Domain 4.0: Operations and Incident Response

Question 1

___ command line tool that tests network connectivity. good troubleshooting tool for determining whether a route is available to a host

Answer 1

ping: test reachability–determine round trip time, uses Internet control message protocol (ICMP), primary troubleshooting tools

Question 2

___ network scanning tool that is often used in security auditing

Answer 2

nmap: network mapper–learn more about network devices, identify open ports/port scan, OS scan, service scan (version, name, details), additional scripts like Nmap scripting engine (NSE) that extends capabilities and does vulnerability scans

Question 3

____ shows network statistics, including the protocol, local address, foreign address, and connection

Answer 3

netstat: network statistics: OS, show active connections, show binaries, do not resolve names

Question 4

____ is a network utility for gathering information from transport layer network connections

Answer 4

netcat: read or write to the network: open a port and send/receive traffic, lisen on port number, transfer data, scan ports and send data to a port, become a backdoor by running shell from a remote device

Question 5

__ and ____ are troubleshooting tools that query DNS servers

Answer 5

dig (domain information groper)– more advanced domain information, nslookup–lookup info from DNS servers: canonical names, IP addresses, cache timers, etc.

Question 6

___, ___ and __ are common command line tools for file display and manipulation

Answer 6

head (view first few lines of file: head -n[# of lines to show] [name of file]), tail (view last few lines of file, same format as head for command line), cat (combine file/files into another file: cat [file1.txt] [file2.txt] or cat [file1.txt] [file2.txt] > [both.txt]

Question 7

python is a ____-purpose programming

Answer 7

general

Question 8

___ is a packet analyzer tool to capture TCP/IP packets

Answer 8

tcpdmp (capture packets from command line, write packets to a file)

Question 9

_____ is a command line shell and scripting interface for Microsoft windows environments

Answer 9

powershell

Question 10

label 5 forensics tools

Answer 10

dd (create a bit by bit copy of a drive, create a disk image or restore from a disk image), Memdump (copy info in system memory to the standard output stream, memory dump, copy to another host across the network), WinHex (universal hexadecimal editor for Windows, edit disks, files, RAM, disk cloning, secure wipe), FTK Imager (drive imagining tool, supports for many different file systems and full disk encryption methods) and autopsy (digital forensics on hard drives, smartphones, extract many different data types)

Question 11

_____ ____ can be placed inline or in between the devices from which you want to capture traffic

Answer 11

protocol analyzers

Question 12

most common firewall config _____ include permissions for traffic to run from any source to any destination, unnecessary services running, weak authentication and log file negligence

Answer 12

errors

Question 13

a ____ web content filter can either prevent legitimate content or allow prohibited content

Answer 13

misconfigured

Question 14

____ authorization should be required before conducting vulnerability or penetration tests

Answer 14

written

Question 15

____ ____ ____ includes preparation, identification, containment, eradication, recovery, and post-incident events such as lessons learned

Answer 15

incident response process

Question 16

order of ____ describes the order in which evidence should be collected, from the most volatile systems to the least volatile

Answer 16

volatility

Question 17

data in __ and ____ or ___ files is considered the most volatile

Answer 17

RAM (random access memory: browsing history, clipboard info, encryption keys, command history), swap/paging/pagefile (a place to store RAM when memory is depleted, similar to a RAM dump)

Question 18

____ of ___ ensures that evidence is properly handled

Answer 18

chain of custody

Question 19

data ____ during and after an incident includes capturing system images, traffic logs, video, time offset, hashes, screenshots and witness interviews

Answer 19

acquisition

Question 20

_____ ____ is a framework similar to a kill chain and provides a reference for incident response

Answer 20

MITRE ATT&CK:
identify point of intrusion
understand methods used to move around
identify potential security techniques to block future attacks

Question 21

the ____ ____ of ____ ____ places the basic components of malicious activity at one of 4 points: adversary, infrastructure, capability and victim

Answer 21

diamond model of intrusion analysis

Question 22

____ responses exercises can be discussion oriented or simulated

Answer 22

incident

Question 23

____ and _____ ensure the restoration of organizational functions in the shortest possible time, even if services resume at a reduced level of effectiveness or availability

Answer 23

BCP (business continuity plan), COOP (continuity of operations plan)