MODULE 1: Intro to Ethical Hacking Flashcards

1
Q

What is the assurance that information is accessible only to those authorized to have access?

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the trustworthiness of data or resources in terms of preventing improper and unauthorized changes?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is assurance that the systems responsible for delivering, storing, and processing information are accessible when required by the authorized users?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What refers to the characteristic of a communication, document, or any data that ensures the quality of being genuine?

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message?

A

Non-Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What term refers to the use of information and communication technologies (ICT) to take competitive advantages over an opponent?

A

Information Warfare or InfoWar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of information warfare refers to all strategies and actions to defend against attacks on information and communication technologies assets?

A

Defensive Information Warfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What type of information warfare involves attacks against information and communication technologies assets of an opponent?

A

offensive information warfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What classification of attack does not tamper with data and involves intercepting and monitoring network traffic and data flow on the target network? (Ex: sniffing, eavesdropping)

A

Passive Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What classification of attack tampers with data in transit or disrupts communication or services between systems in order to bypass or break into secured systems? (Ex: DoS, MiTM, session hijacking, and SQL Injection)

A

Active Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What classification of attack is performed when the attacker is in close physical proximity with the target system or network in order to gather, modify, or disrupt access to information? (Ex: social engineering such as eavesdropping, shoulder surfing, and dumpster diving)

A

Close-In Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What classification of attack involves using privileged access to violate rules or intentionally cause a threat to the organization’s information or information systems? (Ex: theft of physical devices, planting keyloggers, backdoors, and malware)

A

Insider Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What classification of attack occurs when attackers tamper with hardware or software prior to installation such as at its source or while in transit between source and destination?

A

Distribution Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What methodology is a component of intelligence driven defense for the identification and prevention of malicious intrusion activities by understanding the adversary’s tactics, techniques, and procedures beforehand?

A

The Cyber Kill Chain Methodology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which step of the Cyber Kill Chain Methodology involves gathering data on the target to probe for weak points?

A

Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which step of the Cyber Kill Chain Methodology involves creating a deliverable malicious payload using an exploit and a backdoor?

A

Weaponization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which step of the Cyber Kill Chain Methodology involves sending a weaponized bundle to the victim using email, USB, ect.?

A

Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which step of the Cyber Kill Chain Methodology involves exploiting a vulnerability by executing code on the victim’s system?

A

Exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which step of the Cyber Kill Chain Methodology involves installing malware on the target system?

A

Installation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which step of the Cyber Kill Chain Methodology involves creating a command and control channel to communicate and pass data back and forth?

A

Command and Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which step of the Cyber Kill Chain Methodology involves performing actions to achieve intended objectives/goals?

A

Actions on Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the guidelines that describe the way an attacker performs the attack from beginning to the end?
This includes initial exploitation, privilege escalation, and lateral movement.

A

Tactics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the technical methods used by an attacker to achieve intermediate results during the attack classified as?
This includes initial exploitation, setting up and maintaining command and control channels, accessing the target infrastructure, covering the tracks of data exfiltration, ect.?

A

Techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the term that describes the organizational approaches that threat actors follow to launch an attack?

A

Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What term describes the identification of the common methods or techniques followed by an adversary to launch attacks or penetrate an organization’s network?

A

Adversary Behavioral identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which Adversary Behavior points to and adversary already being inside of a target network?
Indicators include the enumeration of systems, hosts, and processes and the execution of various commands to extract information such as local user context, system config, hostname, IP, active remote systems, and processes running.

A

Internal Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which Adversary Behavior can be identified by checking windows event logs or PowerShell transcript logs?
Used by an adversary for automating data exfiltration and launching further attacks.

A

Use of PowerShell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which Adversary Behavior includes the creation and configuration of multiple domains pointing to the same host allowing an adversary to switch quickly between domains to avoid detection?

A

Unspecified Proxy Activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which Adversary Behavior includes interacting with the target system, browsing files, reading file contents, modifying file content, creating new accounts, connecting to the remote system, and downloading and installing malicious code?

A

Use of Command Line Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which Adversary Behavior includes modifying the contents of the HTTP user-agent field in order to communicate with the compromised system and execute attacks?

A

HTTP User Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which Adversary Behavior includes using servers to communicate remotely with compromised systems through an encrypted session in order to steal data, delete data, and launch further attacks?

A

Command and Control (C2) Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which Adversary Behavior includes obfuscating malicious traffic in legitimate traffic carried by common protocols used in the network?
Allows an adversary to communicate with the C2 server, bypass security controls, and perform data exfiltration.

A

DNS Tunneling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which Adversary Behavior includes manipulating a web server by creating a shell within a website to gain remote access to the server and perform various tasks such as data exfiltration, file transfers, and file uploads?

A

Use of Web Shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which Adversary Behavior is described as collecting or destroying sensitive data?

A

Data Staging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the term for clues, artifacts, and pieces of forensic data found on the network or OS of an organization that indicates potential intrusion or malicious activity?

A

Indicators of Compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which indicator of compromise category includes malicious data sent to a target organization or individual?

A

Email Indicator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which indicator of compromise category indicates use of a command and control (c2) server, malware delivery, adversary identification of target operating systems, ect.?

A

Network Indicator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which indicator of compromise category is found by performing an analysis of the infected system within the organizational network?

A

Host-Based Indicator

39
Q

Which indicator of compromise identifies specific behavior related to malicious activities?

A

Behavioral indicators

40
Q

What broad term refers to exploiting system vulnerabilities and compromising security controls to gain unauthorized or inappropriate access to a system’s resources?

A

Hacking

41
Q

What class of hacker uses their computing skills for illegal or malicious purposes (criminal activities)?

A

Black Hats

42
Q

What class of hacker uses their hacking skills for defensive purposes? Also known as Ethical Hackers/Penetration Testers.

A

White Hats

43
Q

What class of hacker works both offensively and defensively at various times? Sometimes good, sometimes bad.

A

Gray Hat

44
Q

What class of hacker hacks the government or corporations in order to increase awareness of their social or political agendas?

A

Hacktivist

45
Q

What class of hacker aims to bring down critical infrastructure for a “cause” and are not worried about facing jail terms or any other kind of punishment?

A

Suicide Hackers

46
Q

What class of hackers are unskilled and compromise systems by running scripts, tools, and software developed by real hackers?

A

Script Kiddies

47
Q

What class of hacker is motivated by religious or political beliefs and have a goal to create fear by large scale disruption of computer networks?

A

Cyber Terrorists

48
Q

What class of hacker is employed by the government to penetrate, gain top-secret information from, and damage the information systems of other governments?

A

State-Sponsored Hackers

49
Q

What are the 5 hacking phases in order from start to finish?

A
  1. Reconnaissance
  2. Scanning / Enumeration
  3. Gaining Access
  4. Maintaining Access
  5. Clearing tracks
50
Q

Which phase of the 5 hacking phases refers to the preparatory phase where an attacker seeks to gather information about a target prior to launching an attack?

A

Reconnaissance

51
Q

Which reconnaissance type involves acquiring information without directly interacting with the target?

A

Passive Reconnaissance

52
Q

Which reconnaissance type involves interacting with the target directly by any means?

A

Active Reconnaissance

53
Q

Which phase of the 5 hacking phases involves scanning the network for specific information on the basis of information gathered during the reconnaissance phase?

Includes the use of dialers, port scanners, network mappers, ping tools, and vulnerability scanners in order to extract information such as live machines, open/closed ports, OS details, device type, system uptime, ect.

A

Scanning

54
Q

Which phase of the 5 hacking phases includes obtaining access to the operating system or applications?
During this phase an attacker can escalate privileges if need be.
(Ex: password cracking, buffer overflows, denial of service, and session hijacking)

A

Gaining Access

55
Q

Which phase of the 5 hacking phases refers to when an attacker tries to retain their ownership of the system?
During this phase an attacker may prevent the system from being pwnd by other hackers by securing their access with backdoors, rootkits, or trojans.

A

Maintaining Access

56
Q

Which phase of the 5 hacking phases involves the hacker attempting to hide their malicious acts?

A

Clearing Tracks

57
Q

What is the term used for hacking in order to identify vulnerabilities, verify the existence of exploitable vulnerabilities, and perform security assessments of organizations with the permission of concerned authorities?

A

Ethical Hacking

58
Q

What type of hackers are employed either through contracts or direct employment and must abide by a contract that specifies the scope/what is off limits?

They must also sign an NDA and are only allowed to reveal vulnerabilities to the employer.

A

Ethical Hackers

59
Q

What is the greatest asset of an organization?

A

Information

60
Q

What term refers to the assurance that the integrity, availability, confidentiality, and authenticity of information is protected during usage, processing, storage, and transmission of information?

A

Information Assurance (IA)

61
Q

What concept is a security strategy in which several protection layers are placed throughout an information system in order to prevent direct attacks?

A

Defense In Depth

62
Q

What term refers to the degree of uncertainty or expectation that an adverse event may cause damage to the system?

A

Risk

63
Q

What is used to scale risk by considering the probability, likelihood, and consequence or impact of the risk?

A

A Risk Matrix

64
Q

What is the process of reducing and maintaining risk at an acceptable level by means of a well-defined and actively employed security program?

A

Risk Management

65
Q

Which risk management phase identifies the sources, causes, consequences, and other details of the internal and external risks affecting the security of an organization?

A

Risk identification

66
Q

Which risk management phase assesses the organization’s risk and provides an estimate of the likelihood and impact of the risk?

A

Risk Assessment

67
Q

Which risk management phase selects and implements appropriate controls for the identified risks?

A

Risk Treatment

68
Q

Which risk management phase ensures appropriate controls are implemented to handle known risks and calculates the chances of a new risk occurring?

A

Risk Tracking

69
Q

Which risk management phase evaluates the performance of the implemented risk management strategies?

A

Risk review

70
Q

What is defined as the collection and analysis of information about threats while drawing patterns that allow you to respond effectively to cyber threats?
This helps the organization identify and mitigate various business risks.

A

Cyber Threat Intelligence

71
Q

What type of threat intelligence is consumed by high level executives and management and is basically high level information on changing risks?

A

Strategic

72
Q

What type of threat intelligence provides information on attacker’s TTPs and is consumed by IT service managers, SOC managers, and administrators?

A

Tactical

73
Q

What type of threat intelligence provides information on a specific incoming attack and is consumed by security managers and network defenders?

A

Operational

74
Q

What type of threat intelligence provides information on specific indicators of compromise and is consumed by SOC staff and Incidence Recovery teams?

A

Technical

75
Q

What is a risk assessment approach for analyzing the security of an application by capturing, organizing, and analyzing all of the information that affects the security of an application?

A

Threat Modeling

76
Q

What Threat Modeling Step helps to determine how much effort needs to be put towards subsequent steps?

A
  1. Identify Security Objectives
77
Q

What Threat Modeling Step identifies the components, data flows, and trust boundaries?

A
  1. Application Overview
78
Q

What Threat Modeling Step helps to find more relevant and more detailed threats?

A
  1. Decompose the Application
79
Q

What Threat Modeling Step helps identify threats relevant to the control scenario and context using the information obtained in steps 2 and 3?

A
  1. Identify Threats
80
Q

What Threat Modeling Step identifies weaknesses related to the threats found using vulnerability categories?

A
  1. identify Vulnerabilities
81
Q

What is a set of predefined processes to identify, analyze, prioritize, and resolve security incidents in order to restore normal service operations asap?

A

Incident Management

82
Q

Placeholder for incident handling and response

A

no answer

83
Q

What two assets are now vastly used across various industries due to the increase in computing power, data collection, and storage capabilities?
These assets are unsupervised self-learning systems that are used to define what a normal network looks like and then backtrack and report any deviations or anomalies in real time.

A

Machine Learning and Artificial intelligence

84
Q

What machine learning classification makes use of algorithms that input a set of labeled training data with the aim of learning the differences between labels?

A

Supervised Learning

85
Q

What machine learning classification makes use of algorithms that input unlabeled training data with the aim of deducing categories by itself?

A

Unsupervised learning

86
Q

What is a proprietary information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, ATM, and POS cards?

A

PCI-DSS

87
Q

What law specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within an organization?

A

ISO/IEC 27001:2013

88
Q

What law provides federal protections for personal health information?

A

HIPAA

89
Q

What Act is designed to protect investors and the public by increasing the accuracy and reliability of corporate disclosures?

A

Sarbanes Oxley Act (SOX)

90
Q

What law is a US copyright law that defines legal prohibitions against circumvention of technological protection measures employed by copyright owners to protect their works?

A

The Digital Millennium Copyright Act (DMCA)

91
Q

What Act provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets?

A

Federal Information Security Management Act (FISMA)

92
Q

What regulation was put into effect in 2018 and is the most stringent privacy and security laws globally that is able to levy fines in the tens of millions of euros against violators?

A

General Data Protection Regulation (GDPR)

93
Q

What Act sets out the framework for data protection laws in the UK?

A

Data Protection Act 2018 (DPA 2018)