Messer Practice Exam 3 Flashcards
What is an “EDR”?
Endpoint Detection and Response (EDR) is a security solution for end-user devices to protect against malicious software and threats.
What does an “Evil Twin” do?
An access point designed to look exactly like access points on the network.
Common characteristics: similar SSID name, configuration settings, or placing it where users would expect to see one.
What is “Code Signing”?
When an application developer digitally signs his code.
Used to validate that nothing has changed with the application code since it has been published.
What is “TOTP”?
Time-based One-Time Password
An algorithm that provides a pseudo-random number as an authentication factor.
What is “HOTP”?
HMAC (Hash Message Authentication Code)-based One-Time Password
an algorithm that provides an authentication factor based on a one-time password.
Difference between TOTP and HOTP
TOTP: You get a password based on the time-of-day.
HOTP: you get a password based on a counter.
What does “MTTR” stand for?
Mean Time to Restore
EXAMPLE: It takes approx. 6 hours to restore the system.
What is a relatively common occurrence with non-credentialed network scans?
It is relatively common for vulnerability scans to show vulnerabilities that don’t actually exist, especially if the scans are not credentialed.
Just make sure to confirm that it is in fact a false positive, before dismissing the vulnerability notification.
What is “Minimization”?
A data collection policy that limits the amount of personal or private information that can be gathered.
What is “PCI DSS”?
Payment Card Industry Data Security Standard (PCI DSS)
It is a set of security rules and guidelines for storing credit card information.
What is “SSAE SOC 2”?
Statement on Standards for Attestation Engagements, System and Organization Controls 2 (SSAE SOC 2).
An auditing standard for IT systems.
What is “CSA CCM”?
Cloud Security Alliance Cloud Controls Matrix (CSA CCM)
Provides security information and guidelines for cloud-based applications.
What is the main perk of a RTOS?
Real-Time Operating System (RTOS)
It can instantly react to input without any significant delays or queuing in the operating systems.
What is “ICS” (Aka “SCADA”)?
Industrial Control System (ICS)
Supervisory Control and Data Acquisition System (SCADA)
A dedicated network used to manage and control manufacturing equipment, power generation equipment, water management systems, and other industrial machines.
What is a “MFD”?
Multi-function Device (MFD)
Commonly associated with a device that can print, scan, and fax.
What is “Certificate Pinning”?
It involves embedding the fingerprint of a certificate inside of an APPLICATIONNN, ensure that communication only occurs with trusted servers.
This extra layer of protection reduces the risk of Man-in-the-Middle attacks.
What is the point of an “Offline CA”?
Its a common way to prevent the exploitation of a root authority.
A security administrator is concerned that a user may have installed a rogue access point on the corporate network. Which of the following could be used to confirm this suspicion?
Switch Log - An analysis of switch interface activity would be able to identify any new devices and their MAC Addresses.
What is “Certificate Chaining”?
The process of verifying digital certificates in a hierarchical manner to establish trust. It involves checking the chain of certificates starting from the end-entity certificate to the root certificate authority.
By ensuring each certificate in the chain is valid and trusted, it establishes integrity and security with communication.
What is a “UTM Gateway”?
A Unified Threat Management (UTM) Gateway is an all-in-one device that provides firewall services, URL filtering, spam filtering, and more.
NOTE: From the UTM perspective, traffic from a rogue access point would look similar to all other network traffic.
What is “XSS”?
Cross-Site Scripting (XSS)
Step 1: Attacker injects the websites with malicious scripts that will execute in another user’s browser.
Step 2: The malicious script is activated with each visit to the website.
Step 3 (Occasionally): In some attacks, the victim’s cookies are stolen, or private credentials are revealed.
EXAMPLE: A url contains
What does “CSRF” do?
Cross-Site Request Forgery (CRSF)
Example:
Step 1: Perpetrator forges a request for a fund transfer to a website.
Step 2: Perpetrator embeds the request into a hyperlink and sends it to visitors who may be logged into the site.
Step 3: A visitor clicks on the link, inadvertently sending the request to the website.
Step 4: The website validates the request and transfers funds from the visitor’s account to the perpetrator.
Main Reason to use “Tabletop exercise”?
It is a walk-through exercise where the disaster recovery process can be discussed in a conference room WITHOUT MAKING CHANGES TO EXISTING SYSTEMS/INFRASTRUCTURE!
What does “HA” stand for and what does it mean?
High Availability (HA)
This means that the service should always be on an available.
What does a “SIEM” do?
It consolidates data from devices on the network and provides log searching and reporting features.
When do you use a “Static Code Analyzer”?
When evaluating the security of existing Source Code. It wouldn’t be useful for dynamic input validation. Manually writing input validation into your code is how you implement input validation.
Sam, a user in the purchasing department, would like to send an email to Jack. Which of these would allow Jack to verify the sender of the email?
The sender of a message (Sam in this case_ digitally signs with their own private key to ensure integrity, authentication, and non-repudiation. The digital signature is validated with the sender’s public key.
The contractor of a long-term temporary employee is ending. What would be one of the most critical part of the off-boarding process?
Archiving the decryption keys associated with the user’s account.
Without the decryption keys, it will be impossible to access any of the user’s protected files once they leave the company.
What does a “Honeypot” do?
It simulates a production environment.
When attackers attempt to exploit the honeypot, their techniques and methods are logged. With these logs, administrators can gain additional insights into the attachks and processes used by attackers.
What is a “Runbook”?
A runbook is like a bit of a cookbook that has detailed steps on how to perform a particular task.
