L8: Threat Analysis

Question 1

Name the three phases of intelligence gathering used by attackers:

Answer 1

Footprinting (FP)
Scanning (S)
Enumeration (E)

Question 2

Gathering information on OS, services, and architecture of the target system is called ______.

Answer 2

Scanning

Question 3

Gathering information on DNS, email servers, and IP Address range is called _______.

Answer 3

Footprinting

Question 4

Gathering information on network user and group names, routing tables, and network management protocols is called ________.

Answer 4

Enumeration

Question 5

Which protocol is used to break data into packets?

Answer 5

TCP

Question 6

Which protocol is used to move packets from router to router?

Answer 6

IP

Question 7

Which protocol reassembles the data packets?

Answer 7

TCP

Question 8

With regards to computing, what is entropy?

Answer 8

Randomness for use in crypto or other applications that require random data.

Question 9

What are two sources of entropy?

Answer 9

Hardware sources and randomness generators

Question 10

Short lived domains are generally used by

Answer 10

Botnets (B)

Question 11

Disposable domains are generally used by

Answer 11

Adware (A)

Question 12

Anonymously registered domains are generally used by

Answer 12

Spyware (S)

Question 13

Kopis and Notos are domain reputation systems. Which one has the global internet view?

Answer 13

Kopis

Question 14

The number of distinct malware samples connected to IPs is an example of ________ features.

Answer 14

Evidence-based

Question 15

The average length of domain names and the occurrence freuency of different characters are examples of _________ features.

Answer 15

Zone-based

Question 16

The total number of IPs historically associated with geographical locations is an example of ________ features.

Answer 16

Network-based

Question 17

A dynamic malware-related domain detection system should have global visibility into DNS request and response messages.

Answer 17

True

Question 18

A dynamic malware-related domain detection system should not be able to detect malware domains before the infection reaches a local network.

Answer 18

False

Question 19

A dynamic malware-related domain detection system should not require data from other networks.

Answer 19

True

Question 20

A dynamic malware-related domain detection system should be able to detect malware-related domains even if there is no reputation data.

Answer 20

True

Question 21

One of the more successful methods to taking down a botnet requires investigators to find and target each bot in the net

Answer 21

False

Question 22

A proven method to stop botnets requires isolating the C&C domain from the botnet

Answer 22

True

Question 23

With regards to takedowns, P2P-based networks are much easier than C&C networks.

Answer 23

False