Golosary Deck

Question 1

Parser

Answer 1

A parser is a software component or program that analyzes input data (often text or code) to break it into smaller, structured parts for easier processing. It is widely used in fields like programming, natural language processing, and data analysis.

Question 2

False Positives

Answer 2

Refers to an incorrect alert or notification generated by a security system, where a benign or legitimate action, file, or event is mistakenly identified as a threat or malicious activity. This often happens due to overly sensitive detection systems, misconfigurations, or outdated threat signatures.

Question 3

False Negative

Answer 3

When a security system fails to detect a real threat or malicious activity, incorrectly classifying it as benign. This type of error is particularly dangerous because it allows threats to go unnoticed, leaving systems vulnerable to attacks.

Question 4

Dynamic analysis

Answer 4

Dynamic analysis is a method of evaluating software, systems, or applications by observing their behavior during runtime. Dynamic analysis involves running the program in a controlled environment to identify bugs, vulnerabilities, or performance issues that occur during execution.

Question 5

Static Analysis

Answer 5

Static Analysis is a method of evaluating software by examining its source code, bytecode, or intermediate code without executing the program. It is widely used in software development to identify potential issues early in the development lifecycle.

Question 6

Netflow collector

Answer 6

A NetFlow collector is a critical component of a NetFlow monitoring system that receives, processes, and stores flow data exported from network devices like routers and switches. It is used to analyze network traffic and provide insights into bandwidth usage, traffic patterns, and potential security issues.

Question 7

SIEM Collectors

Answer 7

SIEM collectors are components within a Security Information and Event Management (SIEM) system that gather log and event data from various sources across an organization’s IT environment. These collectors play a crucial role in centralizing data for analysis, correlation, and threat detection.

Question 8

DROP

Answer 8

DROP rule in iptables refers to silently disallowing a connection by discarding the packet without sending any response back to the sender.

Question 9

Replay attack

Answer 9

A replay attack is a type of network attack where an attacker intercepts valid data transmissions between two parties and fraudulently retransmits or delays them to deceive the receiver into performing unauthorized actions. The attacker does not need to decrypt the intercepted data; simply resending it can exploit the system’s trust in the original message