Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS > General > Flashcards

General Flashcards

1
Q

Apache log file path

A

/var/log/httpd/access_log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

/var/log/httpd/access_log

A

This file records all requests processed by the Apache server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

httpd_log

A

Log file for WebSphere, an old web server application from the early 2000’s for z/OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

http_log

A

C header library for http logging, utilized by Apache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

apache_log

A

Binary/executable file used for parsing Apache logs in a Postgres DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

The incident response policy contains procedures and guidelines, divided into these categories

A
  1. Preparation
  2. Detection/Analysis
  3. Containment
  4. Eradication/Recovery
  5. Post-incident stages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident Response Procedures

A

Provide detailed, tactical information to the CSIRT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CSIRT

A

Cybersecurity Incident Response Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A Policy is

A

a statement of intent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A Guideline is

A

A statement by which to determine a course of action, aiming to streamline a routine process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A Framework is

A

A basic structure underlying a system, concept, or text

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Mimikatz

A

Post-exploitation tool that dumps passwords from memory, as well as hashes, PINs, and Kerberos tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Tool for performing pass-the-hash, pass-the-ticket, or building Golden Kerberos tickets

A

Mimikatz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Extensible Configuration Checklist Description Format (XCCDF)

A

XCCDF is a specification language for writing security checklists, benchmarks, and related kinds of documents in XML.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Common Vulnerabilities and Exposures (CVE)

A

Provides a reference-method for publicly known information-security vulnerabilities and exposures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Common Configuration Enumeration (CCE)

A

Provides unique identifiers to system configuration issues to facilitate fast and accurate correlation of configuration data across multiple information sources and tools

Used with vulnerability scanners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Common Platform Enumeration (CPE)

A

A structured naming scheme for IT systems, software, and packages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Used to identify an endpoint’s characteristics when conducting network authentication

A

Network Access Control (NAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Port Security

A

Enables an administrator to configure individual switch ports to allow only a specified number of source MAC addresses ingressing the port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Shellshock/Bash Bug/Bashdoor

A

A critical Bash vulnerability that was discovered in 2014 that enabled RCE by encoding a script in an environment variable via the “function export” feature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Logjam

A

A TLS downgrade attack, discovered in 2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Drupalgeddon

A

A highly critical Drupal vulnerability discovered in 2014 that allows RCE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Stagefright

A

A critical Android vulnerability that enables RCE by utilizing Multimedia Messages (MMS), discovered in 2015

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Heartbleed

A

A high severity vulnerability in OpenSSL effecting the TLS protocol via improperly handled Heartbeat Extension packets (bad input validation), causing a “buffer-over-read” condition that allows the retreival of sensitive information in process memory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Root Cause Analysis

A

Helps understand why important alerts were missed and guides improvements in your alert management system to prevent similar oversights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Alert Fatigue

A

A common cause of missed security alerts, due to a security team being inundated with an excessive volume of alerts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CVSS Metric - AV

A

Access Vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

CVSS Metric - AC

A

Access Complexity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

CVSS Metric - PR

A

Privilege Required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

CVSS Metric - UI

A

User Interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

CVSS Metric - S

A

Scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

CVSS Metric - C

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

CVSS Metric - I

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

CVSS Metric - A

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Nmap Filtered Result

A

A network obstacle is blocking the port so Nmap cannot tell whether it is open or closed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Gramm-Leach-Bliley Act (GLBA)

A

Protects the privacy of an individual’s financial information held by financial institutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Sarbanes-Oxley Act (SOX)

A

Dictates requirements for retaining documents related to an organization’s financial and business operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Security framework that assumes a unidirectional workflow

A

Lockheed Martin Cyber Killchain; Fails to consider attacker retreat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Attack framework developed in response to unidirectional workflows

A

AT&T Alienvault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Best security mitigation for ICS/SCADA and IoT networks

A

User Entity Behavioral Analysis (UEBA) to compare behavior to a known good baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Sensitive/Commonly Abused Ports

A

53 (DNS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Advanced Persistent Threat (APT)

A

A stealthy threat actor, typically a nation-state or state-sponsored, that can remain undetected for an extended period of time

EUBA unlikely to detect this kind of threat actor, should be discovered through endpoint analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Regex \b

A

Delimiter for a “whole word”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Developed Capabilities (MITRE)

A

A threat actor’s capability to identify and exploit zero-day vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Acquired and Augmented (MITRE)

A

Refers to the utiliation of commodity malware and techniques (aka script kiddies)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Advanced Capabilities (MITRE)

A

A threat actor’s capability to introduce vulnerabilities through the supply chain attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Integrated Capabilities (MITRE)

A

Refers to non-cyber tools, such as political or military assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Formal Verification Methods

A

A mathematical model of the inputs and outputs of a system to prove that the system works as specified in all cases

Provides the single greatest mitigation for critical software which cannot have errors (corner cases)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

User Acceptance Testing (UAT)

A

A beta phase of software testing by a limited set of users who report their findings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

eFUSE

A

Intel-designed mecahnism to allow software instructions to blow a transistor in the hardware chip.

eFUSE prevents firmware downgrades

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

FERPA

A

Family Education Rights and Privacy Act

Privacy act that relates to Education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Dynamic Threat Models

A

Diamond, MITRE ATT&CK, AT&T Alienvault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Open Web Application Security Project (OWASP)

A

International non-profit organization dedicated to web application security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

NetBIOS

A

A legacy transport layer protocol that allows Windows computers to talk to eachother on the same network, and was used as a legacy implementation of SMB on port 139

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

LPR (Protocol)

A

Line Printer Remote Protocol (TCP 515)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

AppSocket (RAW)

A

Non Windows printing protocol

Utilizes smaller packet headers and requires no further processing by the receiving printer

Offers no security and very vulnerable

Port 9100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Internet Printing Protocol (IPP) supports

A

Authentication, access control, and encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Proprietary ISO Framework

A

27001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Security Intelligence

A

Collects, analyzes and disseminates information on the status of security systems (internal)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Cyber Threat Intelligence

A

Investigation, collection and dissemination of information about emerging threats and the threat landscape (external)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Cisco Talos

A

A reputational threat research intelligence supplier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Information Sharing and Analysis Centers (ISAC)

A

(USA) Not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members. ISACs are available for Critical Infrastructure, Government, Healthcare and other industries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Cyber Security Information Sharing Partnership (CSIP)

A

The UK’s alternative to USA’s ISACs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Indicator of Attack

A

Evidence that an intrusion is ongoing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Indicator of Compromise

A

Evidence that an attack has happened

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Behavioral Threat Research

A

Refers to the correlation of IoCs into attack patterns (killchain)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

STIX

A

Structured Threat Information eXpression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Structured Threat Information Expression

A

Language standard for the dissemination of IOC data via JSON included in the OASIS CTI framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

TAXII

A

Trusted Automation eXchange of Indicator Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Trusted Automation eXchange of Indicator Information (TAXII)

A

Application protocol for exchanging CTI over HTTPS using a REST API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

OpenIOC

A

CTI framework developed by Mandiant of XML formatted data to be used in automated incident detection and threat analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

MISP

A

Malware Information Sharing Project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

CTI

A

Cyber Threat Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Adversary Capability

A

A formal classification of the resources and expertise available to a particular threat actor (ie. Acquired or Augmented tools)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Attack Surface

A

The point at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Attack Vector

A

A specific path by which a threat actor gain unauthorized access to a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Google Hacking

A

Open-source intelligence technique that use Google search operators to locate vulnerable web servers and applications. The Google Hacking Database contains a reference for optimized GH search strings aka “Dorks”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Shodan

A

A search engine optimized for identifying vulnerable internet-attached devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

AbuseIPDB

A

Community-driven database that keeps track of IP addresses reported for abusive behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

NetFlow

A

Cisco-developed means of reporting network flow information and metadata to a structured database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Zeek (Bro)

A

Open source IDS/IPS for UNIX/Linux that contains a scripting engine that can be used to act on significant events by generating an alert or executing a process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Domain Generation Algorithm (DGA)

A

Method used by malware to evade block lists by dynamically generating domain names for C2 networks, primarily used in a “Fast Flux Network” and usually generates a high volume of NXDOMAIN errors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Mitigating DGA

A

Use Secure Recursive DNS Resolvers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Fast Flux Network

A

Method used by malware to hide the presence of C2 networks by continually changing the host IP addresses in domain records using domain generation algorithms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Blinding Attack

A

Condition that occurs when a firewall is under-resourced and cannot log data fast enough, therefore some data is missed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Firewalking

A

A firewall enumeration technique that sends packets with a TTL of 1 to a variety of ports in an attempt to identify hosts behind an open port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Black Hole

A

Means of mitigating DoS or intrusion attacks by routing traffic to a null interface, effectively dropping the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Sinkhole

A

DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Dark Nets

A

Unused physical network ports or unused IP address space within a local network often used by attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Forward Proxy

A

A server that receives traffic and sends (forwards) it to another network. Can filter or modify data in the process of forwarding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Reverse Proxy

A

A type of proxy server that protects servers from direct contact with client requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Non-Transparent Proxy

A

A type of proxy that requires explicit clientside configuration that a user is generally aware of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Transparent Proxy (Forced or Intercepting Proxy)

A

A proxy server that redirects requests and responses without the client being explicitly configured to use it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Web Application Firewall (WAF)

A

A firewall designed specifically to protect software running on webservers and their backend databases from code injection and DoS attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Snort

A

IDS or IPS/SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Security Onion

A

Open source Linux-based platform for security monitoring, incident response, and threat hunting that bundles Snort, Suricata, Zeek, Wireshark and NetworkMiner, and other log and incident management tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Port Security

A

Security measures applied to physical or logical ports on a networked device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Endpoint Security Hybrid Products

A

Advanced Threat Protection (ATP), Advanced Endpoint Protection (AEP), NextGen AV (NGAV)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

FLARE VM

A

A malware analysis sandbox for Windows binaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Cuckoo

A

Malware analysis VM for Linux, Windows and Mac binaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Joe Sandbox

A

Malware sandbox tool that performs some automated malware classification and accepts Windows, Linux, Mac and Android binaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

File Signature (Magic Number)

A

The first two bytes of a binary header that indicates its file type. FileSignatures.net serves as a resource for information on Magic Numbers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

MZ

A

The first two bytes of an executable binary, AKA MZ in ASCII.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Packed Program/Program Packer

A

An executable self-extracting archive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Masquerading

A

Replaces a genuine executable with a malicious one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

DLL Sideloading

A

Exploits a programs manifest to load a malicious DLL at runtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Process Hollowing

A

Dropper starts a process in a suspended state and rewrites the memory locations for the program with malware code

108
Q

Shellcode

A

Any lightweight code designed to run an exploit on a target

109
Q

Yara

A

Program for identifying, classifying and describing malware samples. Commonly used for analyzing pcaps against Yara rules.

110
Q

MAEC Scheme (Malware Attribute Enumeration and Characterization Scheme)

A

A standardized language for sharing structured information about malware that is copmlementary to STIX and TAXII to improve the automated sharing of threat intelligence

111
Q

MUA (Software)

A

Mail User Agent

112
Q

MDA

A

Mail Delivery Agent

113
Q

MTA (Email)

A

Message Transfer Agent

114
Q

MIME

A

Multipurpose Internet Mail Extensions

115
Q

Multipurpose Internet Mail Extensions (MIME)

A

Allows a body of an email to support different formats, such as HTML, RTF, encoded binary and attachments

116
Q

MIME Exploit

A

Message data that contains scripts or objects that target some vulnerability in the message client

117
Q

Secure MIME (S/MIME)

A

Email encryption standard that adds digital signatures and public key cryptography to traditional MIME communications

118
Q

SPF

A

Sender Policy Framework

119
Q

Sender Policy Framework (SPF)

A

Single DNS record identifying hosts authorized to send mail for the domain that can include other SPF records (Ex: TXT @ v=spf1 mx include:_spf.google.com include:email.domain.com -all)

120
Q

DKIM

A

DomainKeys Identified Mail

121
Q

DomainKeys Identified Mail (DKIM)

A

Provides a cryptgoraphic authentication mechanism for mail utilizing a public key published as DNS record, performed serverside (Ex: v=DKIM1;k=rsa;p=PublicKeyGoesHere)

122
Q

DMARC

A

Domain-Based Message Authentication, Reporting and Conformance

123
Q

Domain-Based Message Authentication, Reporting and Conformance (DMARC)

A

Framework for ensuring proper application of SPF and DKIM utilizing a policy published as a DNS record (Ex: v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:user@ex.domain.tld; ruf=mailto:user@ruf.domain.tld; fo=1)

124
Q

Security Information and Event Management Systems (SIEM)

A

A solution that provides real time or near real time analysis of security alerts generated by network hardware and appliances

125
Q

Normalization

A

Process where data is reformatted or restructured to facilitate the scanning and analysis process

126
Q

find/findstr

A

Windows alternative to grep

127
Q

Windows Management Instrumentation Command-Line (WMIC)

A

CLI for the administration of Windows systems using WMI, often used for reviewing log files on a remote machine

128
Q

EnCase

A

Digital forensics case management suite that provides workflows to assist in investigations

129
Q

Forensic Toolkit (FTK)

A

Digital forensics investigation suite for Windows which can utilize server clustering for faster processing speeds

130
Q

Sleuth Kit

A

Commandline utilities for imaging and file analysis that interfaces with Autopsy

131
Q

File Carving

A

The process of extracting data from a computer when that data has no associated file system metadata

132
Q

Master File Table

A

A table that contains metadata with the location of each file in terms of blocks/clusters for disks formatted as NTFS (FAT uses a File Allocation Table instead)

133
Q

Scalpel

A

Open source CLI tool included in Sleuth Kit/Autopsy that is used to conduct file carving on Linux and Windows

134
Q

Covert Channel

A

An IOC where data is transmitted with a hidden element, such as non standard data inside of a ping packet

135
Q

DRDoS

A

Distributed Reflection DoS

136
Q

Beaconing

A

Means for a network node to advertise its presence and establish a link with other nodes, often seen in specified intervals

137
Q

Slashdot Effect

A

When a website experiences DoS conditions due to sudden popularity

138
Q

ARP Spoofing/Poisoning

A

Occurs when an attacker redirects an IP to a MAC that was not its intended destination, best remediated by an IDS

139
Q

Footprinting

A

Phase of an attack or penetration test in which the attacker or tester gathers information about the target before attacking it

140
Q

IANA Dynamic Ports

A

49,152 - 65,535

141
Q

Overt Channel Exfiltration

A

The usage of commonly used programs to exfiltrate data, such as IM, SMS, Email, FTP or P2P programs

142
Q

Covert Channel Exfiltration

A

The exfiltration of data using covert techniques such as data segmentation, obfuscation and encoding, with the aim of evading detection

143
Q

pstree

A

Linux command that provides the parent/child relationship of all the processes on a system

144
Q

ps

A

Linux command that lists the attributes of all the current processes

145
Q

systemd

A

A Linux Init daemon

146
Q

SO (Shared Library)

A

Linux equivalent of a DLL

147
Q

Memory Overflow

A

A means of exploiting a vulnerability in an application to execute arbitrary code or to crash the process with a memory leak

148
Q

Prefetch File

A

A file that records the names of applications that have been run, as well as the date and time, file path, run count and DLLs used by the executable

149
Q

Shimcache

A

An application usage cache that is stored in the Registry as the key. (Ex. HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache) Often used for applications that require specialized compatibility settings.

150
Q

Amcache

A

An application usage cache that is stored as a hive file (Ex. C:\Windows\appcompat\Programs\Amcache.hve)

151
Q

Persistence

A

The ability of a threat actor to maintain covert access to a target host or network

152
Q

crontab

A

Tool that manages cron jobs, the Linux equivalent of scheduled tasks. “crontab -l” lists the currently scheduled cron jobs

153
Q

Cellebrite

A

Software for evidence extraction from smartphones and other mobile devices, cloud data and metadata using a universal forensic extraction device (UFED)

154
Q

Mobile Phone Examiner Plus (MPE+)

A

Mobile device forensics tools created by AccessData, the developers of FTK

155
Q

EnCase Portable

A

Mobile device forensics tool created by Guidance Software, the developers of EnCase

156
Q

Pivoting

A

Using an infected host to attack another host (Using SSH with the -D flag, you can set up a local proxy and port forwarding on a target)

157
Q

Pass the Hash

A

Network based attack where the attacker steals hashed user credentials and uses them as is to try to authenticate to the same network the hashed credentials originated on. Only use Domain Admin accounts for logging into Domain Controllers to prevent pass the hash exploits

158
Q

Golden Ticket

A

A Kerberos ticket that can grant other tickets in an Active Directory environment (AKA TGT). Admins should regularly change the krbtgt account password.

159
Q

krbtgt hash

A

The trust anchor of the AD domain which functions like a private key of a RCA (root cert authority) and generates ticket-granting tickets (TGT) that are used by users to access services within Kerberos

160
Q

Business Continuity Plan (BCP)

A

The plans and processes used during the response to a disruptive event

161
Q

Disaster Recovery Plan (DRP)

A

The plans used during the event of a disaster

162
Q

Tabletop Exercise

A

An exercise that tests a framework of controls using an incident scenario conducted by a “red team”

163
Q

OODA Loop

A

A military decision making model created to help responders think clearly in the “fog of war”, consisting of Observe, Orient, Decide and Act

164
Q

Isolation Mitigation

A

Removes an affected component from a larger environment

165
Q

Segmentation Mitigation

A

Achieves the isolation of a host or group of hosts using network technologies and architecture

166
Q

Sanitization

A

Group of procedures that an organization uses to govern the disposal of obsolete information and equipment

167
Q

Enterprise Risk Management (ERM)

A

The comprehensive process of evaluating, measuring, and mitigating the many risks that pervade an organization, usually as defined by business stakeholders rather than engineers

168
Q

Single Loss Expectancy (SLE)

A

Metric to determine the expected financial loss from a single event. SLE = AV * EF, (Asset Value * Exposure Factor)

169
Q

AV (Risk Analysis)

A

Asset Value, Monetary value of the asset

170
Q

EF (Risk Analysis)

A

Exposure Factor, The percentage of loss that would result

171
Q

Annual Rate of Occurence (ARO)

A

Number of times per year that a specific threat is expected to occur

172
Q

Annual Loss Expectancy (ALE)

A

Expected financial loss for multiple events during a year

173
Q

Business Impact Analysis (BIA)

A

A systemic activity that identifies organizational risks and determines their effect on ongoing mission critical operations

174
Q

Maximum Tolerable Downtime (MTD)

A

The longest period of time a business can be inoperable without causing irrevocable business failure

175
Q

Recovery Time Objective (RTO)

A

Length of time it takes after an event to resume normal business operations and activities

176
Q

Work Recovery Time (WRT)

A

The length of time in addition to the RTO of individual systems to perform reintegration and testing of a restored or upgraded system

177
Q

Recovery Point Objective (RPO)

A

The longest period of time that an organization can tolerate lost data being unrecoverable

178
Q

Risk transference

A

Response that involves moving or sharing the responsibility of a risk to another entity, usually involving insurance

179
Q

Risk mitigation

A

Response that reduces a risk to fit within an organization’s risk appetite

180
Q

Risk avoidance

A

Ceasing an activity that presents risk

181
Q

Risk Register

A

Document highlighting the results of risk assessments in an easily comprehensible format that is disseminated to stakeholders

182
Q

CVSS Base Score 9+

A

Critical

183
Q

CVSS Base Score 7-8.x

A

High

184
Q

CVSS Base Score 4-6.x

A

Medium

185
Q

CVSS Base Score 0.x-3.x

A

Low

186
Q

CVSS Base Score 0

A

None

187
Q

tcpdump -e

A

Includes the ethernet header during packet capture.

188
Q

tcpdump -n

A

Displays the IP addresses in numeric form

189
Q

tcpdump -l

A

Line buffered mode

190
Q

tcpdump -C

A

Packet buffered mode

191
Q

tcpdump port

A

Listen only on a specified port

192
Q

tcpdump -A

A

Print each packet in ASCII

193
Q

tcpdump -s

A

Set snap length (0 for unlimited, all traffic)

194
Q

tcpdump -B

A

Set buffer size

195
Q

tcpdump -c

A

Limit captured packets to provided value (e.g. 20 packets)

196
Q

tcpdump Logical Operators

A

“AND”, &&, “OR”, ||, “NOT”, !

197
Q

Continuous Integration

A

Automated building and testing of an application after it’s source code has been updated

198
Q

Continuous Delivery

A

Delivers the newest version of an application to a production or testing environment, which can then be approved for release by a human

199
Q

Continuous Deployment

A

All changes to code that pass CI/CD checks are automatically released without the need for human intervention

200
Q

Continuous Monitoring

A

Constant evaluation of an environment for changes to quickly detect new risks and improve business operations

201
Q

Data Sampling

A

Captures specified data that is determined to be useful, rather than collecting all data

202
Q

SSL vs TLS

A

TLS was developed in 1999 as SSLv3.1 before being renamed to TLS and the two terms are often used interchangably although SSL is not considered to be secure

203
Q

Nikto

A

Web application scanner

204
Q

OpenVAS

A

Infrastructure vulnerability scanner

205
Q

Nessus

A

Infrastructure vulnerability scanner

206
Q

Qualys

A

Infrastructure vulnerability scanner

207
Q

Output Encoding

A

Translates special characters into an encoded form that isn’t dangerous to the target system (Ex: < to < in HTML)

208
Q

Input Validation

A

Ensures data entering a system is formatted as expected

209
Q

Defense In Depth

A

Layering various technical controls to further secure infrastructure

210
Q

Base64 Encoding

A

Commonly used to bypass detection mechanisms in a network, and will commonly end with two equal signs (Ex. aGVsbG8gd29ybGQNCg==)

211
Q

Windows Autostart Registry Location

A

Run Subkey (HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE \Software\Microsoft\Windows\CurrentVersion\Run)

212
Q

nmap -sT

A

TCP connect scan

213
Q

nmap -sV

A

Service discovery scan

214
Q

nmap -Pn

A

Scan ports, no ping

215
Q

nmap -p

A

Scan port or port range

216
Q

nmap -p-

A

Scan all ports on system

217
Q

nmap -F

A

Fast port scan

218
Q

nmap -sS

A

Syn Port Scan, Only performs a partial connection and thus does not reveal you to your target

219
Q

nmap -sT

A

TCP Connect Scan, Detects open TCP ports

220
Q

nmap -sU

A

UDP Port Scan, Detects open UDP ports

221
Q

nmap -sA

A

Ack Port Scan, Detects if a port is stateful and/or filtered

222
Q

nmap -sn

A

Performs host discovery but does not scan any ports (use for quick scans)

223
Q

nmap -PR

A

Performs ARP discovery on a local network

224
Q

nmap -n

A

Does not resolve DNS, speeds up some scans

225
Q

nmap -A

A

Aggression Detection Mode, which is a combination of OS and service discovery

226
Q

nmap -O

A

OS Detection

227
Q

nmap -oN

A

Output Normal

228
Q

nmap -oX

A

Output XML

229
Q

nmap -oG

A

Output Greppable

230
Q

nmap -oA

A

Output All (types)

231
Q

Password Spraying

A

When an attacker uses a common password(s) to attempt to access multiple accounts

232
Q

Credential Stuffing

A

The automated injection of stolen username and password pairs (credentials) to an authentication system

233
Q

Ring 0

A

Kernel

234
Q

Ring 1

A

Device Drivers (Most privileged)

235
Q

Ring 2

A

Device Drivers (Less privileged)

236
Q

Ring 3

A

Applications

237
Q

Secure Disposal

A

A method of sanitizing by physical destruction of the media via shredding, incineration or degaussing

238
Q

Clearing involves

A

Overwriting data once with repetitive data, or resetting a device to factory settings

239
Q

Purging involves

A

Eliminating information from being feasibly recovered even in a laboratory environment

240
Q

DeepScan

A

Static code analyzer

241
Q

Tripwire

A

File integrity monitoring program

242
Q

OAuth2 is designed to

A

Authenticate claims, not to authenticate users. It’s a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user.

243
Q

OpenID Connect (OIDC)

A

OIDC is an identity authentication protocol that is an extension of open authorization (OAuth) 2.0 to standardize the process for authenticating and authorizing users when they sign in to access digital services.

244
Q

DGA

A

Domain Generation Algorithm

245
Q

SCAP

A

Security Content Automation Protocol

246
Q

Security Content Automation Protocol (SCAP)

A

A method for using specific standards to enable automated vulnerability management, measurement, and policy compliance evaluation of systems deployed in an organization

247
Q

TOGAF

A

The Open Group Architecture Framework

248
Q

The Open Group Architecture Framework (TOGAF)

A

A prescriptive framework that divides the enterprise architecture into four domains: Technical, Business, Applications and Data

249
Q

Regression Testing

A

Re-running functional and non-functional tests to ensure that previously developed and tested software still performs after a change

250
Q

Linux command to find bash version

A

which bash

251
Q

NIST recommendations on SMS multi-factor

A

NIST’s SP 800-63-3 recommends SMS be depreciated for MFA, as it may be accessible to attackers

252
Q

MacOS Application Config File Format

A

Property Lists (plists)

253
Q

net config

A

Used to manage network resources

254
Q

net group

A

Used to manage domain groups

255
Q

net computer

A

Adds or removes a computer from a domain (ran on primary DC)

256
Q

ZAP

A

OWASP Zed Attack Proxy

257
Q

OWASP Zed Attack Proxy (ZAP)

A

The worlds most popular FOSS web application scanner

258
Q

sc

A

Windows Scheduler command

259
Q

/etc/xinetd.conf

A

Older location for Linux startup services configuration. Potential location for evidence of a backdoor.

260
Q

Why are FPGAs often considered as “Anti-Tamper”

A

FPGAs are often used to provide “Physically Unclonable Functions” (PUFs) that generate a digital fingerprint based on unique features of a device

261
Q

XXE

A

XML External Entity

262
Q

XML External Entity (XXE)

A

Type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

263
Q

UEFI Boot Phase Order

A
  1. Security
  2. Pre-EFI initialization
  3. Driver Execution Environment
  4. Boot Device Select
  5. Transient System Load
  6. Runtime
264
Q

Identity Provider (IdP)

A

Validates a user’s identity when using SAML for authentication

265
Q

Relying Party (RP)

A

Provide services to members of a federation (SAML)

266
Q

FISMA

A

Federal Information Security Management Act

267
Q

Federal Information Security Management Act (FISMA)

A

United States federal law that defines a comprehensive framework to protect government information, operations, and assets (Compliance)

CS (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions