Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ (SY0-701) > Lesson 12: Explain Incident Response and Monitoring Concepts > Flashcards

Lesson 12: Explain Incident Response and Monitoring Concepts Flashcards

1
Q

Define an ‘Incident’

A

An event that interrupts standard operations or compromises confidentiality, integrity, or availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define an ‘Incident response policy/plan (IRP)’

A

Defines the resources, processes, procedures, and guidelines for dealing with cybersecurity incidents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the seven steps of CompTIA’s incident response lifecycle?

A
  1. Preparation
  2. Detection
  3. Analysis
  4. Containment
  5. Eradication
  6. Recovery
  7. Lessons learned
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define the first step (preparation) of the CompTIA incident response lifecycle

A

Hardening systems, writing policies and procedures, and setting up confidential lines of communication; implies creating IRP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What features does a security information and event management (SIEM) have to assist in preparation?

A
  1. Incident detection for collection and analysis of environment
  2. Digital forensics for validating data
  3. Case management tools for logging incidents and coordinating response activities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define the second step (detection/identification) of the CompTIA incident response lifecycle

A

The process of correlating events from network and system data sources and determining whether they are an IoC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define a ‘Call list’

A

A document listing authorized contacts for out-of-band notification and collaboration during a security incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define the third step (analysis) of the CompTIA incident response lifecycle

A

Process in which IoCs are assessed to determine validity, impact, category, and priority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is necessary for an IoC to be a true positive incident?

A

Correlating multiple indicators.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the next step after validating a true IoC?

A

Identify the type of incident and the data or resources affected; establishing the category and impact allows determination of priority.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How does the value of data affect impact of an IoC?

A

The move valuable the data the higher the impact of the IoC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define ‘downtime’ and how it can affect impact

A

The degree to which an incident disrupts business processes; Longer downtime means higher impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When determining the scope, what factors can affect impact of the IoC?

A

The number of affected systems; the type of affected systems, and how the systems have been affected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does detection time affect the impact of an IoC?

A

The longer it takes to detect an IoC, the more potential damage that can take place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the purpose of an incident category?

A

To ensure that all response team members and other organizational personnel have a shared understanding of the meaning of terms, concepts, and descriptions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does effective incident analysis depend on?

A

Threat intelligence; insight into adversary tactics, techniques, and procedures (TTPs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define a ‘cyber kill chain’

A

describes the stages by which a threat actor progresses to a network intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define the first step (Reconnaissance) in the cyber kill chain

A

Mapping an attack surface and identifying potential attack vectors using network probes, Open Source Intelligence (OSINT), and social engineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define the second step (weaponization) in the cyber kill chain

A

Coding an exploit to take advantage of a vulnerability discovered through reconnaissance coupled with a payload to deliver the exploit and maintain covert access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define the third step (Delivery) in the cyber kill chain

A

Weaponized code is inserted into the environment using a selected attack vector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define the fourth step (exploitation) in the cyber kill chain

A

Weaponized code is executed on the target system and gains the capability to deliver the payload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define the firth step (installation) in the cyber kill chain

A

Payload is successfully installed on the target system using methods to remain undetected and achieve persistence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define the sixth step (Command and Control) in the cyber kill chain

A

The payload establishes a connection to a remote server, enabling the attacker to connect to the target and download or fabricate additional attack tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define the seventh step (Action on Objectives) in the cyber kill chain

A

Adversary uses the compromised system to achieve or progress towards goals, such as data exfiltration, DoS/vandalism, or escalating access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Define a ‘playbook’

A

A checklist of actions to perform to detect and respond to a specific type of incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is best practice when planning for different attack types?

A

Develop a playbook, or standard operating procedure (SOP) to assist analysts in detecting and responding to specific cyber threat scenarios.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define the fourth step (containment) of the CompTIA incident response lifecycle

A

Isolating affected hosts/accounts; Limit the scope and magnitude of the incident; Secure data while limiting the immediate impact on customers and business partners.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

When at the 4th step (containment) of CompTIA’s incident response lifecycle, what should be considered in regards to the time it will take to implement containment?

A

What damage or theft has occurred already? How much more could be inflicted and in what sort of time frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How could containment inadvertently be a negative approach?

A

What actions could alert the threat actor that the attack has been detected? What evidence of the attack must be gathered and preserved?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are two forms of containment?

A
  1. Isolation-Based Containment
  2. Segmentation-Based Containment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Define ‘Isolation-Based Containment’

A

Isolation involves removing an affected component from whatever larger environment it is a part of; Removes any interface between the affected system and the production network or the Internet; Disabling a user account or service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

If a single host is infected, what are simple ways to isolate it?

A

Disconnect networking cables from the host or disabling the switch port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the downside to pulling the plug from an infected system?

A

Least stealthy option and will reduce opportunities to analyze the attack or malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Define a ‘sinkhole’

A

Honeynet; DoS attack mitigation strategy that directs the traffic that is flooding a target IP address to a different network for analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Define ‘Segmentation-Based Containment’

A

A means of achieving the isolation of a host or group of hosts using network technologies and architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How can different layer 2/3 technologies be used to perform isolation?

A

Reconfiguring routing/firewall infrastructure to isolate infected VLANs and subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Define the fifth step (eradication) of the CompTIA incident response lifecycle

A

Removes the cause of compromise and restores the affected system by applying secure configurations and/or installing patches once the incident has been contained.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define the sixth step (recovery) of the CompTIA incident response lifecycle

A

Process in which hosts, networks, and systems are brought back to a secure baseline configuration and ensuring that the system cannot be compromised through the same attack vector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the 3 steps of eradication and recovery efforts?

A
  1. Reconstitution of affected system
  2. Re-audit security controls
  3. Notify affected parties
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define ‘Reconstitution of affected system’

A

Removing malicious files or tools from affected systems or restoring systems from secure backups/images.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define ‘Re-audit security controls’

A

By ensuring no vulnerability to the same attack or from a new attack that could be launched through information gained from the initial attack; Changing cipher suites, a new system/OS, new cryptographic keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Why is it important to notify affected parties after reconstitution of affected system and re-audit of security controls?

A

To provide the means to remediate their own systems/accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Define the seventh step (lessons learned) of the CompTIA incident response lifecycle

A

Analyzes the incident and responses to identify whether procedures or systems could be improved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Define a ‘lessons learned report (LLR)’ or ‘after-action report (AAR)’

A

An analysis of events that can provide insight into how to improve response and support processes in the future.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What should be included in a lessons learned report (LLR)?

A

A root cause analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Define ‘root cause analysis’

A

A technique used to determine the true cause of the incident, and when removed, it prevents the problem from occurring again.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Define a ‘tabletop exercise’

A

A facilitator presents a scenario, and the responders explain what action they would take to identify, contain, and eradicate the threat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Define a ‘walkthrough exercise’

A

A facilitator presents the scenario similar to a tabletop exercise, but the incident responders demonstrate what actions they would take in response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What separates a walkthrough from a tabletop exercise?

A

Running scans and analyzing sample files, typically on sandboxed versions of the company’s actual response and recovery tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Define ‘Threat hunting’

A

Insights gained from threat intelligence to proactively discover whether there is evidence of TTPs already present within the network or system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Define ‘Intelligence fusion’

A

Using sources of threat intelligence data to automate detection of adversary IoCs and TTPs.

52
Q

What can intelligence fusion be implemented with?

A

In a security information and event management (SIEM).

53
Q

Define a ‘maneuver’ in threat hunting

A

Blinding attack/distraction; The concept that threat actor and defender may use deception or counterattacking strategies to gain positional advantage.

54
Q

Define ‘Digital forensic analysis’

A

Examining evidence gathered from computer systems and networks to a standard that will be accepted in a court of law; Deleted files, timestamps, user activity, and unauthorized traffic.

55
Q

How is digital evidence similar to DNA or fingerprints?

A

They are all latent; the evidence cannot be seen with the naked eye; It must be interpreted using a machine or process.

56
Q

Because digital evidence is latent, what must be considered when using the evidence in procecution?

A

Steps must be taken to ensure the admissibility of digital evidence; Requires documentation showing how the evidence was collected and analyzed without tampering or bias.

57
Q

Define a ‘legal hold’

A

A process designed to preserve all relevant information when litigation is reasonably expected to occur.

58
Q

Define ‘Acquisition’ in a legal sense

A

Process of obtaining a forensically clean copy of data from a device seized as evidence.

59
Q

Define ‘Data acquisition’

A

Tools used to create a forensically clean copy of data from a source device.

60
Q

During the acquisition process, what is best practice when making images of volatile and nonvolatile storage?

A

To capture evidence in the order of volatility, from more volatile to less volatile.

61
Q

What is the best practice order for data acquisition?

A
  1. CPU registers and cache memory
  2. RAM and other nonpersistent memory
  3. HDDs, SSDs, flash memory
  4. Remote logging and monitoring data
  5. Physical configuration and network topology
  6. Archival media and printed documents
62
Q

Define volatile memory

A

Data is lost when power is removed.

63
Q

Define a ‘dump’

A

A file containing data captured from system memory.

64
Q

Define a ‘system memory dump’

A

An image file of running processes; Temporary files, registry data, network connections, cryptographic keys, etc.

65
Q

Define ‘disk image acquisition’

A

Acquiring data from nonvolatile storage; HDDs, SSDs, flash memory, optical media (CD/DVD).

66
Q

What are the 3 types of device states for disk image acquisistion?

A
  1. Live acquisition
  2. Static acquisition by shutting down the host
  3. Static acquisition by pulling the plug
67
Q

Define ‘Live acquisition’

A

Copying the data while the host is still running.

68
Q

What is the upside to live acquisition?

A

Captures more evidence/data for analysis and reduces the impact on overall services.

69
Q

What is the downside to live acquisition?

A

The data on the actual disks will have changed, so this method may not produce legally acceptable evidence; May also alert the bad actor and allow time to perform anti-forensics.

70
Q

What is the drawback of static acquisition by shutting down the host?

A

Runs the risk that the malware will detect the shutdown process and perform anti-forensics to try to remove traces of itself.

71
Q

What is the benefit and disadvantage of static acquisition by pulling the plug?

A

Most likely to preserve the storage devices in a forensically clean state, but there is the risk of corrupting data.

72
Q

What is paramount when performing any sequence of acquisition?

A

To document the steps taken and supply a timeline and video-recorded evidence of actions taken to acquire the evidence.

73
Q

What is the ‘‘dd command’’ in Linux and its function?

A

Linux command that makes a bit-by-bit copy of an input file, typically used for disk imaging.

74
Q

What is the syntax for the dd command to image a disk?

A

dd if=input file of=output file

75
Q

What is the value of a video verified
timeline in digital forensics?

A

Establishes the provenance; Being able to trace the source of evidence to a crime scene and show that it has not been tampered with.

76
Q

When creating a forensically sound image from nonvolatile storage, what is to be considered when choosing the capture tool?

A

Capture tool must not alter data or metadata (properties) on the source disk or file system.

77
Q

Where is data acquisition typically performed?

A

By attaching the target device to a forensics workstation or field capture device equipped with a write blocker.

78
Q

Define a ‘write blocker’ and its purpose

A

A forensic tool to prevent the capture tool or analysis device from changing data on a target disk or media.

79
Q

What is the first step in data acquisition?

A

A cryptographic hash of the disk media is made, using either the MD5 or SHA hashing function.

80
Q

What is the second step in data acquisition?

A

A bit-by-bit copy of the media is made using an imaging utility.

81
Q

What is the third step in data acquisition?

A

A second hash is then made of the image, which should match the original hash of the media.

82
Q

What is the fourth step in data acquisition?

A

A copy is made of the reference image, validated again by the checksum. Analysis is performed on the copy.

83
Q

Define ‘Chain of custody’

A

Record of handling evidence from collection to presentation in court to disposal.

84
Q

What is the reason for documenting chain of custody when security breaches go to trial?

A

Establishes the integrity and proper handling of evidence; Protects an organization against accusations that evidence has either been tampered with.

85
Q

Define ‘E-discovery’

A

Filtering relevant evidence produced from all the data gathered in a forensic examination and storing it in a database in a format such that it can be used as evidence in a trial.

86
Q

What is an IoC that reveals the presence of a hidden partition?

A

Unused space in an extended partition.

87
Q

What is a file system metadata structure that is used to store and organize file object information, such as file size, owner, permissions, and timestamps?

A

inode

88
Q

Define a ‘data source’ in context of digital forensics

A

Something that can be subjected to analysis to discover indicators.

89
Q

What are typical data sources?

A

Log files from a network device, host/OS, application, system memory, etc.

90
Q

What two ways can a SIEM platform be used for automated reporting?

A
  1. Alerts/Alarms to detect the presence of an IoC
  2. Status reports
91
Q

Define ‘metadata’

A

Information stored or recorded as a property of an object, state of a system, or transaction.

92
Q

What are the 3 components of a syslog message?

A
  1. PRI code
  2. Header
  3. Message
93
Q

Define the PRI code of a syslog message

A

Calculated from the facility and a severity level.

94
Q

Define the header of a syslog message

A

Contains a timestamp, host name, app name, process ID, and message ID fields.

95
Q

Define the the message of a syslog alert

A

Contains a tag showing the source process plus content.

96
Q

What do security logs typically contain?

A

Audit events, such as a failed login or access to a file being denied.

97
Q

Define an ‘endpoint log’

A

A target for security-related events generated by host-based malware and intrusion detection agents.`

98
Q

Define an ‘email’s internet header’

A

A record of the email servers involved in transferring an email message from a sender to a recipient.

99
Q

How can metadata play a role in analysis of an incident?

A

Establish timeline questions, such as when and where a breach occurred, as well as containing other types of evidence.

100
Q

Where can email metadata such as an email header be viewed?

A

Via commands on a mail client or from a message transfer agent (MTA).

101
Q

Define the function of a security information and event management (SIEM)?

A

Provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.

102
Q

What are the 3 forms of collection that a security information and event management (SIEM) can utilize?

A
  1. Agent-based
  2. Listener/Collector
  3. Sensor
103
Q

Define a ‘Listener/Collector’

A

A network appliance that gathers or receives log and/or state data from other network systems.

104
Q

Define ‘log aggregation’

A

Parsing information from multiple data sources so that it can be presented in a consistent and searchable format.

105
Q

Define ‘correlation’

A

A function of log analysis that links log and state data to identify a pattern that should be logged or alerted as an event.

106
Q

Define an ‘executive report’ and its purpose

A

High-level summary for decision-makers. This guides planning and investment activity.

107
Q

Define a ‘manager report’ and its purpose

A

Provides cybersecurity and department leaders with detailed information. This guides day-to-day operational decision-making.

108
Q

Define ‘alert tuning’

A

Process of adjusting detection and correlation rules to reduce incidence of false positives and low-priority alerts.

109
Q

How can a rule/alert level be adjusted to correct false positives?

A

Adjust the parameter of the rules, adding more correlation factors, setting to log only/no alert, or to produce a notification for x amount of events.

110
Q

In order to alleviate the number of alerts at an analyst’s dashboard, what can be done to reduce alerts?

A

By redirecting alerts to a different group based on the type of alert.

111
Q

How can AI help develop alerting?

A

Deploying machine learning (ML) to rapidly analyze the sort of data sets produced by SIEM and how analysts respond to alerts and tuning the ruleset in a way that reduces alert.

112
Q

Define a ‘network monitor’

A

Auditing software that collects status and configuration information from network devices typically based on SNMP.

113
Q

Define the difference between a ‘flow collector’ and a network monitor

A

Records metadata and network traffic statistics rather than recording each frame for analysis.

114
Q

What is the purpose of a flow collector?

A

Highlight patters in traffic; Alert based on anomalies, flow patterns or custom rules; Visualization of network.

115
Q

How does a flow collector define a specific traffic flow?

A

By packets sharing the same characteristics, referred to as keys.

116
Q

What is a collection of keys identifying a traffic flow called?

A

A flow label.

117
Q

If traffic matches a key/flow label, what is it called?

A

A flow record.

118
Q

What is a flow label made up of?

A

Packets that share the same key characteristics, such as IP source and destination addresses and protocol type; Also known as a 5-tuple.

119
Q

Define a ‘system monitor’

A

Software that tracks the health of a computer’s subsystems using metrics reported by system hardware or sensors; high temperature, chassis intrusion, and so on.

120
Q

What protocol does a vulnerability scanner use to determine if a host/app/service meets security best practice?

A

Security Content Automation Protocol (SCAP) allows compatible scanners to determine whether a computer meets a configuration baseline.

121
Q

What two tools does the Security Content Automation Protocol (SCAP) use to determine if a computer meets baseline?

A
  1. Open Vulnerability and Assessment Language (OVAL)
  2. Extensible Configuration Checklist Description Format (XCCDF)
122
Q

What is the difference between a sensor and a collector, in the context of SIEM?

A

A SIEM collector receives log data from a remote host and parses it into a standard format that can be recorded within the SIEM; A sensor (or sniffer) copies data frames from the network, using a mirror port or a TAP.

123
Q

Which type of analysis involves deep-down, frame-by-frame scrutiny of captured network traffic to decode packet header fields and payload contents, aiding in identifying attack tools, data exfiltration attempts, and suspicious domains?

A

Retrospective network analysis (RNA)

124
Q

Define ‘Retrospective network analysis’

A

Recording the totality of network events at a packet header or payload level.

125
Q

What is the purpose of retrospective network analysis?

A

Detailed analysis of captured traffic to identify attack tools, data exfiltration attempts, and suspicious domains.

Security+ (SY0-701) (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions