Final Tuning Flashcards
What can cause nmap to not see hosts?
If it is not running services, or if it has a firewall that prevents responses
BIA
Business Impact Assessment
SLA
Service Level Agreement
BPA
Business Partner Agreements
MOU
Memorandum of Understanding
After running Scalpel what should you do?
Review the contents of the scalpelout folder
What scans should you use to understand what information is available to a potential external attacker about the system as well as what damage they may be able to cause on a web application server for public access?
Web application vulnerability scans, external network scans, port scans.
An internal network scan would provide an insider’s perspective so would not provide the data needed
ITIL
Provides guidance on best practices for implementing IT service management
ISO
Provides high level standards for a wide variety of business and manufacturing processes
COBIT
Provides control objectives for IT governance
PCI DSS
Provides security standards for handling credit card information
strings command
Prints strings of printable characters in a file
The sudoers file, output of groups command, and the stat command can all provide ___
Useful info about user or file permissions
Heuristic detection rules on an IPS are a valid way to ____
Prevent port scans
NIST functional impact- Medium
Loss of ability to provide a critical service to a subset of system users
NIST functional impact- High
Entire network goes down
NIST functional impact- Low
Single switch down or network slows down
NIST Tier 3 Risk Management Program
Repeatable
There is an organization wide approach to managing cyber risk
NIST Tier 4 risk management program
Adaptive
Organization wide approach to managing cyber risk that uses risk-informed policies, processes, and procedures to address potential cyber security events
Method to wipe all of an SSD
ATA secure erase command
Degaussing is used for ____
Magnetic media such as tapes, not effective on SSDs
After identifying a compromised system, you determine that the system is beaconing to a group of fast flux DNS entries. What technique can you use to identify other infected hosts?
Log DNS queries to identify compromised systems
/etc/shadow
Contains password hashes
Where on a Windows system can you look for evidence that files were deleted?
Windows Registry
MFT
INDX files
