Domain 7 - Security Operations Flashcards

1
Q

These allow access to objects such as files.

A

Permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

These refer to the ability to take actions.

A

Rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

the combination of both rights and permissions.

A

Privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This imposes the requirement to grant users access only to data or resources they need to perform assigned work tasks.

A

need to know principle. data = need to know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This states that subjects are granted only the privileges necessary to perform assigned work tasks and no more.

A

principle of least privilege. actions = least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

This refers to the amount of privileges g t ranted to users, typically when first provisioning an account. In other words, when administrators create user accounts, they ensure the accounts are provisioned with the appropriate amount of resources, and this includes privileges.

A

Entitlement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In the context of least privilege, this refers to the amount of privileges that users collect over time. For example, if a user moves from one department to another while working for an organization, this user can end up with privileges from each department.

A

Aggregation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This extends the trust relationship between the two security domains to all of their subdomains. Within the context of least privilege, it’s important to examine these trust relationships, especially when creating them between different organizations.

A

Transitive Trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This ensures that no single person has total control over a critical function or system. This is necessary to ensure that no single person can compromise the system or its security. Instead, two or more people must conspire or collude against the organization, which increases the risk for these people.

A

Separation of duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

These models provide fully functional applications typically accessible via a web browser. For example, Google’s Gmail

A

Software as a Service (SaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

These models provide consumers with a computing platform, including hardware, an operating system, and applications. In some cases, consumers install the applications from a list of choices provided by the CSP. Consumers manage their applications and possibly some configuration settings on the host. However, the CSP is responsible for maintenance of the host and the underlying cloud infrastructure.

A

Platform as a Service (PaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

These models provide basic computing resources to consumers. This includes servers, storage, and in some cases, networking resources. Consumers install operating systems and applications and perform all required maintenance on the operating systems and applications. The CSP maintains the cloud-based infrastructure, ensuring that consumers have access to leased systems.

A

Infrastructure as a Service (IaaS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 5 steps involved in managing a computer security incident response.

A

Response, Mitigation, Reporting, Recovery, Remediation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

This examines the incident to determine what allowed it to happen. For example, if attackers successfully accessed a database through a website, personnel would examine all the elements of the system to determine what allowed the attackers to succeed.

A

root cause analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attacks that prevent a system from processing or responding to legitimate traffic or requests for resources and objects.

A

Denial-of-service (DoS) attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This is a common DoS attack. It disrupts the standard three-way handshake used by TCP to initiate communication sessions.

A

SYN flood attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

This is another type of flood attack, but it floods the victim with Internet Control Message Protocol (ICMP) echo packets instead of with TCP SYN packets. More specifically, it is a spoofed broadcast ping request using the IP address of the victim as the source IP address.

A

smurf attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

These are similar to smurf attacks. However, instead of using ICMP, this attack uses UDP packets over UDP ports 7 and 19. This attack will broadcast a UDP
packet using the spoofed IP address of the victim. All systems on the network will then send traffic to the victim, just as with a smurf attack.

A

Fraggle attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This floods a victim with ping requests. This can be very effective when launched by zombies within a botnet as a DDoS attack.

A

ping flood attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This attack employs an oversized ping packet. Ping packets are normally 32 or 64 bytes, though different operating systems can use other sizes. This attack changed the size of ping packets to over 64 KB, which was bigger than many systems could handle. When a system received a ping packet larger than 64 KB, it resulted in a problem. In some cases
the system crashed.

A

ping-of-death attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An attacker fragments traffic in such a way that a system is unable to put data packets back together.

A

teardrop attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

This occurs when the attacker sends spoofed SYN packets to a victim using the victim’s IP address as both the source and destination IP address. This tricks the system into constantly replying to itself and can cause it to freeze, crash, or reboot.

A

land attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

This refers to an attack on a system exploiting a vulnerability that is unknown to others.

A

zero-day exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Any script or program that performs an unwanted, unauthorized, or unknown activity on a computer system.

A

Malicious code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

code downloaded and installed on a user’s system without the user’s knowledge.

A

drive-by download

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

This attack occurs when a malicious user is able to gain a position logically between the two endpoints of an ongoing communication.

A

man-in-the-middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

This means using a modem to search for a system that accepts inbound connection attempts.

A

War dialing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

This is the most common method of detection. It uses a

database of known attacks developed by the IDS vendor.

A

Knowledge-based Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

This type of detection starts by creating a baseline of normal activities and events on the system. Once it has accumulated enough baseline data to determine normal activity, it can detect abnormal activity that may indicate a malicious intrusion or event.

A

Behavior-based Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A portion of allocated IP addresses within a network that are not used. It includes one device configured to capture all the traffic into this area of the network. Since the IP addresses are not used, it does not have any other hosts and it should not have any traffic at all.

A

a darknet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

An individual computers created as a trap for intruders.

A

Honeypots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Two or more networked honeypots used together to simulate a network.

A

honeynet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

false vulnerabilities or apparent loopholes intentionally implanted in a system in an attempt to tempt attackers. They are often used on honeypot systems to emulate
well-known operating system vulnerabilities. Attackers

A

Pseudo flaws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

This system is similar to a honeypot, but it performs intrusion isolation using a different approach. When an IDS detects an intruder, that intruder is automatically transferred to this system. It has the look and feel of an actual network, but the attacker is unable to perform any malicious activities or access any confidential data from within this location.

A

A padded cell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

A zero-knowledge team knows nothing about the target site except for publicly available information, such as domain name and company address.

A

Black-Box Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

A full-knowledge team has full access to all aspects of the target environment. They know what patches and upgrades are installed, and the exact configuration of all relevant devices. If the target is an application, they would have access to the source code.

A

White-Box Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

A partial-knowledge team that has some knowledge of the target performs gray-box testing, but they are not provided access to all the information.

A

Gray-Box Testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

the process of extracting specific elements from a large collection of data to construct a meaningful representation or summary of the whole.

A

Sampling

39
Q

This is a form of nonstatistical sampling. It selects only events that exceed a level , which is a predefined threshold for the event. The system ignores events until they reach this threshold.

A

Clipping

40
Q

This refers to monitoring outgoing traffic to prevent data ex-filtration, which is the unauthorized transfer of data outside the organization.

A

Egress monitoring

41
Q

the practice of embedding a message within a file. For example, individuals can modify bits within a picture file to embed a message.

A

Steganography

42
Q

the records created by recording information about events and occurrences into one or more databases or log files. They are used to reconstruct an event, to extract information about an incident, and to prove or disprove culpability.

A

Audit trails

43
Q

any component that can cause an entire system to fail.

A

single point of failure

44
Q

the ability of a system to suffer a fault but continue to operate.

A

Fault tolerance

45
Q

refers to the ability of a system to maintain an acceptable level of service during an adverse event.

A

System resilience

46
Q

This is also called striping. It uses two or more disks and improves the disk subsystem performance, but it does not provide fault tolerance.

A

RAID-0

47
Q

This is also called mirroring. It uses two disks, which both hold the same data. If one disk fails, the other disk includes the data so a system can continue to operate after a single disk fails.

A

RAID-1

48
Q

This is also called striping with parity. It uses three or more disks with the equivalent of one disk holding parity information. If any single disk fails, the RAID array will continue to operate, though it will be slower.

A

RAID-5

49
Q

This is also known as RAID 1 + 0 or a stripe of mirrors, and is configured as two or more mirrors (RAID-1) configured in a striped (RAID-0) configuration. It uses at
least four disks but can support more as long as an even number of disks are added. It will continue to operate even if multiple disks fail, as long as at least one drive in each mirror continues to function.

A

RAID-10

50
Q

a quick instance of an increase in voltage

A

spike

51
Q

a quick instance of a reduction in voltage.

A

sag

52
Q

when voltage remains low for a long period of time

A

brownout

53
Q

If power stays high for a long period of time, it’s called

A

surge

54
Q

system will default to a secure state in the event of a failure, blocking all access.

A

fail-secure

55
Q

system will fail in an open state, granting all access.

A

fail-open

56
Q

Four types of trusted recovery that is relevant to system resilience and listed in Common Criteria

A

Manual Recovery, Automated Recovery, Automated Recovery without Undue Loss, Function Recovery

57
Q

If a system fails, it does not fail in a secure state. Instead, an administrator is required to manually perform the actions necessary to implement a secured or trusted recovery after a failure or system crash.

A

Manual Recovery

58
Q

The system is able to perform trusted recovery activities to restore itself against at least one type of failure. For example, a hardware RAID provides automate drecovery against the failure of a hard drive but not against the failure of the entire server. Some types of failures will require manual recovery.

A

Automated Recovery

59
Q

This is similar to automated recovery in that a system can restore itself against at least one type of failure. However, it includes mechanisms to ensure that specific objects are protected to prevent their loss. An example would include steps to restore data or other
objects. It may include additional protection mechanisms to restore corrupted files, rebuild data from transaction logs, and verify the integrity of key system and security components.

A

Automated Recovery without Undue Loss

60
Q

Systems that support function recovery are able to automatically recover specific functions. This state ensures that the system is able to successfully complete the recovery for the functions, or that the system will be able to roll back the changes to
return to a secure state.

A

Function Recovery

61
Q

The network capacity available to carry communications.

A

Bandwidth

62
Q

The time it takes a packet to travel from source to destination.

A

Latency

63
Q

The variation in latency between different packets.

A

Jitter

64
Q

Some packets may be lost between source and destination, requiring retransmission.

A

Packet Loss

65
Q

Electrical noise, faulty equipment, and other factors may corrupt the contents of packets.

A

Interference

66
Q

standby facilities large enough to handle the processing load of an organization and equipped with appropriate electrical and environmental support systems. They have no computing facilities (hardware or software) preinstalled and also has no active broadband communications links.

A

Cold sites

67
Q

a backup facility is maintained in constant working order, with a full complement of servers, workstations,
and communications links ready to assume primary operations responsibilities. The servers and workstations are all preconfigured and loaded with appropriate operating system and application software. The data is periodically or continuously updated.

A

hot site

68
Q

These sites always contain the equipment and data circuits necessary to rapidly establish operations. This equipment is usually preconfigured and ready to run
appropriate applications to support an organization’s operations. However, they do not typically contain copies of the client’s data

A

warm sites

69
Q

Activation of this type of site usually takes at least 12 hours from the time a disaster is declared.

A

warm sites

70
Q

a company that leases computer time. They own large server farms and often fields of workstations. Any organization can purchase a contract from them to consume some portion of their processing capacity. Access can be on site or remote.

A

service bureau

71
Q

two organizations pledge to assist each other in the event of a disaster by sharing computing facilities or other technological resources.

A

Mutual assistance agreements (MAAs)

72
Q

database backups are moved to a remote site using bulk transfers. The remote location may be a dedicated alternative recovery site (such as a hot site) or simply an offsite location managed within the company or by a contractor for the purpose of maintaining backup data.

A

electronic vaulting; keyword is batch sending of data. for example every hour.

73
Q

data transfers are performed in a more expeditious manner. Data transfers still occur in a bulk transfer mode, but they occur on a more frequent basis, usually
once every hour and sometimes more frequently. Unlike electronic vaulting scenarios, where entire database backup files are transferred, these setups transfer copies of the database transaction logs containing the transactions that occurred since the previous bulk transfer.

A

remote journaling- keyword transaction logs

74
Q

the most advanced database backup solution and the most expensive! A live database server is maintained
at the backup site. The remote server receives copies of the database modifications at the same time they are applied to the production server at the primary site. Therefore, the remote server is ready to take over an operational role at a moment’s notice.

A

Remote mirroring

75
Q

These store a complete copy of the data contained
on the protected device. They duplicate every file on the system regardless of the setting of the archive bit. Once it is complete, the archive bit on every file is
reset, turned off, or set to 0.

A

Full Backups

76
Q

These store only those files that have been modified
since the time of the most recent full or incremental backup. Only files that have the archive bit turned on, enabled, or set to 1 are duplicated. Once it is complete,
the archive bit on all duplicated files is reset, turned off, or set to 0.

A

Incremental Backups

77
Q

These store all files that have been modified since the
time of the most recent full backup. Only files that have the archive bit turned on, enabled,or set to 1 are duplicated. However they doe not change the archive bit.

A

Differential Backups

78
Q

one of the simplest tests to conduct, but it’s also one of the most critical. In this test, you distribute copies of disaster recovery plans to the members of the disaster recovery team for review.

A

read-through test

79
Q

In this type of test, often referred to as a table-top exercise , members of the disaster recovery team gather in a large conference room and role-play a disaster scenario. Usually, the exact scenario is known only to the test moderator, who presents the details to the team at the meeting. The team members then refer to their copies of the disaster recovery plan and discuss the appropriate responses to that particular type of disaster.

A

structured walk-through

80
Q

In these tests, disaster recovery team members are presented with a scenario and asked to develop an appropriate response. Some of these response measures are then tested. This may involve the interruption of noncritical business activities and the use of some operational personnel.

A

Simulation tests

81
Q

These tests involve relocating personnel to the alternate recovery site and implementing site activation procedures. The employees relocated
to the site perform their disaster recovery responsibilities just as they would for an actual
disaster. The only difference is that operations at the main facility are not interrupted. That site retains full responsibility for conducting the day-to-day business of the organization.

A

Parallel tests

82
Q

These tests operate like parallel tests, but they involve actually shutting down operations at the primary site and shifting them to the recovery site. For obvious reasons, these tests are extremely difficult to arrange, and you often encounter resistance from management.

A

Full-interruption tests

83
Q

3 requirements to be admissible evidence

A

Must be relevant to determining a fact, must be material or related to the case, and must be competent or obtained legally

84
Q

This type of evidence consists of things that may actually be brought into a court of law. In common criminal proceedings, this may include items such as a murder weapon, clothing, or other physical objects. In a computer crime case, it might include seized computer equipment, such as a keyboard with fingerprints on it or a hard drive from a hacker’s computer system.

A

Real evidence

85
Q

This type of evidence includes any written items brought into court to prove a fact at hand. This type of evidence must also be authenticated. For example,
if an attorney wants to introduce a computer log as evidence, they must bring a witness (for example, the system administrator) into court to testify that the log was collected as a routine business practice and is indeed the actual log that the system collected.

A

Documentary evidence

86
Q

This type of evidence is, quite simply, evidence consisting of the testimony of a witness, either verbal testimony in court or written testimony in a recorded deposition.

A

Testimonial Evidence

87
Q

a branch of computer forensic analysis, involves the

identification and extraction of information from storage media.

A

Media Analysis

88
Q

Forensic investigators are also often interested in the activity that tookplace over the network during a security incident. This is often difficult to reconstruct due to the volatility of network data—if it isn’t deliberately recorded at the time it occurs, it generally is not preserved.

A

Network Analysis

89
Q

What are the three-steps of an incident response process

A

Detection and identification, Response and reporting, Recovery and remediation

90
Q

The safety and welfare of society and the common good, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.

A

The Code of Ethics preamble

91
Q

List the four Code of Ethics canons

A

Protect society, the common good, necessary public trust and confidence, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession.

92
Q

a crime (or violation of a law or regulation) that is directed against, or directly involves, a computer.

A

Computer crime

93
Q

list the six categories of computer crimes.

A

military and intelligence attack, business attack, financial attack, terrorist attack, grudge attack, and thrill attack.

94
Q

Group of servers that are managed as a single logical system.

A

Server clustering. Note: not all clusters do load balancing.