Misc

Question 1

Nmap TCP SYN scan is also known as?

Answer 1

Stealth scan or half open scan

Question 2

Nmap -sI (capital i)

Answer 2

Zombie scan/decoy also known as Idle scan

Question 3

NIST 800-53

Answer 3

Information security standard that provides a category of privacy and security controls for information systems

Question 4

CVSS Base Metrics
AV
AC
PR
UI
S
C
I
A

Answer 4

AV (Attack Vector) N=Network, A=Adjacent, L=Local, P=Physical

AC (Attack Complexity) L=low, H=High

PR (Privileges Required) N=None, L=Low, H=High

UI (User Interaction) N=None, R=Required

S (Scope) U=Unchanged, C=Changed

Confidentiality, Integrity, Availability
H=High, L=Low, N=None

Question 5

High Risk Ports

Answer 5

SSH 22, Telnet 23, FTP 20 & 21, NetBIOS 137-139, SMB 445, DNS 53, POP3 110, RDP 3389, SMTP 24, SQL 3306

Question 6

SLA

Answer 6

Service Level Agreement
Contract with performance metrics, how they are measured, penalties

Question 7

MOU

Answer 7

Memorandum of Understanding
Not binding, outlines plans

Question 8

IoC

Answer 8

Indicator of Compromise
Behavioral- change login patterns, excessive file access or sharing, access unauthorized resources

Network- abnormal traffic patterns, access from malicious IP, multiple failed logins, malware

Host-Based- Process ID, registry keys, network connections

Question 9

Cloud Infrastructure Assessment Tools

Answer 9

Pacu
Prowler
Scout Suite

Question 10

Open Source Security Testing Methodology Manual (OSS TMM)

Answer 10

Developed by ISECOM and used for security testing and analysis.

Question 11

Beaconing Traffic IoCs

Answer 11

Regular
Small footprint (might be just SYN)
Changing IPs and domains
Protocols: IRC, DNS, HTTP(S), social media

Question 12

Peer-to-Peer (P2P) Communication IoCs

Answer 12

Hidden in SMB or IPP
ARP/man in the middle using ARP spoofing

Question 13

Rouge Devices IoCs

Answer 13

Rouge devices can be unaccounted for and/or unwanted
Detection: human eye, network mapping, NAC and intrusion detection

Question 14

Nonstandard Port Usage IoCs

Answer 14

Well know ports: 0-1023 TCP/UDP
Registered ports: 1024-49151 TCP/UDP
Dynamic and private: 49152-65535

Question 15

Data Exfiltration IoCs

Answer 15

Stealing data
HTTP(S) channel with public storage services
Web app attacks (SQLi)
DNS as a channel
E-mail, P2P, IM
Encrypted tunnels (IPsec, SSL)

Question 16

Convert Channel IoCs

Answer 16

Outbound traffic is seldom filtered
Encoding data in protocol headers
Fragmentation
Encryption
Steganography

Question 17

Host-Based IOCs

Answer 17

Malicious Processes
Registry Changes
Network Traffic
High Resource Usage

Question 18

UEBA

Answer 18

User and Entity Behavior Analysis

UEBA is a cybersecurity solution that uses algorithms and machine learning to detect anomalies in the behavior of both users and devices.