Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Defense & Countermeasures > Focused ECIHv2 Study Guide > Flashcards

Focused ECIHv2 Study Guide Flashcards

1
Q

What is the Risk equation?

A

Risk = Threat X Vulnerabilty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In Order, What is the Risk Assessment Process?

A
  1. System Characterization
  2. Threat Identification
  3. Vulnerability Identification
  4. Control Analysis
  5. Likelihood Analysis
  6. Impact Analysis
  7. Risk Determination
  8. Control Recommendation
  9. Risk Assessment Report
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is PILAR?

A

Risk Analysis and Management Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of Incident Response Orchestration - Automation?

A

To automatically notify a person when there’s an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO/IEC 27000

A

Overview and introduction of the information security management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO/IEC 27001

A

The Information Security Management System (ISMS) requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ISO/IEC 27002

A

Code of practice for information security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ISO/IEC 27003

A

Information Security Management System implementation guidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ISO/IEC 27004

A

Information Security Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ISO/IEC 27005

A

Information Security Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO/IEC 27006

A

Requirements for bodies providing audit and certification of Information Security Management Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ISO/IEC 27007

A

Guidelines for Information Security Management Systems auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISO/IEC TR 27008

A

Guidance for auditors on ISMS controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ISO/IEC 27009

A

Guidelines for those producing sector or industry-specific ISO27k standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISO/IEC 27010

A

Information Security Management for inter-sector and inter-organizational communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NIST 800-86

A

Incident Response Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

NIST 800-61 Rev.2

A

Incident handling guide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RFC 2196

A

RFC 2196 builds on RFC 1244 and is a guide to setting computer security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

COBIT IT

A

Governance framework that emphasizes compliance and helps increase the value of ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NIST 800-61

A

Step-by-step instructions for new and established incident response teams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Graham-Leach-Bliley Act (GLBA)

A

Deals with financial institutions, specifically PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Sarbanes-Oxley (SOX)

A

Fair and accurate corporate reporting. Deals with corporate fraud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

General Data Protection Regulations (GDPR)

A

Article 32: Speaks to the CIA triad and the ability to restore PII on time

Article 33: Must notify if data is breached within 72 hours, if possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NIST: Incident Handling Criteria and Reporting Timeframe

A 
Cat 0 Exercise/Network Defense Testing
Cat 1 Unauthorized Access – 1 hour
Cat 2 DOS – 2 hours
Cat 3 Malicious code – 1 hour
Cat 4 Inappropriate usage - Weekly
Cat 5 Scan/Probe/Attempting access – Monthly
Cat 6 Investigation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

buck-security

A

Linux tools which identify the security status of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Kiwi Syslog Server

A

Centrally manages Syslog messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Splunk

A

Collects, monitors and analyzes log files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Microsoft Baseline Security Analyzer

A

Gets the security posture of a Windows system, indicates whether a system is missing security patches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Magic Tree

A

Reporting tool using a tree structure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

KeepNote

A

Multi-platform notetaking software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Forensic Readiness Planning

A
  1. Identify potential evidence
  2. Determine source
  3. Define a policy that determines the pathway
  4. Establish a handling and storing policy
  5. Does it require a full or formal investigation?
  6. Train staff
  7. Special process for documenting
  8. Legal advisory board
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

rc.local

A

The script /etc/rc. local is for use by the system administrator. It is traditionally executed after all the normal system services are started, at the end of the process of switching to a multiuser runlevel. You might use it to start a custom service, for example a server that’s installed in /usr/local.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Common Imaging Software

A

FTK Imager and R-Drive Image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Order of Volatility

A
  1. Registers and Cache
  2. Routing table, process table, kernel stats, memory
  3. Temp files
  4. Disk or storage media
  5. Remote logging
  6. Physical config and network topology
  7. Archival media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Data Collection Commands

A

Systeminfo.exe – Windows
PsInfo – Windows
Cat – Linux
Uname – Linux

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Uptime Commands

A
  • PsUptime – Windows
  • Date /t – Windows (show date and time)
  • Net Statistics – Windows
  • Uptime and W – Linux
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Process Commands

A

• Netsat – ab (Windows) All executable files
• ListDLLs (Windows) shows all DLLs
• Pslist.exe (Window) shows running processes and
uptime
• Pmdump (Windows) tries to help find rogue
processes
• Top (Linux) system info summary as well as
processes and threads
• W (Linux) current processes per user
• Ps root’s processes
• Pstree shows processes in a tree form

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Network Commands

A
  • Nbstat -c contents (cache name and ip)
  • Netstat -ano (all connections and even ports)
  • Netstat -r (routing table and frequent routes)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Cyber Triage

A

Simplified collection and analysis of endpoint data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Process Explorer

A

DLLs of processes – Can show you malware hits on Virus Total

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Forensic Explorer

A

Undelete and slack space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Forensic toolkit (FTK)

A

decryption and password cracking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Event Log Explorer

A

Event logs in Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

OSForensics

A

Discover relevant forensic data through searching and indexing as well as undelete, also cheap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Helix3

A

Gives visibility across your entire network revealing internet abuse, data sharing and harassment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Autopsy

A

view file system, restore deleted data and timeline analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

EnCase

A

Does pretty much everything, very expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Foremost

A

Linux recovers files based on headers, footers and internal data structures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Golden Ticket

A

Stolen Kerberos ticket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Syscall Proxying

A

Remote commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Userland Execve Technique

A

Unix process load and execute ELF binary image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

ADS (Alternate data stream)

A

Hide files in NTFS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Trail Obfuscation

A

Trying to mislead investigators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Preparing Malware Testbed Steps

A

Step 1: Allocate a physical system for the analysis lab
Step 2: Install virtual machine on the system
Step 3: Install guest OS on the virtual machine
Step 4: isolate the system for the network by ensuring that the NIC card is in “host only” mode
Step 5: Simulate internet services using tools such as iNetSim
Step 6: Disable the “shared folders” and the “guest isolation”
Step 7: Install malware analysis tools
Step 8: Generate hash value of each OS and tool
Step 9: Copy the malware over to the guest OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Live System/Dynamic Analysis

A

A malware detection technique for live systems that are operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Intrusion Analysis

A

A malware detection technique that utilizes logs and alerts of IDS, SIEMS, etc…

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

TCPView

A

GUI TCP viewer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Process Monitor

A

GUI that allows filtering of real time monitoring, you can use it to drill down clear to driver stack information and see individual commands sent over the network to the machine. You can also right click on the process and search it online.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Registry Monitoring Tools

A 
Regshot
Reg Organizer
Registry Viewer
RegScanner
Registrar Registry Manager
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Autoruns

A

Monitors autoruns, you can verify signatures and jump to reg key or file location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

SIGVERIF

A

Checks file and folder integrity by verifying hash values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

HashMyFiles

A

Hashes files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

IDA Pro

A

Multi-platform disassembler and debugger through instruction tracing, functions tracing, read/write/execute tracing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Memory Dump Analysis Using Volatility Framework

A 
connections - 
connscan - 
psscan - 
pstree - 
malfind - 
apihooks - 
printkey - 
idt - 
threads - 
modscan - 
getsids - 
filescan - 
sockets - 
mutantscan -
65
Q

SSDT View and ReKall

A

Identify SSDT patching by rootkits

66
Q

RogueKiller

A

Identifies kernal-mode rootkits

67
Q

CapLoad and Wireshark

A

Detect malicious beaconing traffic

68
Q

PRTG Network Monitor and GFI Languard

A

Identify unwanted traffic to malicious and unknown external entities

69
Q

Mail Bombing

A

DOS attack by overloading an email box

70
Q

Mail Storming

A

DOS by reply all to large distribution lists

71
Q

Spear Phishing

A

Targeted at a specific person or group

72
Q

Whaling

A

Targeting high profile people, like executives

73
Q

Pharming

A

Redirecting traffic using DNS poisoning or host file modification

74
Q

Spimming

A

Spam on Instant Messanger

75
Q

Puddle Phishing

A

Targeting small organizations

76
Q

CEO Scam

A

Impersonating a CEO to get employees to do something for you (Like the Google Play card scams that are super common)

77
Q

Netcraft

A

Neighborhood watch scheme to help defend community against phishing – also includes a toolbar that gives a website a risk rating

78
Q

PhishTank

A

Open API for developers and researchers to integrate anti-phishing data into their applications

79
Q

MxToolbox

A

Makes email headers human readable by parsing them according to RFC 822

80
Q

Email Dossier, Email Address Verifier, emailvalidator, Email Checker, and G-Lock Software Email Verifier

A

All email validity checkers

81
Q

eMailTrackerPro

A

Analyzes email header and reveals sender’s geographical location and IP address

82
Q

EventLog Analyzer

A

Used to analyze email logs at server level

83
Q

Recover My eMail

A

Uses Outlook PST or DBX files to recover deleted emails

84
Q

Gophish

A

Used to create phishing simulations to test your organizations exposure to phasing – usually used to schedule people for additional security awareness training

85
Q

SPAMfighter

A

An automatic SPAM filter

86
Q

Gpg4win

A

Email encryption and digital signatures

87
Q

Suricata

A

IDS/IPS/Network Security Monitoring (NSM)/offline pcap processing

88
Q

Ntopng

A

Web-based network traffic monitoring released under GPLv3

89
Q

Wireshark - Detect ICMP Ping Sweep Attempts

A

Icmp.type==8 or icmp.type==0

90
Q

Wireshark - Detect TCP ping sweep

A

Tcp.dstport==7

91
Q

Wireshark - Detect UDP ping sweep

A

Udp.dstport==7

92
Q

Wireshark - It is used to see if a port is open, RST response if port is closed

A

SYN+ACK

93
Q

Wireshark - Used if there is a large amount of RST or ICMP type 3 packets

A

Stealth Scan

94
Q

Wireshark - Used if the TCP session is less than 4 packets it can be a sign of a TCP port scan

A

Stealth Scan Detection – Statistics>Conversations>TCP

95
Q

Wireshark - A full three-way handshake to find open ports

A

A full connect scan

96
Q

Wireshark - Same detection method as stealth scan

A

TCP full connect scan detection

97
Q

Wireshark - Checks for SYN, SYN+ACK, RST+ACK or ICMP Type 3 packets

A

Full scan detection

98
Q

Wireshark - Null Scans

A

TCP packets without a setting flag
RST = Port closed, no response = open or filtered
Detect using TCP.flags==0x000

99
Q

Wireshark - Xmas Scans

A

Attacker uses FIN, PSH, and URG TCP flags and waits for a response
RST = Port closed, no response = open or filtered
Detect using tcp.flags==0x029

100
Q

Wireshark - ARP poisoning detection

A
  • Duplicate IP address configured messages
  • Arp.duplicate-address-detected
  • Xarp is another tool that can be used to do this besides Wireshark
101
Q

PromqryUI

A

Detect network interfaces running in promiscuous mode

102
Q

NMAP

A

Detect network interfaces running in promiscuous mode using nmap –script=sniffer-detect (target ip address/range of ip addresses)

103
Q

ZENMAP

A

GUI version of NMAP

104
Q

DoS/DDoS - Volumetric Attacks

A 
o	Measured in bits-per-second
o	UDP Flood
o	ICMP Flood
o	Ping of death
o	Smurf
105
Q

DoS/DDoS - Protocol Attacks

A 
o	Measured in packets-per-second
o	SYN flood
o	Fragmentation
o	ACK flood
o	TCP state exhaustion
106
Q

DoS/DDoS - Application Layer Attacks

A

o Measured in requests-per-second
o HTTP GET/POST
o Sloworis

107
Q

DoS/DDoS - Permanent Attack

A

Plashing – Bricks the system (Bad firmware updates)

108
Q

DoS/DDoS - Distributed Reflection Attack

A

Reflects transmissions of third parties before the target to amplify attack

109
Q

DoS/DDoS Tools

A

o Low Orbit Ion Cannon – Flood target with UDP, TCP or HTTP packets or requests
o High Orbit Ion Cannon – DDOS version, just select IP/Port/Protocol
o Additional Tools – HULK, Black Hat Hacking Tools, DAVOSET, Tsunami, R-U-Dead-Yet

110
Q

KFSensor

A

Honeypot software to attract and detect hackers

111
Q

RFC 3704 Filtering

A

Limits impact by denying spoofed addresses

112
Q

CISCO IPS Source IP Reputation Filtering

A

Uses Cisco database to check reputation of connection source

113
Q

Black Hole Filtering

A

Discarding packets at the routing level

114
Q

Anti DDOS Guardian & D-Guard Anti-DDOS Firewall

A

Anti-DDOS software

115
Q

Incapsula

A

Mitigates any size attack without impacting legitimate traffic and latency

116
Q

Shell Injection

A

System (), StartProcess (), java.lang.runtime.exec (), System.Diagnostics.Process.Start ()

117
Q

Cross-Site Request Forgery

A

Spoofed requests on behalf of the logged in user

118
Q

\’

A

Single-quote character

119
Q

|

A

or

120
Q

\%27

A

Single-quote character

121
Q

--

A

Double-dash

122
Q

#

A

Hash

123
Q

\%23

A

Hex version of #

124
Q

What does the ‘i’ mean at the end of a regular expression?

A

Case insensitive

125
Q

What does the ‘x’ mean at the end of a regular expression?

A

Ignore white spaces

126
Q

\%3d

A

=

127
Q

\%3b

A

;

128
Q

\%6f

A

o

129
Q

\%4f

A

O

130
Q

\%72

A

r

131
Q

\%52

A

R

132
Q

\%2e

A

.

133
Q

\%2f

A

/

134
Q

\%5c

A

\

135
Q

16 bit Unicode

A

Replaces unusual Unicode with %u

136
Q

UTF-8

A

% followed by the hexcode (%c2 for example)

137
Q

Base64

A

Represents binary data in printable ASCII characters

138
Q

Hex Encoding

A

HTML encoding scheme that uses hex values of every character

139
Q

%0a

A

new line

140
Q

%20

A

space

141
Q

&amp

A

&

142
Q

&lt

A
143
Q

&gt

A

>

144
Q

Who is the Cloud Consumer?

A

The User

145
Q

Who is the Cloud Carrier?

A

Intermediary between user and provider (Transport services)

146
Q

Who is the Cloud Auditor?

A

Makes independent assessments of cloud service controls

147
Q

Who is the Cloud Broker?

A

Manages the cloud service and maintains relationship between provider and consumer (the reseller)

148
Q

AICPA SAS 70 Type II

A

Cloud Security best practice

149
Q

CloudPassage Halo

A

All security functions needed to deploy servers securely in public and hybrid clouds

150
Q

Pod Slurping

A

Stealing information using small devices like iPods/iPads/phones/MP3 players/etc

151
Q

Where to find USB Connected History

A

Windows - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB (Windows)

Mac - System Information->Hardware->USB

Linux - usb-devices

152
Q

ObserveIT

A

Threat Management solution that monitors user behavior with “eyes on the endpoint”

153
Q

DataRobot

A

Automated machine learning platform to detect insider threats

154
Q

Ekran System

A

Helps monitor/detect/analyze user-based insider threats

155
Q

NERC 1300

A

North America Electric Reliability Corporation

156
Q

Mirekusoft

A

Uninstaller

157
Q

SysAnalyzer

A

Malcode analyzer

158
Q

OWASP

A

Top 10 Web Application Security Risks

159
Q

Cross-site Forgery

A

Also known as one-click attacks

Cyber Defense & Countermeasures (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions