Domain 4 Flashcards
1
Q
What commands display the route a packet takes to a destination, recording the number of hops along the way
These are excellent tools to use to see where a packet may get hung up during transmission
A
tracert and trace-route
2
Q
If you want to query a DNS server, you can use this command on Windows or this command on Linux .you can Query for individual DNS record
A
nslookup/dig
3
Q
To obtain the network information about a host, you can use this command on Windows or the same command on Linux
A
ipconfig/ifconfig
4
Q
What is an open-source security scanner You can use it to scan hosts for vulnerabilities, scan for open ports, or fingerprint remote hosts to find out which operating systems they run
This tool is very useful for analyzing an environment
A
Nmap
5
Q
This command is used to test connectivity between systems
This command is a multi-platform utility, originally written for UNIX, that uses ICMP to communicate with remote hosts
A
ping/pathping
6
Q
is a TCP/IP packet creation tool that allows a user to craft raw IP, TCP, UDP, and ICMP packets from scratchThis tool provides a means of performing a wide range of network operations; anything that you can do with those protocols can be crafted into a packet
A
Hping
7
Q
The ____ command enables you to look at the current network communications on a host You can use it to look for listening Ports and established connections
A
Netsat
8
Q
What is the network utility designed for Linux environments. What is a network tool that can be used to perform network troubleshooting, explore networks or scan for open ports
A
Netcat
9
Q
What scan IP networks and can report on the status of IP addresses
There are a wide range of free and commercial scanning tools
A
IP scanners
10
Q
The ___ command is used to display the ____ table on a host
It can also be used to delete ARB entries in a table
A
Arp
11
Q
What command works in Linux and Windows systems to provide information on current routing parameters and to manipulate these parametersIn addition to listing the current routing table, it has the ability to modify the table
A
Route
12
Q
What is a tool designed to transfer data to or from a server, without user interaction
It works on both Linux and Windows systems
A
Curl
13
Q
What is a Python-based program designed to assist penetration testers in the gathering of information during the reconnaissance portion of a penetration test This is a useful tool for exploring what is publicly available about your organization on the Web
A
theHarvester
14
Q
What is a Linux-based tool used by penetration testers. What is the automated scanner designed to collect a large amount of information while scanning for vulnerabilities
A
Sn1per
15
Q
What is a command-line utility to interface with websites that can perform port scans as part of a penetration testWhen you use this tool, the source IP address for the scan is the website, not your testing machine
A
Scanless
16
Q
What is a Perl script designed to enumerate DNS information. This will enumerate DNS entries, including subdomains, MX records, and IP addresses
DNS enumeration can be used to collect information such as user names and IP addresses of targeted systems
A
Dnsenum
17
Q
What is one of the leading vulnerability scanners in the marketplaceIt comes in a free version, with limited IP address capability, and fully functional commercial versions. What is designed to perform a wide range of testing on a system
A
Nessus
18
Q
What is a sandbox used for malware analysis. What is designed to allow a means of testing a suspicious file and determining what it does It is open source, free software that can run on Linux and Windows
A
Cuckoo
19
Q
What is a utility designed to return the first lines of a file. A common option is the number of lines one wishes to return
A
Head
20
Q
What is a utility designed to return the last lines of a file
A common option is the number of lines one wishes to return
A
Tail
21
Q
What is a Linux command, short for concatenate, that can be used to create and manipulate files
A
Cat
22
Q
What is a Linux utility that can perform pattern-matching searches on file contents
A
Grep
23
Q
What is the Linux command used to change access permissions of a file
The general form of the command ischmod<options> <permissions> <filename></filename></permissions></options>
A
Chmod
24
Q
The Linux command loggeris how you can add log file information to /var/log/syslog
The ______ command works from the command line, from scripts, or from other files, thus providing a versatile means of making log entries
A
Logger
25
What is a cryptographically secured means of communicating and managing a network
This uses port 22 and is the secure replacement for Telnet
SSH
26
What is a Microsoft Windows-based task automation and configuration management framework, consisting of a command-line shell and scripting language. This is a powerful command-line scripting interface. These files use the .ps1 file extension
PowerShell
27
This is a computer language commonly used for scripting and data analysis tasks facing system administrators and security personnel
This is a general-purpose computer programming language that uses the file extension
Python
28
What is a general-purpose cryptography library that offers a wide range of cryptographic functions on Windows and Linux systems
Designed to be a full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, it provides so much more for real-world daily challenges
OpenSLL
29
What is the name for both a tool and a suite of tools
As a suite, this is a group of free, open source utilities for editing and replaying previously captured network trafficAs a tool, it specifically replays a PCAP file on a network
Tcpreplay
30
This utility is designed to analyze network packets either from a network connection or a recorded fileYou also can use this to create files of packet captures, called PCAP files, and perform filtering between input and output, making it a valuable tool to lessen data loads on other tools
Tcpdump
31
Whatis the gold standard for graphical analysis of network protocol
lsWith dissectors that allow the analysis of virtually any network protocol, this tool can allow you toexamine individual packets, monitor conversations, carve out files, and more
Wireshark
32
What is the use of specific methods to determine who did what on a system at a specific time, or some variant of this question Computers have a wide range of artifacts that can be analyzed to make these determinations
Forensics
33
What is a Linux command-line utility used to convert and copy files
On Linux systems, virtually everything is represented in storage as a file, and this can read and/or write from/to these files, provided that function is implemented in the respective drivers
Data Dump dd
34
This program dumps system memory to the standard output stream, skipping over any holes in memory maps
By default, the program dumps the contents of physical memory (/dev/mem). The output from this is in the form of a raw dump
Memedump
35
What is a hexadecimal file editor
This tool is very useful in forensically investigating files, and can examine specific application files without invoking the application and changing the data
WinHex
36
What is the company AccessData’s answer to dd. This is a commercial program, free for use, and is designed to capture an image of a hard drive (or other device) in a forensic fashion
FTK imager
37
This is the open source answer for digital forensic tool suites
It runs on Windows and offers a comprehensive set of tools that can enable network-basedcollaboration and automated, intuitive workflows
Autopsy
38
What are toolsets designed to assist hackers in the tasks associated with exploiting vulnerabilities in a system
These frameworks are important because the exploitation path typically involves multiple steps, all done in precise order on a system to gain meaningful effect
Exploitation frameworks
39
What is a tool that tries to obtain access credentials without authorization. These work using dictionary lists and brute force
password cracker
40
These tools are tools used to destroy, purge, or otherwise identify for destruction specific types of data on systems
Before a system can be retired and disposed of, you need to sanitize the data needs
Data sanitization
41
This the describes the steps an organization performs in response to any situation determined to be abnormal in the operation of a computer system or network
Incident response plans
42
What is the set of actions security personnel perform in response to a wide range of triggering events
1.Preparation2.Identification3.Containment4.Eradication5.Recovery6.Lessons learned
Incident response process
43
What the phase of incident response that occurs before a specific incident
This includes all the tasks needed to be organized and ready to respond to an incident
Preparation
44
What is the process where a team member suspects that a problem is bigger than an isolated incident and notifies the incident response team for further investigationA
n incident is defined as a situation that departs from normal, routine operations
Identification
45
What is the set of actions taken to constrain the incident to a minimal number of machines
This preserves as much of production as possible and ultimately makes handling the incident easier
Containment
46
What involves removing the problem, and in today’s complex system environment, this may mean rebuilding a clean machine
A key part of operational eradication is the prevention of reinfection
Eradication
47
What is the process of returning the asset into the business function and restoring normal business operationsThe recovery process includes the steps necessary to return the system and applications to operational status
Recovery
48
What phase serves two distinct purposes
The first is to document what went wrong and allowed the incident to occur in the first place
The second is to examine the incident response process itself
Lessons learned
49
What exercise is one that is designed for the participants to walk through all the steps of a process, ensuring all elements are covered and that the plan does not forget a key dataset or personThis is typically a fairly high-levelreview, designed to uncover missing or poorly covered elements
tabletop
50
How do you examine the actual steps that take place associated with a process, procedure, or event
What are in essence a second set of eyes, where one party either explains or demonstrates the steps to perform a task while a second person observes
Walkthroughs
51
what is an approximation ofthe operation of a process or system that is designed to represent the actual system operations over a period of timeThe simulation can be used in place of systems or elements that are not practical to replicate during an exercise
Simulations
52
What framework is a knowledgebase of various real-world observations and attack techniquesIt is often used by organizations for threat modeling
MITRE ATT&CK
53
What is a cognitive model used by the threat intelligence community to describe a specific event
The Diamond Model enables intrusion analysis by placing malicious activity at four points of the diamond: adversary, infrastructure, capability, and victim
The Diamond Model of Intrusion Analysis
54
Developed by Lockheed Martin, what is is a framework used to defend against the chain of events an attacker takes, from the beginning of an attack to the end of an attackThis model has a series of distinct steps that an attacker usesduring a cyberattack—from the early reconnaissance stages to the exfiltration of data
Cyber Kill Chain
55
What is Having a management process, including defined personnel roles and responsibilities, is essential for the management of the stakeholders and their relationships during incidents
Stakeholder management
56
as part of the incident response effort that answers the preceding questions and defines responsibilities for communication is a key element to be developed during the preparation phase
communication plan
57
What is critical for effective disaster recovery efforts. This defines the data and resources necessary and the steps required to restore critical organizational processes
A disaster recovery plan
58
What is a long-term strategy to ensure the business will continue to operate (critical business functions/services) before, during, and after a disaster is experienced
The focus of this is the continued operation of the essential elements of the business or organization
Business continuity planBCP
59
What is designed in order to maintain operations during a disasterThe overall goal of this is to determine which subset of normal operations needs to be continued during periods of disruption
Continuity of operations planning (COOP)Continuity of Operations Plan (COOP)
60
What is composed of the personnel who are designated to respond to an incident
The incident response plan should identify the membership and backup members, prior to an incident occurring
The cyber incident response team (CIRT)
61
Which Data retention is the storage of data records
One of the first steps in understanding data retention in an organization is the determination of what records require storage and for how long
Retention policies
62
A vulnerability report provides you information on what is visible on your network, authorized or not
Vulnerability scan output
63
What allows you to identify, visualize, and monitor trends via alerts within a dashboard view
SIEM dashboards
(security information and event management)
64
What are the devices that provide security data that is important for investigators
Sensor placement begins with defining collection objectives
Sensors
65
What is the quality of being quick to detect or respond to slight changes, signals, or influencesAs the purpose of a SIEM system is to alert operators to changes that indicate significant events, sensitivity to those events is important
Sensitivity
66
What are a series of data points that indicate a change over time. They can be increasing, decreasing, cyclical, or related to variability What is important is that this indicates some form of change
Trends
67
What is the primary method of communication between the SIEM system and operators
When conditions meet the rule requirements, the SIEM system can send this
Alerts
68
This is the process of establishing a relationship between two variables
SIEM event ________ logs are extremely useful because they can be used to identify malicious activity across a plethora of network devices and programs
Correlation
69
What are a primary source of information during an investigation Software can record in this in a wide range of information as it is operating
Log files
70
What are filled with equipment that can provide valuable log information
Firewalls, routers, load balancers, and switches can provide a wealth of information as to what is happening on the network
Network
71
These logs can provide a very detailed history of what actions were performed on a system
Login records that indicate failed logins can be important, but so can entries that show login success
System
72
What logs are generated by the applications themselves as they runSome applications provide extensive logging; others minimal or even no logging
Application
73
What logs are logs kept by the OS for metadata associated with security operations
The driving force for what needs to be recorded is the system’s audit policy, a statement about what records need to be
Security
74
What servers respond to specific, formatted requests for resources with responses, whether in the form of a web page or an error and all of this activity can be logged
Web
75
What logs, when enabled, can contain a record for every query and responseThis can be a treasure trove of information for an investigator because it can reveal malware calling out to its command-and-control server, or data transfers to non-company locations
DNS
76
What logs contain information about successful and failed authentication attempts
The most common source of authentication log information comes from the system’s security logs, but additional sources exist as well
Authentication
77
What are copies of what was in memory at a point in time—typically a point when some failure occurred
Dump files can be created by the operating system (OS) when the OS crashes, and these files can be analyzed to determine the cause of the crash
Dump files
78
What call manager applications enable a wide range of audio and video communication services over the Internet
These systems can log a variety of data, including call information such as the number called (to and from), time of the call, and duration of the call
VoIP and call managers
79
What is a text-based protocol used for signaling voice, video, and messaging applications over IPSIP provides information for initiating, maintaining, and terminating real-time sessions
Session Initiation Protocol (SIP)
80
What stands for System Logging Protocol and is a standard protocol used in Linux systems to send system log or event messages to a specific server, called a syslog server
Syslogs
81
What is the command that is used to view logs created through through the systemd-journald serviceWhen systemd creates log files, it does so through the systemd- service
Journald
82
How do both extend the original syslog standard by adding capabilities such as content filtering, log enrichment, and correlation of data elements into higher-level events
Rsyslog and syslog-ng
83
What is a multiplatform log management tool designed to assist in the use of log data during investigations
This tool suite is capable of handling syslog-type data as well as other log formats
NXLog
84
What are utilities designed to measure network bandwidth utilization over time
Bandwidth monitors can provide information as to how much bandwidth is being utilized, by service type, and how much remains
Bandwidth monitors
85
What data about data
A file entry on a storage system has the file contents plus metadata, including the filename, creation, access, and update timestamps, size, and moreDigital contains metadata, and correlating metadata is a part of almost every investigation
Metadata
86
How is metadata is in the header of the e-mail and includes routing information, the sender, receiver, timestamps, subject, and other information associated with the delivery of the message
E-mail header data can be important in investigations
Email
87
What devices generate, store, and transmit metadataCommon fields include when a call or text was made, whether it was an incoming or outgoing transmission, the duration of the call or the text message’s length (in characters), and the phone numbers of the senders and recipients
Mobile
88
What browsers store different metadata covering what pages were accessed and whenBrowser metadata is a commonly used source of forensic information, because entries of what and when a browser has accessed data can be important
Web
89
What metadata comes in two flavors: system and applicationThe file system uses metadata to keep track of the filename as well as the timestamps associated with last access, creation, and last write
File
90
What is a proprietary standard from CiscoFlow data is generated by the network devices themselves, including routers and switches
NetFlow
91
Both NetFlow and sFlowcollect packets from routers and switches
This is used primarily for traffic management
sFlow
92
What is a protocol that’s the answer to the proprietary Cisco NetFlow standard
what is based on NetFlow version 9 and is highly configurable using a series of templates
IPFIXInternet Protocol Flow Information Export (IPFIX)
93
(also known as a packet sniffer, network analyzer, or network sniffer) is a piece of software or an integrated software/hardware system that can capture and decode network traffic
Protocol analyzer
94
This application approved list consists of a list of allowed applications
If an application is not on the allowed list, it is blocked
Application approved
95
What use of an application block or deny list is essentially noting which applications should not be allowed to run on the machine
This is basically a permanent “ignore” or “call block” type of capability
Application blocklist/deny list
96
What is item is to render it disabled but not permanently removed from the system
There are a variety of mechanisms to do this, but the end result is the same: a quarantine option gives the user the opportunity to undo the disablement
Quarantine
97
Protecting a system from configuration changes is essential to secure the system in the specific configuration that the implementation intended
Configuration changes
98
What have directionality; there are inbound and outbound rules. Inbound rules protect a machine from incoming traffic Outbound rules can also protect against sending data (including requests) to unauthorized or dangerous places
Firewall rules
99
What is a collective set of commonly employed protection elements associated with mobile devices
Mobile device management (MDM)
100
What refers to technology employed to detect and prevent transfers of data across an enterprise
Employed at key locations, DLP technology can scan packets for specific data patterns
Data loss prevention (DLP)
101
What are used to limit specific types of content across the Web to users
A common use is to block sites that are not work related, and to limit items such as Google searches and other methods of accessing content determined to be inappropriate
Content filter/URL filter
102
What Certificates remain valid for a specific duration of time
When a certificate is about to expire, it should be renewed if needed
Update or revoke certificates
103
What is the use of networking protocols and resultant connectivity to limit access to different parts of a networkThis limit can be partial or it can be complete, as offered by an air gap, and this method of separation is used to enforce different trust boundaries
Isolation
104
What the act of performing specific actions that limit the damage potential of an incident, keeping the damage limited, and preventing further damage
Authentications
105
What applies to networking security, is a broad term
VLANs, firewalls, and even storage segmentation and containerization can be used for segmentation purposes
Segmentation
106
What systems are extremely valuable when it comes to incident mitigation of severe threats because they can automate data gathering and initiate threat response
SOAR
107
What consists of a series of action-based conditional steps to perform specific actions associated with security automation
A runbook typically focuses on technical aspects of computer systems or network
Runbooks
108
What is a set of approved steps and actions required to successfully respond to a specific incident or threat this is more comprehensive than a runbook and has more of a people/general business focus
Playbooks
109
What legal hold is the process by which you properly preserve any and alldigital evidence related to a potential case
Once an organization receives this notice, it is required to maintain a complete set of unaltered data, including metadata, of any and allinformation related to the issue causing the legal hold
Legal hold
110
What allow high-bandwidth data collection that can show what was connected to what, how things were laid out, desktops, and so forth
Video
111
AdmissibilityFor evidence to be credible, especially if it will be used in court proceedings or in corporate disciplinary actions that could be challenged legally, it must meet three standards:
•________ evidence - The evidence must be convincing or measure up without question
•________ evidence - The evidence must be legally qualified and reliable
•________evidence The evidence must be material to the case or have a bearing on the matter at hand
Admissibility
1. Sufficient 2. Competent evidence. 3. Relevant evidence
112
What shows who obtained the evidence, when and where it was obtained, where it was stored, and who had control or possession of the evidence for the entire time since the evidence was obtained
Chain of custody
113
What events refers to the specifics, including the metadata to document it, demonstrating the sequence of events as recorded by the computer The sequence can be very important because it provides key clues as to what actually happened, even when there is not a direct artifact
Timelines of sequence
114
What are metadata entries associated with artifacts in a computer systemWhile a log entry may have a this, some items can have multiple of this, stored in multiple locations
Time Stamps
115
What is the difference in time between the system clock and the actual time
Computers keep their own internal time, but to minimize record time offset, most computers sync their time over the Internet with an official time source
Time offset
116
What Physical serialized tags are attached to each evidence item, and the tag number is used to identify a specific itemFrequently the evidence items are then stored in anti-static bags to protect them from damage
Tags
117
What are the official descriptions of the forensic data
Reports can have a variety of elements—from pure descriptive information, such as machine/device identifiers (make, model and serial number), to information on the data, including size and hash values
Report
118
When you have an idea of what information you will want to be able to examine, you can make an active logging plan that ensures the information is logged when it occurs
Event logs
119
What witness preparation can be critical in a case, even for technical experts
Interviews
120
What refers to the collection of information that may be evidence in an investigation
Evidence consists of the documents, verbal statements, and material objects admissible in a court of law
Acquisition
121
Following is the order of volatility of digital information in a system:
1.CPU, cache, and register contents (collect first)
2.Routing tables, ARP cache, process tables, kernel statistics
3.Live network connections and data flows
4.Memory (RAM)
5.Temporary file system/swap space
6.Data on hard disk
7.Remotely logged data
8.Data stored on archival media/backups (collect last
Order of volatility
122
What physical hard disk drive (HDD) will persist data longer than a solid state drive (SSD)Some of the key elements are the use of write blockers when making forensic copies and protecting media from environmental change factors
Disk
123
What is the working memory of the computer that handles the current data and programs being processed by the CPU
This memory, once limited to a single megabyte, now commonly consists of 4 GB or more
Random-access memory (RAM)
124
The swapor pagefileis a structure on a system’s disk to provide temporary storage for memory needs that exceed a system’s RAM capacity
The operating system has provisions to manage the RAM and pagefile, keeping in RAM what is immediately needed and moving excess to the pagefile when RAM is full
Swap/pagefile
125
What is the source of many forensic artifacts, most of which are created to enhance system responsiveness to user requests
The two major OSs, Microsoft Windows and Linux, perform basically the same tasks: they enable applications to perform on a system
OS
126
One of the most common acquisitions is USB storage devices These are used to transport files between machines and are common in any case where the removal of information is suspected
Device
127
What is a set of software that is associated with a physical device. It can be of interest in a forensics investigation when the malfunctioning of a device is an issue, as malware has targeted the firmware
Firmware
128
This, as you can easily guess, is a picture of a particular moment in timeSnapshots are common in virtual machines, providing a point in time to which the machine can be recovered
Snapshot
129
What are temporary storage locations for commonly used items and are designed to speed up processing. They exist all over in computer systems and are performance-enhancing items
Cache
130
There can be a lot of useful information in the logs associated with network infrastructure
The level and breadth of this information is determined by the scope of the investigation
Network
131
What the key element in modern digital forensics. Most of the items used to demonstrate a specific action as occurring fall into one of two categories: metadata or OS
Artifacts
132
The issues associated with on with respect to forensics is one dominated by access
Premises Vs Cloud
133
What clause is critical requirement of any service level agreement, and its specificity needs to match the operational and regulatory scope of the cloud engagemen
Right-to-audit clauses
134
Whether on premises or in the cloud, there will be cases where regulatory or law enforcement actions raise jurisdictional issuesIt is important to consult with the company’s legal counsel to understand the ramifications of data location with respect to forensics and subsequent data use
Regulatory/jurisdiction
135
Many forensic investigations are related to the theft of intellectual property, and many times that is also a breach of data protected under privacy laws
Data breach notification laws
136
If a subsequent hash created on the same data stream results in a different hash value, it usually means that the data stream was changed
Hashing
137
A value is a small piece of data derived from the data being protectedThe primary purpose of this is to validate the authenticity of data (for example, that it hasn’t changed)
Checksums
138
What is a reference to the origin of data. In the case of digital forensics, it is not enough to present a specific data element as “proof ”; one must also show where it came from
Provenance
139
What is the term used for the document and data production requirements as part of legal discovery in civil litigation
E-discovery
140
What is a digital forensics sense is associated with determining the relevant information for the issue at hand—simply stated, recover the evidence associated with an act
Data Recovery
141
What is a characteristic that refers to the inability to deny an action has taken place
This can be a very important issue in transactions via computers that involve money or things of value
Non-Repudiation
142
What is gathering is the use of all resources to make determinationsThis can make a large difference in whether or not a firm is prepared for threats
Strategic intelligence/counterintelligence
