Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Defense & Countermeasures > ECIHv2 Academia Questions > Flashcards

ECIHv2 Academia Questions Flashcards

1
Q

What are the Information Security Threat Categories?

A

Host Threats
Network Threats
Application Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DNS and ARP Poisoning is what type of Information Security Threat Category?

A

Network Threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A person or entity that is responsible for the incidents or has the potential to impact the security of an organization’s network is what type of actor?

A

Threat Actor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Script Kiddies, Organized Hackers and State Sponsored Attackers are all part of what?

A

Threat Actors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Recovery, Process Review and Practice are all part of which Incident Management guidelines?

A

OWASP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Jenny works on an Incident Response team for her organization. After a major incident, she is asked to check and verify as much as possible to get a positive confirmation from each party that in their opinion, everything is operating normally again. What Practice is Jenny taking part in?

A

Eradication and Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which standard specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization?

A

ISO/IEC 27001:2013

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The NERC 1300 Cyber Security standard stands for what?

A

North American Electric Reliability Corporation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Federal law requires federal agencies to report incidents to the which Incident Response Center?

A

Federal Computer Incident Repsonse Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Accurately detecting and assessing incidents are the most challenging and essential part of…

A

Signs of an Incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the advantages of an Incident Response Orchestration?

A

It includes automated alarms that detect the incident and alert the response personnel with details

It allows responders to remotely assess the incident analysis results and manage the actions

It allows responders to configure different solutions to interact and streamline incident response action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Loss of productive hours, loss of business, and loss of theft of resources are considered…

A

Tangible Costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the benefits when it comes to Incident handling and response (IH&R)?

A

The IH&R process provides a focused and structured approach for restoring normal business operations as quickly as possible after an incident

The decision to establish IH&R process is affected by inputs, complaints, and queries from all the stakeholders involved in the organization’s business processes

IH&R processes differ from organization to organization according to their business and operating environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IH&R mission statements define the ____ and _____ of the planned incident handling and response capabilities

A

Purpose and Scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Incident response procedures, also referred to as ___________, provide detailed processes to implement guidelines defined by IH&R plan and policy

A

Standard operating procedures (SOPs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which group is responsible for examining the computer network traffic for signs of incidents or attacks such as DoS, DDoS, firewall breach, or other malicious code?

A

Network Administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Organizations must implement several security controls. Which security control ensures that only selected or eligible employees have access to sensitive data, critical devices, and other necessary resources required to accomplish the assigned tasks?

A

Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Organizations must secure the network communications by implementing Packet Filters, IPsec, Virtual Private Network, and Secure Shell. Which is responsible for authenticating and validating the packets during transmission?

A

IPsec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A successful backup strategy must have two key features:

A

Security & Real-Time Offsite Backup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

_______ refers to a contract between the organization and an insurer to protect related individuals from different threats and risks

A

Cyber Insurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ManageEngine ServiceDesk Plus and AlienVault OSSIM are both websites used as

A

Ticketing Tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Loss of personal password, failure to download antivirus signatures, and unsuccessful scans and probes in the networks are considered incidents at a _______

A

Low Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Denial-of-Service attacks, the presence of harmful viruses, worms, and Trojan horse, or Suspected break-in in any computer of a company are all considered incidents at a _______

A

High Level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Report writing tools help incident handlers to generate efficient reports on detected incidents during incident handling and response process. What website is considered a note taking application that works on Windows, Linux, and MacOS X?

A

keepnote.org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are examples of the objective of computer forensics?

A

Identify, gather, and preserve the evidence of a cyber crime

Find vulnerabilities and security loopholes

Recover deleted and hidden files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is an important guideline for building an investigation team?

A

To appoint a person as a technical lead among the team members

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

James is a part of an incident response team that wants to ensure proper reaction against any mishap. Being forensically ready will allow him and his team to:

A

Eliminate the threat of repeated incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What refers to the first action performed after occurrence of a security incident?

A

First Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The _____ ensure that the evidence is stored, examined, preserved, and examined in a way that protects the reliability and correctness of the evidence.

A

Principles of digital evidence collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

If the victim computer has an internet connection, the first responder must?

A

Unplug the network cable from the router and modem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the process of imaging or collecting information from various media in accordance with certain standards for analyzing its forensic value?

A

Forensic Data Acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Volatile data is fragile and lost when the system loses power or the user switches it off. Where can this data be found?

A

Registries
Cache
RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are tools used to calculate the hash value?

A

HashCalc
MD5 Calculator
HashMyFiles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The incident responder should collect information regarding network connections to and from the affected system, immediately after the report of any incident. What is a tool that can help gather this information?

A

Netstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The first responder needs to prepare and check several prerequisites such as the availability of tools, reporting requirement, and ______ in order to conduct a successful investigation

A

Legal clearances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Andrea is a first responder and she wants to use forensics analysis tools to help her with collecting, managing, transferring, and storing necessary information required during forensics investigation. Which would be a beneficial tool for her to use?

A

Helix3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the most common type of attacks against any enterprise?

A

Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which type of Malware is used to trick the victim into performing predefined action?

A

Trojan Horse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which type of malware is access the victim’s computer or a network without the user’s knowledge?

A

Backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is considered a huge network of compromised systems used by attackers to perform denial-of-service (DoS) attacks?

A

Botnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

A type of Trojan that downloads other malware (or) malicious code and files from the internet on to the PC or device?

A

Downloader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Instant messenger applications, network propagation, email attachments, and decoy applications are all common ways attackers can _____?

A

Send a malware into a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Jose is an incident responder who wants to eradicate malware security incidents. What steps should he include?

A

Content Filtering Tools & Network Security Devices

Blacklist & Antivirus

Manual Scan & Fixing Devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What actions must take place in restoring email services after a malware incident?

A

Change passwords and enable scanning of links and attachments

45
Q

When building a testbed there are some tools required for testing. What is an important tool for testing?

A

Sandbox

46
Q

There are a ton of indications of malware incidents. What’s an important technique for users, tech support, administrators, and incident responders to help be able to identify?

A

Memory Dump/Static Analysis

47
Q

John prefers using tools such as Mirekusoft and SysAnalyzer to help him at work. What is the primary use of these tools?

A

To monitor installation of malicious executables

48
Q

________ is a built-in Windows tool that comes inbuilt in Windows 10/8/7 and searches for unsigned drivers on a system.

A

SIGVERIF

49
Q

Email crimes can be categorized in two ways either by sending emails or supported by emails. What is a crime supported by Emails?

A

Cyberstalking

50
Q

What crime refers to the unsolicited or undesired emails used to distribute malicious links and attachments, cause network congestion, perform phishing and financial frauds, and so on?

A

Spamming

51
Q

There are several types of phishing that can occur. Which type targets high profile executives like CEO, CFO, politicians, and celebrities?

A

Whaling

52
Q

Unavailability of the email server, sudden increase of advertising and spam emails, and change in email template and signature are all indicators of what?

A

Email Attacks

53
Q

Netcraft,and PhishTank are tools for detecting _____&_____?

A

Phishing/Spam

54
Q

Removing malware, isolating the critical systems infected with malware, blocking the compromised email accounts, and performing other email security hardening measures are all a part of _____.

A

Eradication

55
Q

What are guidelines to prevent spam?

A

Avoid giving email ID to unnecessary or unsecured websites

Do not use or subscribe to sites that access email contact list

Use long email ID with numbers and underscore to prevent spammers

56
Q

Identity theft occurs when someone uses your personal information in a malicious way. What is the best way to avoid identity theft from happening?

A

Review your credit card reports regularly

57
Q

When it comes to email incidents changing passwords, informing banks, contacting law enforcement, and making an insurance claim are all a part of which step?

A

Recovery

58
Q

David is an incident handler and wants to determine the email origin by matching the domain name for an IP address. Which website would he use?

A

arin.net

59
Q

This type of identity theft occurs when a victim’s bank account and credit card information are stolen and used illegally by a thief.

A

Financial

60
Q

Organizations must be able to handle and respond to various email attacks by developing and implementing proper incident response plan against the known attacks. This includes email filtering, email monitoring tools, and ________.

A

Developing an acceptable email usage policy

61
Q

When discussing common network security incidents, these threats prevent the authorized users from accessing network resources.

A

Denial-of-Service Incidents

62
Q

Reconnaissance attacks, sniffing and spoofing attacks, firewall attacks, and brute forcing attacks are all types of _______.

A

Unauthorized Access Incidents

63
Q

There are many indications of unauthorized access incidents. Which indication would be applicable if there are suspicious tools or exploits and unpredicted open ports?

A

Changes in system configuration

64
Q

User reports regarding network or system unavailability, System status changes, Misplaced hardware parts, and Unauthorized hardware found are all indications of _____.

A

Physical Intrusion

65
Q

There are four main common types of reconnaissance attacks that are attempted by the attackers in order to exploit the networks. Which type tricks people into revealing sensitive information?

A

Social Engineering

66
Q

A ______ is a basic network scanning technique that is employed to determine which range of IP addresses map to live hosts (computers).

A

Ping Sweeping

67
Q

The most common way of networking computers is through a _______

A

Ethernet

68
Q

What is a guideline for network security measures to prevent an unauthorized access incident?

A

Design the network in such a way that it blocks the suspicious traffic

69
Q

Jane is an incident responder who wants to detect and access the malware present in the network and then eliminate it. Which website could she use to view logs in real time and identify malware propagation?

A

kiwisyslog.com

70
Q

In a DoS attack, attackers flood the victim system with ___________ or traffic to overload its resources.

A

Non-legitimate Service Requests

71
Q

Crashing a service by interacting with it in an unexpected way and Hanging a system by causing it to go into an infinite loop are examples of?

A

DoS attacks

72
Q

Permanent DoS, also known as ________, refers to attacks that cause irreversible damage to system hardware

A

Phlashing

73
Q

Insecure Coding, Configuration Errors, Platform Vulnerabilities, and Logic Errors are all causes of what?

A

Web Incidents

74
Q

________ is an international organization that provides top 10 vulnerabilities and flaws of web applications.

A

OWASP

75
Q

Kevin is an attacker who is exploiting vulnerabilities by performing an XSS attack. What are two types of exploitations that he can perform?

A

Data Theft and Data Manipulation

76
Q

What method is an attack in which an authenticated user is made to perform certain tasks on the web application that an attacker chooses? For example, a user clicking on a link sent through an email or chat

A

Cross-Site Forgery

77
Q

Sarah is a hacker who is using a method called __________ on victim systems to analyze users’ surfing habits and sell that information to other attackers or to launch various attacks on the victims’ web applications.

A

Cookie Snooping

78
Q

If a hacker is identifying the kinds of websites a target company is frequently surfing and injecting malicious code that redirects the page to downloading malware, what kind of attack are they pursuing?

A

Watering Hole Attacks

79
Q

What is another name for Cross-Site Request Forgery (CSRF)?

A

One-click Attack

80
Q

_________ can contain session-specific data such as user IDs, passwords, account numbers, links to shopping cart contents, supplied private information, and session IDs.

A

Cookies

81
Q

What is the name of the primary tool placed on the edge of a network and assists in filtering or blocking malicious content from entering or leaving web applications?

A

Web Application Firewall (WAF)

82
Q

Proxy Servers act as doorways between the user and the web application that are browsed by the user. What are they used to prevent?

A

IP blocking and Maintain Anonymity.

83
Q

Limiting the length of user input, using custom error messages, and disabling commands like xp_cmdshell are all different ways to eradicate _______.

A

SQL Injection Attacks

84
Q

Charles is an incident handler who wants to eradicate insecure deserialization attacks. Which measure should he take?

A

Guard sensitive data during deserialization

85
Q

Resource pooling, rapid elasticity, distributed storage, and broad network access are all characteristics of _______?

A

Cloud Computing

86
Q

What would be considered a limitation of cloud computing?

A

Security, privacy, and compliance issues

Prone to outages and other technical issues

Contracts and lock-ins

87
Q

This cloud computing service enables subscribers to use on demand fundamental IT resources such as computing power, virtualization, data storage, network, and so on. Some of the advantages from this service include global accessibility, policy-based services, and guaranteed uptime.

A

Infrastructure-as-a-Service (IaaS)

88
Q

What would be considered an advantage and a disadvantage when comparing a private cloud to a public cloud?

A

A private cloud is more expensive but is also more secure

89
Q

Attackers use __________ (e.g., Wireshark, Cain and Abel) to capture sensitive data such as passwords, session cookies, and other web service-related security configurations

A

Packet Sniffers

90
Q

Chad is an incident responder who wants to monitor user and network activities, changes in files, and registry entries. What tool should he use to accomplish these tasks?

A

Tripwire

91
Q

________ is the cloud server security platform with all the security functions you need to safely deploy servers in public and hybrid clouds

A

CloudPassage Halo

92
Q

There are various threats to be aware of when dealing with cloud computing. Which type of threat arises because of incomplete and non-transparent terms of use, hidden dependency created by cross-cloud applications, inappropriate CSP selection, and lack of supplier redundancy?

A

Supply Chain Failure

93
Q

There are four types of Domain Name System (DNS) attacks. Which type Involves conducting phishing scams by registering a domain name that is similar to that of a cloud service provider?

A

Cybersquatting

94
Q

There are four types of Domain Name System (DNS) attacks. Which type involves registering an elapsed domain name?

A

Domain Snipping

95
Q

Insecure or obsolete encryption makes cloud services susceptible to what type of attack?

A

Cryptanalysis

96
Q

_________ refers to ability of a single cloud to handle data, accounts, systems, and applications of various organizations

A

Elasticity

97
Q

Megan is a disgruntled employee who wants to take her companies secrets and send the data to competitors by using a steganography. Which type of attack would she be committing?

A

Insider Attack

98
Q

What would be considered a harmful insider who uses their technical knowledge to identify the weaknesses and vulnerabilities of the company’s network and sell the confidential information to the competitors or black-market bidders?

A

Professional

99
Q

There are several indicators of insider threats. The most common indicator of an insider threat is lack of awareness of employees against security measures. Examples of this may include_________.

A

Multiple Failed Login Attempts

100
Q

Responders can figure out who is leaking information to the public or to another entity by giving a person a piece of data and waiting to see if the information makes it way to the public domain. What is the name of this technique?

A

Mole Detection

101
Q

Incident handlers can employ tools such as _________, _________, and _________, to monitor, collect, detect, and analyze different activities of users on the network

A

User Behavior Analytics (UBA)
SIEM
DLP Technologies

102
Q

Analyzing log files help incident handlers to detect the perpetrator. Analyzing _______ logs will help incident handler in understanding established connections, uploads, downloads, and requested URLs.

A

Network

103
Q

Dhru is an incident handler who needs to perform a network traffic analysis. Which website will help him in detecting established malicious connections, the type and number of devices accessed, and exfiltrated data?

A

Wireshark

104
Q

What command may give the incident responder valuable insight into what is happening within the server system? This command allows the incident handler to view and retrieve the active transaction log files for a specific database.

A

Database Consistency Checker (DBCC)

105
Q

ObserveIT, Ekran System and DataRobot are both important tools that detect ______.

A

Insider Threats

106
Q

What is a common technique that incident responders can use to secure the confidential data of a company from spies and eradicate different insider threats?

A

Limiting and controlling access

107
Q

What are examples of best practices to avoid insider threats?

A

Monitor employee behaviors and the computer systems used by employees

Implement secure backup and disaster recovery processes for business continuity

Disable remote access and screen sharing activities for all the users

108
Q

Joe is an employee who attacked his company to make a political statement by publicizing the company’s sensitive information. What is the driving force behind this insider attack?

A

Hacktivism

Cyber Defense & Countermeasures (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions