely
Rootkits
43
an undisclosed way to gain access to a system or application
Backdoor
44
The attacker attempts to gain access to a large amount of usernames through commonly used passwords
Spraying
45
The attacker attempts to gain access to a password-protected resource by entering every word in a ________ as a password
Dictionary
46
The attacker attempts every possible combination of letters, numbers, and special characters to guess the user’s credential
Brute Force
47
are pre-assembled tables for reversing encrypted hashes, typically password hashes
Rainbow Table
48
An attacker can launch a known ______ attack if he has samples of both the ? and the ciphertext
Plaintext
49
A USB drive that appears harmless but contains might contain ransomware or a keylogger that transmits back to the attacker’s command and control server
Malicious Flash Drive
50
The attacker creates a copy of a legitimate card to steal its credentials
Card Cloning
51
Attackers capture credit card information illegally through fake credit card readers
Skimming
52
A technique to make systems capable of machine learning more resilient by exposing them to malicious scenarios
Adversarial artificial intelligence (AI)
53
The attacker inputs malicious data to a system or application while its in its training process
Tainted training data for machine learning (ML)
54
Attackers might try new approaches to find security holes in the machine learning algorithm
Security of machine learning algorithms
55
Attackers might try new approaches to find security holes in the machine learning algorithm
Supply-chain attacks
56
attacks have less physical impact than on-premise attacks and are more resilient due to the lower cost to back-up data.
Cloud Based
57
The attacker attempts to find a match to a hash by identifying portions based off probability
Birthday
58
occurs when two different inputs produce the same hash value
Collison
59
The attacker negotiates for a less secure protocol to communicate with hosts and servers
Downgrade
60
Attackers try to work their way up from a basic user account to an account with administrative access
Privilege Escalation
61
An application vulnerability that allows an attacker to inject malicious data
Cross-site scripting
62
The attacker inserts malicious code into an application
Injection
63
An attacker inserts malicious code to obtain or delete data from the database
Structured query language (SQL)
64
is a collection of code that is designed to be used as needed by a computer process
Dynamic Link Library (DLL)
65
is performed by replacing a valid DLL file with a malicious DDL file
DLL Injection Attack
66
The attacker exploits input validation vulnerabilities to execute commands to the LDAP servers
Lightweight Directory Access Protocol (LDAP)
67
The attacker injects XML code directly into the application to manipulate its operations
Extensible Mark Up Language (XML)
68
occurs when a program attempts to read or write to memory with a NULL pointer
Pointer/object dereference
69
The attacker manipulates the file system structure on a web server to search for unsecured files
Directory Traversal
70
The attacker attempts to crash or hang up the application by injecting more data than intended for the application
Buffer Overflow
71
occurs when a process produces an unexpected result due to timing
Race Condition
72
The attacker attempts to access a file between the first time the program accesses the file and usage of file
Time of check/time of use
73
is the ability for an application to catch errors and provide user-friendly feedback to the user, without crashing the application
Error Handling
74
occurs when an error message that's displayed to an end user provides clues about how an application operates
Improper Error Handling
75
occurs when an attacker intercepts secure communication and fraudulently resends or misdirects the communication
Replay Attack
76
The attacker repeats valid transmission data between a legitimate user and server
Session Replays
77
occur when a user’s input exceed the boundaries of integer variables
Integer overflows
78
The attacker attempts to bypass the input validation countermeasures on a server to gain access to sensitive data
Server-side validation
79
With a web-based service, the attacker performs legitimate but unauthorized actions on a user’s account
Cross side request forgies
80
allows applications to communicate and respond to each other
An attacker can target an *** to gain administrative access or modify its intended behavior by discovering flaws in its implementation
application programming interface (API)
81
The attacker exploits the system or application to crash or hang up its intended operations
Resource Exhaustion
82
The attacker causes the application to consume more and more memory the longer it runs
Memory Leak
83
SSL stripping is a technique to downgrade the security of a website from https to http
Secure Sockets Layer
84
Drivers are used by operating systems to interact with the hardware and software components of a device
Driver Manipulation
85
is the act if writing code to provide operating system compatibility with older drivers
Shimming
86
is the act of rewriting the internal processing of a program without altering its external behavior
Refactoring
87
The attacker sends a legitimate password hash for authentication
Pass the hash
88
is a malicious access point that is been configured to eavesdrop and intercept wireless network traffic
Evil twin
89
is an unauthorized and potentially malicious access point
Rogue Access Point
90
is the act of using Bluetooth technology to connect to another device for potentially malicious reasons
Bluesnarfing
91
is the act of using Bluetooth technology to send messages to another device
Bluejacking
92
is a wireless attack in which the attacker denies the victim wireless connection to the access point
Disassocation
93
is the act of blocking access to wireless signals and causing denial of service by interjecting electromagnetic waves on the same frequency
Jamming
94
These attacks occur when an attacker eavesdrops or alters the radio frequencies of ****-capable devices
RFID (Radio Frequency Identification)
95
NFC attacks occur when an attacker disables or alters the communication path between an NFC-capable devices
NFC (Near Field Communication)
96
attacker can decrypt the IV of a wireless traffic to read messages in plaintext
Initialization Vector (IV)
97
attacks occur when an attacker places themselves between two devices to eavesdrop, alter, or intercept the communication
On Path Attack
Man In The Middle
Man In The Browser
98
is the process of altering data to deceive devices about the actual MAC address of a system
Address Resolution Protocol (ARP) poisoning
99
is the act of removing legitimate MAC entries from a network switch and consuming its limited bandwidth
Media access control (MAC) flooding
100
is the act of duplicating the default or factory-assigned MAC address of a device
MAC cloning
101
(DNS) translates URLs to IP addresses
Attackers can target these servers to redirect users to malicious websites
Domain Name Systems
102
occurs when an attacker compromises and takes full control of the victim’s domain name account
Domain Hijacking
103
is the process of altering DNS records to mislead users to a malicious website
DNS Poisoning
104
occurs when users are redirected to a malicious website
Uniform Resource Locator (URL
105
is the act of validating the authenticity of a website and those who access the website
Domain Reputation
106
is large-scale denial-of-service attack that leverages often thousands of botnets
Distributed denial-of-service (DDoS
107
occurs when an attacker denies legitimate access to networking devices
Network DDoS
108
network DDoS occurs when an attacker denies legitimate access to user applications
Application DDoS
109
DDoS occurs when an attacker denies legitimate access to IP-capable devices designed to monitor physical systems
110
is designed to aid administrators manage Windows systems
Attackers can write ****** scripts to steal credentials and other sensitive data through a popular hacking tool called PowerSploit
PowerShell
111
is a widely used programming language and scripting tool used in software development and data analytics
Python
112
a popular scripting language used for automating tasks on Linux systems
Bash
113
are recorded instructions used to improve the functionality of PDF documents
Macros
114
is an older scripting language used to automate Microsoft processes and applications
Visual Basic for Applications (VBA)
115
are long-running attacks, sophisticated cyber-attacks
Advanced persistent threat (APT)
116
These threat actors has legitimate access to organizational facilities and IT resources making detection difficult
Internal Actors
117
These types of hackers are financially supported by their governments and have access to advanced cyber capabilities, including zero-day vulnerabilities
States Actors
118
are beginner hackers who often use tools or scripts without the knowledge of its operations
Script Kiddies
119
are threat actors that switched from traditional criminal activities to conducting online attacks
Criminal Syndicates
120
Skilled individuals with the ability to access computer systems and recourses without authorization
Hackers
121
who are hired to discover computer or network vulnerabilities
Hackers - Authorized
122
Hackers with the intent of stealing sensitive data or gaining unauthorized access to a computer system
Hackers - Unauthorized
123
refers to IT projects that are managed without the knowledge and consent of the IT department
Shadow IT
124
Outside organizations seeking financial or market gain through espionage
Competitors
125
Anonymity can make attribution difficult
Cyber-persona can mask the true actor, requiring significant analysis and collaboration to identify actor at times
Attributes of actors
126
Nation states can conduct more sophisticated cyber-attacks due than script-kiddies, and can cause higher levels of disruptions
Level of sophistication/capability
127
Nation state-sponsored hackers receive industry-leading training in computer hacking and they share their collected information with their government intelligence agencies
Resources/funding
128
An attacker needs a medium to carry out a cyber-attack so they rely on attack vectors (sometimes called threat vectors) to gain access to a system
Vectors
129
This involves an attacker having physical access to the hardware of the system
Direct access
130
An attacker can gain access to a network or device through unsecured access points, weak wireless encryption standards, and weak or default credentials
Wireless
131
is a threat vector that attackers exploit through phishing campaigns
Attackers consider email to be the most successful vector due to its widespread use
Email
132
An attacker can gain access to a system’s component prior to its final integration by attacking its manufacturing process
Supply Chain
133
Attackers can use social media to launch a social media attack or impersonate the victim online
Social Media
134
An attacker can load malware into _________ _______ without the victim’s knowledge
Removable Media
135
Attackers can gain access to data stored in the cloud through password attacks
Cloud
136
Publicly available information about cyber threats
Open-source intelligence (OSINT)
137
Information about cyber threats that is not publicly available
Closed/proprietary
138
The US National Vulnerability Database keeps a record of technical vulnerabilities, including those found in the Common Vulnerabilities and Exposures database or CVE
Vulnerability databases
139
A central resource between the public and private sector to disseminate information regarding cyber threats actors and threats to critical infrastructure
Public/private information-sharing centers
140
Internet content and websites that are undisclosed via search engines and is known for criminal activity
Dark Web
141
Evidence that an unauthorized action has been perform against an information system
Indicators of compromise (IoC)
142
system that sends automatic alerts between the public and private sector once a threat is confirmed
Automated Indicator Sharing (AIS)
143
A standardized communication standard to automatically exchange cyber threat information
Structured Threat Information eXpression (STIX)/Trusted Automated eXchange of Intelligence Information (TAXII)
144
The act of analyzing cyber threat information to predict the attacker’s
Predictive analysis
145
A graphical representation of cyber attacks conducted around the globe
Threat maps
146
A location for software developers to collaborate on projects and centrally store their source code
File/code repositories
147
Conducting research on a vendor by exploring its website for valuable information
Vendor Websites
148
can provide information regarding current cyber threats and critical vulnerabilities
Vulnerability feeds
149
are published research papers that have been peer reviewed and written by industry experts
Academic journals
150
The set of standards that document the protocols involved in online communication
Request for Comments (RFC)
151
are comprised of security experts sharing cyber threat information, while promoting networking amongst peers
Local industry groups
152
A source for information regarding cyber threats from multiple sources
Threat feeds
153
The pattern of activities that is associated to a specific threat actor
Adversary tactics, techniques, and procedures (TTP)
154
exploits an unpublished vulnerability with no available vendor patch
Zero Day
155
refer to security configurations that expose a system or application to threats that could be countered with proper configurations
Weak configurations
156
refers to a device or application with no access control measures in place
Open permissions
157
pose a significant security concern by allowing an attacker to gain administrative access
Unsecured root accounts
158
This is like a default administrator account password should be changed to avoid an attacker guessing the default credential
Default settings
159
refers to protocols like Telnet, HTTP, or FTP, which transmits data in cleartext
Unsecure protocols
160
can receive and respond to communication requests from an attacker
Open ports and services
161
Risks associated with sharing information with individuals, groups, or outside organizations
Third party risks
162
This refers to the policies and procedures in place to vendor and supply chain risks
Vendor Management
163
What refers to the ability for hardware and software systems to effectively communicate and interoperate
System Intregation
164
can expose an organization to security vulnerabilities with no security patch available
Lack of vendor support
165
are risks associated with an attacker can disrupting the system’s manufacturing process
Supply Chain
166
An organization may choose to transfer its code development process to third-parties but may lose visibility and control of the code
Outsourced Code Development
167
Data stored outside the organization via a third party cloud provider should have identical security measures as data stored on-premise
Data storage
168
refers to software code that resides within the hardware of system when the system boots up
Firmware
169
controls the functionalities of a computer and can receive patches from major vendors through automation
(OS) Operating System
170
are software programs with user interfaces and are susceptible to software vulnerabilities
Applications
171
A large open source of information on a threat’s capabilities, gathered from various sources and researchers
Intelligence Fusion
172
is the act of examining a system or application for the presence of known software vulnerabilities
Vulnerability Scans
173
occurs when a vulnerability scan detects a vulnerability that is not present on a system or application
False Positives
174
occurs when a vulnerability scan does not detect a vulnerability that is present on a system or application
False negatives
175
can detect access violations, security incidents, and other policy violations
Log reviews
176
can provide information such as the state of the system, but it is not as in depth as a credentialed scan
Non credentialed scan
177
requires higher privileges but provides vulnerability details and user account information
Credentialed scan
178
involves directly interaction with the target system beyond scanning for open ports
Intrusive vs Non Intrusive Scan
179
vulnerabilities can be detected through a dynamic code analysis and can sometimes require regression testing to ensure the code is executing as intended
Applications
180
Attacker can use available web application scanners to search for web applications that are vulnerable to SQL Injection or cross-site scripting attacks
Web applications
181
A scan is conducted to enumerate the ports and services operating within a network
Network Scan
182
A popular database of known software vulnerabilities, each ranked and with a unique ID
Common Vulnerabilities and Exposures (CVE)/Common Vulnerability Scoring System (CVSS)
183
What reviews should be conducted to discover deviations within the system’s security
Configuration review
184
A system that collects, correlates, and aggregate log data to support IT teams
Syslog/Security information and event management (SIEM)
185
Reviewing the output from a SIEM for the presence of security incidents and possible false positives
SIEM Reports
186
Network packets captured by the SIEM system can identify a threat’s presence on the network
Packet Capture
187
A SIEM system can ingest data from multiple sources
Data Input
188
A SIEM system can create alerts based on changes in an end-user’s patterned behavior
User behavior analysis
189
refers to collected data that conveys human emotion or opinion
Sentimental Analysis
190
is the process of combining log data to a format that is searchable
Log Aggregation
191
are software that are gathered independently and passed to the SIEM for aggregation
Log collectors
192
What combines data from multiple sources to decrease the dwell time of an attack?
Security orchestration, automation, and response (SOAR)
193
A simulated cyber-attack from an outside
Penetration testing
194
(white box) testing is conducted with the security tester having in-depth knowledge of the system or application being tested
Known Environment
195
(black box) testing is conducted with the security tester has no knowledge of the system or application being tested
Unknown Environment
196
(gray box) testing is conducted with the security tester is given limited knowledge of the system or application being tested
Partially Known Environmental
197
the scope and boundaries of the penetration test
Rules of engagement
198
refers to an attacker pivoting to other devices within a network
Lateral Movement
199
An attacker can install a backdoor to maintain or regain access to a compromised system
Persistence
200
involves engaging with the system to collect information that’s otherwise not publicly available
Active Reconnaissance
201
to open-source techniques of information gathering such as Google to gather information on a target
Passive Reconnaissance
202
is the act of gathering initial information regarding the target system or application
Foot printing
