Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Operations > Midterm > Flashcards

Midterm Flashcards

1
Q

Hacking

A

producing an outcome that the system’s designers never intended or anticipated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Penetration Tester

A

Simulates cyber attacks for the purpose of improving organizational security. Focus on comprehensiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Red/Purple Team

A

Simulates cyber attacks like a pen tester,
however, the focus is more on emulating an adversary and testing an organization’s response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cyber Operator

A

Works with or for the military to hunt threats,
protect assets, and provide access to sensitive and secure
environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Vulnerability Researcher

A

Searches for yet unknown vulnerabilities
in software or hardware products

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Vulnerability Analyst

A

Analyzes computer networks and/or systems
for the presence of known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CSIRT (Computer Security Incident Response Team) Analyst or Responder

A

Respond to and eradicate active threats within an
organization’s computer systems or networks. “Blue” team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cyber Crime Investigator or Forensic Analyst

A

Collect and analyze data from computer systems and networks to uncover certain actions or behaviors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Intelligence Analyst

A

Mitigate risk by collecting and disseminating
information about threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Software Engineer

A

Develop and maintain software systems to be resistent to misuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Ethical Hacking

A

Combining technical skills and understanding of an
attacker’s mindset to simulate a hostile attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IT security audit

A

Determine whether an organization’s deployed
controls align with the security policy. Focused more on compliance with policy and best practice than assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Vulnerability assessment

A

Survey of a system to identify as many
vulnerabilities as possible. Focused on identifying the vulnerabilities, not necessarily proving that they can be exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Penetration test

A

Assess the security posture of a scoped network
or resource by actively trying to exploit it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Red team

A

Assess an organization’s response to an emulated adversary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Cyber Operation

A

Military operation that is an ethical cyber attack or defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the difference between an ethical test and an unethical cyber attack?

A

Consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CIA Triad

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why would a penetration test start from “assumed breach”?

A
  1. To provide a test to the customer in the most cost-effective manner
  2. To accurately simulate insider threats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the steps of the Cyber Kill Chain?

A

Reconnaissance
Scanning
Infiltration and Escalation
Exfiltration
Access Extension
Assault
Obfuscation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CVE

A

Common Vulnerabilities and Exposures
They represent specific vulnerabilities and exposures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CWE

A

Common Weakness Enumeration
They are not specific vulnerabilities, but weaknesses that can lead to vulnerabilities.
Ex. CWE-242: Use of Inherently Dangerous Function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

CAPEC

A

Common Attack Pattern Enumeration and Classification
It is a catalog of types of attacks
Ex. CAPEC-148: Content Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NVD

A

National Vulnerability Database
Takes CVEs and pairs them with CVSS severity scores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Open Source Intelligence (OSINT)

A

derived from data and information that is available to the general public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Footprinting

A

An adversary engages in probing and exploration activities to
identify constituents and properties of the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Fingerprinting

A

An adversary compares output from a target system to
known indicators that uniquely identify specific details about the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the order of Recon?

A

OSINT
Footprinting
Fingerprinting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Pagodo

A

A python module which automates performing Google dorks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

WHOIS

A

allows us to figure out information about a domain and provides
contact information for that domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

RIR

A

Regional Internet Registry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Nslookup and Dig

A

query nameservers for DNS records from a particular domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Hunter.io

A

used to find emails and contact info from
people at a company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

DNSDumpster

A

Online tool that compiles information from multiple sources to get a better picture of domain information leakage. Uses multiple sources to find subdomains that you
might not know about

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Attack Surface

A

number of all possible points, or attack vectors, where an unauthorized user can access a system and extract data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Vulnerability

A

A weakness that can be exploited to gain unauthorized access to a computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Order of Scanning

A

Host Discovery
Port Scanning
OS Identification
Service Identification
Vulnerability Scanning

38
Q

ICMP Host Discovery Techniques

A

ICMP Echo Request Ping - Expect ICMP Type 0 Echo Reply if up

ICMP Address Mask Request - Expect ICMP Type 18 Address Mask Reply if up

ICMP Timestamp Request - Expect ICMP Type 14 Timestamp Reply if up

39
Q

TCP Host Discovery Techniques

A

TCP SYN Ping - Expect SYN/ACK if up

TCP ACK Ping - Expect RST if up

40
Q

Other Host Discovery Techniques

A

UDP Ping - Expects an ‘ICMP port unreachable’ message if up

ARP Ping - Expect to receive ARP reply if up

41
Q

System Ports

A

Ports 0-1023
Assigned to specific service by IANA
Usable only by privileged programs

42
Q

User Ports

A

Ports 1024-49151
Assigned to specific service by IANA
Usable by unprivileged programs

43
Q

Dynamic Ports

A

Ports 9152-65535
used by client programs for source ports

44
Q

What are the 3 port states?

A

Open
Closed
Filtered

45
Q

TCP Port Scanning Techniques

A

TCP Connect Scan - Open: Connection, Closed: RST

TCP SYN Scan - Open: SYN/ACK, Closed: RST

TCP ACK Scan - Unfiltered: RST, Filtered: No Response

46
Q

Less Common TCP Port Scanning Techniques

A

TCP NULL Scan
TCP FIN Scan
TCP Xmas Scan
Open: No response
Closed: RST

47
Q

UDP Port Scan

A

Open: Response from service (unlikely) or No response (could also mean filtered)

Closed: ICMP Type 3 Port unreachable error message

48
Q

Banner Grabbing

A

Connecting to a service as if we are going to use it, but instead we’re interested in what the service tells us about itself

49
Q

Masscan

A

tool for host discovery on large subnets
blasts SYNs without waiting for a reply. When it gets a reply, it

50
Q

EyeWitness

A

tool that allows you to collect screenshots from
a list of hosts or from other scan results

51
Q

Dirbuster

A

tool that allows you to brute-force enumeration of web addresses based on a wordlist

52
Q

FFUF

A

Guesses web addresses based on a wordlist

53
Q

Vulnerability Management

A

Vulnerability management is the ongoing, regular process of identifying, assessing, reporting on, managing and remediating cyber vulnerabilities across endpoints, workloads, and systems

54
Q

What is Nessus used for?

A

Vulnerability Scanning

55
Q

Intrusion Detection Systems (IDS)

A

monitor for threats by looking at network traffic; near real-time

56
Q

Intrusion Prevention Systems (IPS)

A

prevents threats found through looking at network traffic; real-time

57
Q

TAPs

A

Test Access Points
mirror all packets using an inline device, detection is run on copies
Slow but don’t drop packets
Prefered

58
Q

SPAN ports

A

Switch or router copies packets and sends them out another port to the security tool
Fast but drop lots of packets

59
Q

Vulnerability

A

A weakness in a system or network which can be exploited to cause the system to act in an unintended way

60
Q

Exploit (verb)

A

Using a vulnerability to cause a system to act in an unintended way

61
Q

Exploit (noun)

A

Code that uses a vulnerability to cause a system to act in an
unintended way

62
Q

Payload

A

Code which is run on the target system as a result of an exploit

63
Q

Server-side Exploitation

A

A server is running and there is some misconfiguration or software bug which allows us to cause the server to act in an unintended way.
Ex: MS17-010, aka Eternal Blue

64
Q

Client-side

A

exploit misconfigurations or bugs in software,
and exploits the trust relationship between the client and server
Ex: Cross-site Scripting (XSS)

65
Q

Social Engineering

A

Here we attacking the “vulnerability” of trust relationships in and by humans.
Ex: Phishing

66
Q

Post-Exploitation

A

anything we do after running a payload on the target system
Ex. Credential theft

67
Q

Access Extension

A

Making it easier to come back next time

68
Q

Pivoting

A

Gaining access to previously unreachable systems

69
Q

Obfuscation

A

Covering our tracks

70
Q

Why do we use reverse shells?

A

Does not create a new vulnerability on the system for other attackers to use

More likely to bypass firewall restrictions

Connections can be made out of NAT’d environments but not necessarily in

71
Q

Staged Payload

A

The original payload fetches another payload and runs it

72
Q

Pros and Cons of a Staged Payload

A

Pro:
The original payload is small, which allows it to be easier to use in an exploit with size requirements.

Con:
More complicated
May be easier to detect on the network
Requires additional network connectivity to run the second stage

73
Q

Stageless Payload

A

The “real” payload is the original payload

74
Q

Pros and Cons of a Stageless Payload

A

Pro: Simpler. No additional network connectivity required

Con: The payload itself is larger

75
Q

Mfsvenom

A

command line tool that allows you to generate custom
payloads which interact with Metasploit

76
Q

What Metasploit module is used to catch a reverse shell from an msfvenom payload?

A

exploit/multi/handler

77
Q

DNS Domain Hierarchy

A

Root (.)
Top Level Domains (TLD) (ev. .com, .edu)
Second Level Domain (ex. google, example)

78
Q

DNS Query Order

A

Root
TLD
Second Level Domain

79
Q

How does the Kaminsky attack work?

A
  1. Query: Whats the ip address of qwrqqwe.example.com
  2. Local cache sends request to example.com’s DNS server
  3. Flood the local cache with spoofed replies with your own NS as the authoritative NS for the domain
80
Q

How big is the TID in a DNS request or reply?

A

2 bytes

81
Q

Username Enumeration

A

enum4linux - uses NULL sessions

RID Cycling
1. Assume that some common names exist. Using the NULL session,
request the SID for that username.
2. Get a SID
3. The last part is the RID It’s used to identify
different users in a domain
4. Remove the RID and add a new one, checking for existence. So, start
with 500 (administrator), 501 (guest/nobody), and work your way up

82
Q

Password Spraying

A

guess a single (or a few) password(s) across many
usernames. Looking for at this point is any valid
credential

83
Q

Password Cracking

A

guessing a bunch of passwords, hashed them all, and compared each one to the hash we have

84
Q

Dumps the SAM database

A

post/windows/gather/hashdump

85
Q

A meterpreter command in the ‘kiwi’ extension used to inject into LSASS

A

creds_all

86
Q

Active directory database that cannot be copied with normal file operations

A

ntds.dit

87
Q

Has hashes that correspond to the users in /etc/passwd

A

/etc/shadow

88
Q

Salting hashes makes it harder to do what type of password cracking?

A

Rainbow table attack

89
Q

When cracking a WPA/WPA2 key, why does the attacker perform a deauthentication?

A

To force an authentication challenge/response

90
Q

What activity is most likely to cause account lockout

A

Password guessing

Cyber Operations (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions