Idk Flashcards
SCAP (Security Content Automation Protocol)
is a multi-purpose framework of specifications that supports automated configuration, vulnerability and patch checking, technical control compliance activities, and security measurement. It is an industry-standard and support testing for compliance.
Agile
The Agile Manifesto emphasizes individuals and interactions over the processes and tools that Spiral and Waterfall rely on. It also focuses on working software, customer collaboration, and responding to change as key elements of the Agile process.
Waterfall
The waterfall model is a breakdown of project activities into linear sequential phases, where each phase depends on the deliverables of the previous one and corresponds to a specialization of tasks.
Rapid Application Development (RAD)
is a form of agile software development methodology that prioritizes rapid prototype releases and iterations. Unlike the Waterfall method, RAD emphasizes the use of software and user feedback over strict planning and requirements recording.
Spiral
is a risk-driven software development model that guides a team to adopt elements of one or more process models, such as incremental, waterfall, or evolutionary prototyping.
Default Nmap scan type
TCP SYN scan
UDP Nmap scan type
-sU flag
TCP FIN Nmap scan type
-sF flag
Stephane was asked to assess the technical impact of a reconnaissance performed against his organization. He has discovered that a third party has been performing reconnaissance by querying the organization’s WHOIS data. Which category of technical impact should he classify this as?
Since WHOIS data about the organization’s domain name is publicly available, it is considered a LOW impact.
An organization wants to choose an authentication protocol that can be used over an insecure network without having to implement additional encryption services. Which of the following protocols should they choose?
The Kerberos protocol is designed to send data over insecure networks while using strong encryption to protect the information.
What technology is NOT PKI x.509 compliant and cannot be used in a variety of secure functions?
Blowfish
What technology is PKI x.509 compliant and can be used in a variety of secure functions?
AES, PKCS, and SSL/TLS are all compatible with x.509 and can be used in a wide variety of functions and purposes.
> ## echo 127.0.0.1 diontraining.com»_space; /etc/hostsWhich of the following best describes what actions were performed by this line of code?
Routed traffic destined for the diontraining.com domain to the localhost.
Which of the following provides a cryptographic authentication mechanism to positively identify an organization as the authorized sender of email for a particular domain name?
DomainKeys Identified Mail (DKIM) provides a cryptographic authentication mechanism. This can replace or supplement SPF. To configure DKIM, the organization uploads a public key as a TXT record in the DNS server.
Sender Policy Framework (SPF)
uses a DNS record published by an organization hosting an email service. The SPF record identifies the hosts authorized to send email from that domain and there must be only one per domain. SPF does not provide a cryptographic authentication mechanism like DKIM.
Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
ensures that SPF and DKIM are being utilized effectively. DMARC relies on DKMI for the cryptographic authentication mechanism.
simple mail transfer protocol (SMTP)
is a communication protocol for electronic mail transmission, which does not utilize cryptographic authentication mechanisms by default.
Which of the following methods could not be used to retrieve the key from a forensic copy of a BitLocker encrypted drive?
Retrieve the key from the MBR.
-BitLocker information is not stored in the Master Boot Record (MBR).
Risk Appetite
An organization’s willingness to tolerate risk.
Risk Avoidance
is the response of deploying security controls to reduce the likelihood and/or impact of a threat scenario.
Risk Deterrence
is the response of deploying security controls to reduce the likelihood and/or impact of a threat scenario.
Risk transference
is the response of moving or sharing the responsibility of risk to another entity.
Base64
Most popular format for attackers to obfuscate malicious code.
