Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified SOC Analyst > Module 02: Understanding Cyber Threats, IoCs, and Attack Methodology > Flashcards

Module 02: Understanding Cyber Threats, IoCs, and Attack Methodology Flashcards

1
Q

What is a cyber threat?

A

An act in which the adversary attempts to gain unauthorized access to an organization’s network by exploiting communication paths.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What three things are behind a threat?

A

Intent
Capability
Motive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is TTP?

A

Part of the capability behind a threat. Tactics, Techniques, and Procedures used to target an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What allows the opportunity of a threat?

A

Security vulnerabilities or weaknesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the typical attack vectors?

A 
Cloud computing threats
Viruses and worms
Ransomware
Mobile threats
Botnet
Insider threat
Phishing
Web application threats
IoT threats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the formula of an attack?

A

Attack=Motive(goal) + Method (TTPs) + Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does motive originate from?

A

A motive originates out of the notion that the target system stores or processes something valuable, and this leads to a threat of an attack on the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are tactics?

A

Strategy followed by an attacker to perform the attack from beginning to end i.e. information gathering for initial exploitation, privilege escalation, lateral movement, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are techniques?

A

Technical methods used by an attacker to achieve intermediate results during the attack i.e. initial exploitation, setting up and maintaining C&C channels, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are procedures?

A

Organizational approach followed by the threat actors to launch an attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a vulnerability?

A

The existence of a weakness, design, or implementation error that, when exploited, leads to an unexpected and undesired event compromising the security of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a reconnaissance attack?

A

Attackers attempt to discover target network’s information to gain as much knowledge as possible around open ports, services, IPs, network layout etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are common reconnaissance methods?

A

Social engineer
Port scanning
DNS footprinting
Ping sweeping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two types of reconnaissance attacks?

A

Active and Passive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are five types of network level attacks?

A 
Packet sniffing
Port scanning
Ping sweeping
DNS footprinting
Social engineering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What type of attack is used to check for live hosts, services, ports, etc.

A

Network scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a popular network scanning tool?

A

nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What process checks what services are running on a target computer by sending a sequence of messages?

A

Port scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the various network level attacks?

A

Reconnaissance
Network scanning
Port Scanning
DNS Footprinting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What attack allows the attacker to determine key hosts in the network and perform social engineering attacks?

A

DNS footprinting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

This process monitors and captures all data packets passing through a given network using sniffing tools

A

Network sniffing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What often allows an attacker to perform network sniffing on a network?

A

Unsecured switch ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the three types of network sniffing?

A

Internet
External
Wireless

24
Q

What type of attack involves setting up a station between the client and server to capture and manipulate the traffic/session?

A

Man-in-the-middle attack

25
Q

What types of communication are susceptible to MiTM attacks?

A

Login functionality
Unencrypted comms
Financial sites

26
Q

What type of password attack involves using a file of common words, phrases, etc. against an application?

A

Dictionary attack

27
Q

This type of password attack tries every combination until the password is cracked.

A

Brute force

28
Q

It works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password

A

Hybrid attack

29
Q

It attacks cryptographic hash functions based on the probability that if a hashing process is used for creating a key, then the same is used for other key

A

Birthday attack

30
Q

It attacks rainbow tables that store pre-computed hash values in plaintext

A

Rainbow table attack

31
Q

What is privilege escalation?

A

An attacker performs a privilege escalation attack which takes advantage of design flaws, programming errors, bugs, and configuration oversights in the OS and software application to gain administrative access to the network and its associated application

32
Q

Unauthorized manipulation of IP addresses in the domain naming server cache is known as what?

A

DNS poisoning

33
Q

What is the goal of DNS poisoning?

A

Re-direct users to malicious sites

34
Q

What is ARP poisoning?

A

ARP poisoning is an attack in which the attacker tries to associate their own MAC address with the victim’s IP address so that the traffic meant for that IP address is sent to the attacker.

35
Q

What is a DHCP starvation attack?

A

Process of inundating DHCP servers with fake DHCP requests resulting in all available IP addresses being used.

36
Q

What is a DHCP spoof attack?

A

Process of implementing a rogue DHCP server and serving requests to clients.

37
Q

What type of attack involves sending large amounts of traffic to target network than it can handle, resulting in exhaustion of resources?

A

Network-based denial of service attack

38
Q

What are four types of network based DOS attacks?

A

TCP SYN Flooding
ICMP Smurf Flooding
UDP Flooding
Intermittent Flooding

39
Q

This type of attack floods the target and does not respond with the expected ACK

A

TCP SYN Flooding

40
Q

This type of attack sends an ICMP echo broadcast and spoofs the source to be the target IP resulting in them being flooded.

A

ICMP Smurf Flooding

41
Q

What is a Distributed Denial of Service attack?

A

A DOS attack that involves many compromised systems i.e. botnets to carry out the attack.

42
Q

What are the two types of DDoS?

A

Network-centric - overloads service by consuming bandwidth

Application-centric - overloads service by sending inundate packets

43
Q

What is malware?

A

Malicious software that aim to disrupt service, gather sensitive information, damage systems, etc. Typically installed without the user’s knowledge.

44
Q

This type of malware is a program that can duplicate itself by making copies of itself. It can only spread from one PC to another when its host is taken to the uncorrupted computer.

A

Virus

45
Q

This type of malware can replicate through a network on its own.

A

Worm

46
Q

This type of virus is coded with different mechanisms to make its detection difficult.

A

Armored virus

47
Q

A malicious program that masquerades as legitimate software.

A

Trojan

48
Q

A software program that tracks the user’s browsing patterns for marketing
purposes and displaying advertisements. It collects the user’s data, such as what types of Internet sites the user visits in order to customize the adverts that are relevant to the user.

A

Adware

49
Q

A software program that hides its activities from detection and performs malicious activities to get privileged access to a target computer.

A

Rootkit

50
Q

This malware changes its signature to avoid pattern matching detection by antivirus programs.

A

Polymorphic malware

51
Q

A type of network attack, where an attacker gains unauthorized access to a target network and remains there undetected for a long period of time

A

APT - Advanced Persistent Attack

52
Q

What is the main goal of an APT?

A

To obtain sensitive information

53
Q

What are the characteristics of APT?

A 
Objectives
Timeliness
Resources
Risk Tolerance
Skills and Methods
Actions
Attack Origination Points
Numbers Involved in the Attack
Knowledge Source
Multiphased
Tailored to the Vulnerabilities
Multiple Points of Entries
Evading Signature-Based Detection Systems
Specific Warning Signs
54
Q

What is the APT threat lifecycle?

A 
Preparation
Initial Intrusion
Expansion
Persistence
Search and Exfiltration
Cleanup
55
Q

What are the main types of host-level attacks?

A

Malware infection
Accidental or intentional deletion of data
Unauthorized access

56
Q

Where do host-level attacks come from?

A 
Un-patched computers
Email
Blended threats
Network file shares
Social engineering
Internet downloads

Certified SOC Analyst (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions