Module 4 Flashcards
Which privacy protection uses four colors to indicate the expected sharing limitations that are to be applied by recipients of the information?
PCII
TLP
CISA
FOIA
TLP uses four colors (red, amber, green, and white) to indicate the expected sharing limitations that applied by the recipients.
TCP-Traffic Light Protocal
What are the two concerns about using public information sharing centers?
Cost and availability
Regulatory approval and sharing
Privacy and speed
Security and privacy
Privacy and speed
Which of the following tries to detect and stop an attack?
HIPS
RDE
HIDS
SOMA
HIPS
A host intrusion prevention system (HIPS) monitors endpoint activity to immediately react to block a malicious attack by following specific rules. Activity that a HIPS watches for includes an event that attempts to control other programs, terminate programs, and install devices and drivers. When a HIPS blocks action it then alerts the user so an appropriate decision about what to do can be made.
Which boot security mode sends information on the boot process to a remote server?
UEFI Native Mode
Trusted Boot
Secure Boot
Measured Boot
Measured Boot
Computer’s firmware logs the boot process so OS can send it to a trusted server to assess the security for the highest degree of security in Measured Boot.
What does Windows 10 Tamper Protection do?
Creates a secure backup copy of the registry
Limits access to the registry
Prevents any updates to the registry until the user approves the update.
Compresses and locks the registry
Limits access to the registry
The Windows 10 Tamper Protection security feature prevents Windows security settings from being changed or disabled by a threat actor who modifies the registry. Instead, the security settings can only be accessed directly through the Windows 10 user interface or through enterprise management software.
Which of the following is part of the OS security configuration?
Giving all users administrator privileges
Enabling the most secure OS platform
Disabling default passwords and unnecessary ports
Installing the latest version of OS
Disabling default passwords and unnecessary ports are the primary steps for OS security configuration.
Which of the following is a disadvantage of the secure boot process?
It makes third party non-vendor-approved software difficult to implement.
It slows down considerably, affecting the performance of the computer.
It requires an operating system like Microsoft OS to ensure secure boot.
It does not validate the boot process.
It makes third party non-vendor-approved software difficult to implement.
In a secure boot process, nonsystem vendor-approved hardware or software would not be initialized by the boot sequence, thereby affecting the implementation of such third-party software or custom hardware.
While going through the network log, Sarah, a network security administrator, noticed substantial outbound network traffic. Which activity did Sarah perform?
Telnet
IOC
HTTP
STIX
Indicator of compromise (IOC) shows suspected malicious activity occurring on the network.
Which of the following can be used to mitigate a limitation of public sharing centers in OSINT?
AIS
KRI
HTTPS
TTP
Automated indicator sharing (AIS) can be used to exchange cybersecurity threats between computers through computer-to-computer communication. This mitigates the limitation on the speed of sharing information through public sharing centers in open source intelligence.
A company monitors the network activity of the organization and stores the logs in a database. You have been asked to identify whether there are any malicious activities in the network. Which of the following can denote the upper and lower bounds of their various network activities?
Threat maps
OSI model
TTP
KRI
A key risk indicator (KRI) is a matrix, stored in the logs, of upper and lower bounds of specific activity occurring across the network. This is a metric used to measure the probability of an event or threat in the network.
John is a project manager with an IT firm, and his current project of developing an ERP application is in the development stage. Currently, the application is not yet mature or stable enough to be placed in a test environment. Which of the following secure coding review techniques is applicable for his project?
Perform static code analysis
Perform dynamic code analysis
Perform a static binary code analysis
Perform a structured manual analysis of code
The static code analysis should be performed before the source code compliance is done.
Daniel accidentally installed a vulnerable application. Which of the following system exploitations would NOT be caused by the vulnerable application?
Executable files attack
Process spawning control
System tampering
Social engineering and phishing attacks
Social engineering and phishing attacks are prominently performed by the attacker without accessing the victim’s system.
BC Technologies had its computer network compromised through a cybersecurity breach. A cybersecurity expert was employed to analyze and identify what caused the attack and the damage caused by the attack. He checked an available database for this purpose and found the threat actor behind the attack. He also found out the cybercriminal has been attempting to sell the company’s valuable data on the internet.
Which are the most probable methods used by the cybersecurity expert to get to this stage of the investigation?
The cybersecurity expert checked with CISCP and also investigated the dark web.
The cybersecurity expert checked the threat maps and used the MAR report.
The cybersecurity expert checked the threat maps and used TAXII.
The cybersecurity expert used STIX and checked with CISCP.
The cybersecurity expert checked with CISCP and also investigated the dark web.
You have been assigned to decide the process used for software application development at your company. Since the products need to be developed and deployed as each module is completed, you chose to go with agile application development. Your manager has requested you consider SecDevOps.
Which of the following is a significant and key feature of using SecDevOps that can be considered for selecting this project’s development model?
Reuse of code
Quarantine
Rigid process
Automation
Automation is a key feature in SecDevOps.
A learning management system application has been written in Python. While running the application code, the specific program or application that converts the program into machine language is called what?
Operating system
Application software
Compiler
Antimalware
A compiler converts the high-level language code into binary, which is understood by the computer.
