Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMPTIA CYSA > GENERAL CYSA TEST > Flashcards

GENERAL CYSA TEST Flashcards

1
Q

What is a Technical or Logical Control?

A

Type of Security Control- In a system e.g by hardware, software, firmware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Operational Control?

A

Type of Security Control- Implimented by people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Managerial Controls?

A

Security Control Provides oversight of a information system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a preventative control?

A

Control that acts to elininmate or reduce likelihood that an attack can success

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a detective control?

A

Control that may not prevent or deter access but will identify and record an attempted intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a corrective control?

A

As Acts to elinate or reduce the impact of intrusion event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Security Intelligence?

A

Collecting data from live systems and analyising it to show the security status of said system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Cyber Threat intelligence?

A

Proactive approach to researching emerging threats and their sources to keep an up to date image of the wider threat landscape

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is open source intelligence?

A

The process of obtaining information using public records, websites and social media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is EPP and what does it do?

A

Endpoint Protection Platform- Swiss army knife of protection, can include AV, HIDS/HIPS/ Encryption DLP and lots more all under one tool (Mostly based on signature detection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is EDR and what how does it differ from EPP?

A

Endpoint Detection & Response- Another prorgam that includes many different security tools inside it. Differs from EPP as it monitors and triggers on behaviours instead of signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is UEBA and what does it do?

A

User Entity Behavior Analytics- System that provides automated identfification of suspicious activity by user accounts and hosts. As there is so much data that needs analyising, AI is often used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is reverse engineering?

A

The process of analyzing the structure of hardware or software roto reveal more about how it functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can malware writers do to hide the identification of the payload and author of the malware to make it harder to detect?

A

They can obfuscate the code before it is assembled or compiled to prevent analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a disassembler?

A

A program that translates machine language (binary) into assembly language!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a magic number?

A

Looking at a HEX file and the first two bytes of the binary header that indicates it file type. e.g E2 = PNG file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is assembly code?

A

Instructions that has been translated from hex codes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do we use to get from HEX code to assembly code?

A

A decompiler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is high-level code?

A

Pesudo-code- something that is human readable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why are we looking to return code into a human readable format?

A

So we can look for strings- We can then write rules of those strings and block them!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the STRINGS tool do?

A

Dump all strings over three characters in ASCII or Unicode for analysis, no need for use of dissembler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a program packer?

A

Method of compression which and executable is mostly compressed and that part that isnt only contains the code to decompress the executable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is shellcode?

A

Any lightweight code that is designed to run a exploit on a target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is code injection?

A

Exploit technique that runs malicious code with the identification number of a legitimate process- e.g process number for Chrome is 10, you run malicious code under the process code 10, this would allow it to run.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is living off the land?

A

When an attacker uses the tools already installed on the computer to continue the attack. e.g using powershell for malicious reasons.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What free, open-source tool, provided by Microsoft can be used for behavior analysis?

A

Sysinternals by Microsoft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What processes will always be running if you look in your process tab in windows explorer?

A

System Idle (PID 0) and System (PID 4)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What manages low level windows functions and is fine if you see several running providing they are run from SystemRoot/System32 and have no parent?

A

Client Server Runtime Subsystem (csrss.exe)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What manages drivers and services and should only have a single instances running as a process?

A

WININIT (Wininit.exe)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the most popular process hackers use to masquerade malware?

A

Services.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does Services.exe do?

A

Hosts nonboot drivers and background services, the process should only have one instance and should be running as a child of WINIT.exe

32
Q

Without looking at the service and only by who started it, what could we identify?

A

If started by username- Potentially malicious, if by SYSTEM, LOCAL, SERVICE OR NETWORK SERVICE ACCOUNTS- NOT MALICIOUS

33
Q

Whatt is the Malware Attribute Enumberation and Characterization Scheme? (MAEC)

A

A standardized language for sharing structured information about malware that is complementary to STIX and TAXII to improve the automated sharing of threat intelligence!

34
Q

What is Yara?

A

Multi-platform program used for identifying, classifying and describing malware samples. Helps with creating rules

35
Q

What is blacklisting?

A

Unless your name IS on the list, you are allowed

36
Q

What is Whitelisting

A

Put everything you want to block on the list, allow everything else

37
Q

What is Execution Control?

A

he process of determine what additional software may be installed on a client or server beyond its baseline.

38
Q

What is MIME?

A

Multipurpose Internet Mail Extensions- Allows a body of an email to support differnt formats, such as HTML, Rich Text format, and binary data, that can be encoded as base64 ASCII Characters and attachments.

39
Q

Multipurpose Internet Mail Extensions- Allows a body of an email to support differnt formats, such as HTML, Rich Text format, and binary data, that can be encoded as base64 ASCII Characters and attachments.

A

Using authentication!

40
Q

What is SPF?

A

Sender Policy Framework-
DSN record identifiying hosts authorized to send mail for the domain with only one being allowed per domain-

41
Q

What is DKIM?

A

DomainKey Identified Mail
Provides a cryptographic authentication mechanism for mail utilizing a public key publishes as a DNS record- Works as when you send an email, your domain MTA is going to assign the email a hash value and send it with the public key, when recived, it can ,compare hashes and see if it matches, knowing it has not been modified in transit.
This is done by the servers, not by the users!

42
Q

What is the framework that uses SPF and DKIM and utilizes a policy publishes as a DNS record?

A

DMARC

43
Q

On a SMTP log what does a status code 220 mean?8 important

A

Indicates server is ready!

44
Q

On a SMTP log what does a status code 250 important

A

Message has been accepted

45
Q

On a SMTP log what does a status code 421?

A

Service is not available

46
Q

On a SMTP log what does a status code 450

A

Server cannot access mailbox, maybe the mailbox doesnt exsist?

47
Q

On a SMTP log what does a status code 451

A

Local server aborted the action due to processing error

48
Q

On a SMTP log what does a status code 452

A

Your drive has filled up, there is no space to send this message!

49
Q

What is S/MIME?

A

Same a MIME but adds digital signatures and public key cryptography

50
Q

What are three examples of SIEMS?

A

SPLUNK, ELK STACK, Alien vault

51
Q

What loses value over time?

A

Intelligence!

52
Q

What is a false negative?

A

Not alerting when you shouldve

53
Q

What is False Positive?

A

Alerting things when you dont need to

54
Q

What is a use case?

A

A specific condition that should be reposted, such as a suspicious log-on or process executing from a temporary directory.

55
Q

Whatre the two places where we can get data from?

A

User Agent- Endpoints, HIDS.HIPS etc && Listener/Collector-Things that push updates to the SEIM over a protocol like syslog or SNMP && Sensors differnt sniffers and sensors - e.g SPANS and TAPS

56
Q

Once we have collected all the information from all the different sources, what do we need to do to be able to understand it?

A

Parsing and normalization is needed as all the information will come in in different formats and will not be readable without translation and review inside SIEM

57
Q

What could be a potential problem when collecting data from sources that span multiple countries?

A

When logging, different logs will be logged at their local timezone, when trying to create a timeline, it will be difficult to create a timeline if crossing timezones. Mitigatation is using UTC (Universal Time Zone)

58
Q

What is a syslog?

A

A protocol enabling different appliances and software applications to transmit logs or event records to a central server

59
Q

When doing Data Forensics, what do we collect first and what is next?

A

Order of volitilalty, make sure you collect data from things that may be changed soon
CPU registers and Cahe memory - Contents of system memory (RAM) e.g routing tables, temp swap files, ARP Cache, process tables- Data on persistent mass storage e.g Hard drive, SDD, Flash drive- Remote logging and monitoring data( SIEMS) and lastly- Physical config and network topology

60
Q

Whatre the three tools we use in forensics?

A

Encase, The Forensic Toolkit (FTK), The Sleuth Kit

61
Q

In digital Forensics, what is Live Acquisition

A

Capturing the contents of memory while the computer is running

62
Q

In digital Forensics, if the device you are investigating has a highliklihood of crashing, what method of collection can you use?

A

Crashdump- Wont be full copy

63
Q

What is a Hibernation File?

A

A file that is written to the disk when the workstation is put into a sleep state

64
Q

What is a pagefile?

A

A file that stores pages of memory in use that exceed the capacity of the hosts physical RAM modules- Page files get written to the hard drive.

65
Q

What happens to data that is written to RAM when you power off the system?

A

You lose it!

66
Q

Why would you use a write blocker?

A

To stop someone being able to remove your hard drive and be able to write to it!

67
Q

What hashing algorithm uses 128-bit digest and is susceptible to collisions?

A

MD-5

68
Q

What is the name of the moderen hashing algorithm?

A

SHA (Secure hashing algorithm)

69
Q

What type of hashing uses 160 bit hash digest?

A

SHA-1

70
Q

What type of hashing uses 256 or 512-bit hash digest and is the current version of hash used in modern forensics?

A

SHA-2

71
Q

What type of firewall should you use if you are using a web server?

A

Web Application Firewall

72
Q

What is a proxy server?

A

A server that acts as a gateway between you and the internet

73
Q

What is a Forward Proxy?

A

A proxy that acts on behalf of a user- You connect to the proxy and the proxy connects to the website of your chosing

74
Q

What is a reverse Proxy?

A

A type of server that protects your internal servers from the outside user- Outside user makes request to Proxy and Proxy makes request to internal server

75
Q

Why is a reverse proxy a good way of collecting information?

A

You can log the data and analyse it.

76
Q

What is an Access Control List?

A

Used inside Firewalls- A list of permitted and denied connections based on IP address, Ports or Applications in use

77
Q

What is systernals used for?

A

To identify the baseline and see what is “normal” see what process are running

COMPTIA CYSA (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions