Modules 13-17: Threats and Attacks Flashcards
What are two methods used by cybercriminals to mask dns attacks? (choose two.)
Domain generation algorithms
Reflection
Fast flux
Shadowing
Tunneling
- Domain generation algorithms
- Fast flux
Fast flux is a technique used to hide phishing and malware delivery sites behind a quickly-changing network of compromised DNS hosts (bots within botnets). The double IP flux technique rapidly changes the hostname to IP address mappings and the authoritative name server.
Domain generation algorithms randomly generate domain names to be used as rendezvous points.
Which network tool uses artificial intelligence to detect incidents and aid in incident analysis and response?
SIEM
Wireshark
NetFlow
SOAR
SOAR
SOAR works with SIEMs systems, where SIEM can detect a malicious activity and SOAR helps to respond to the threat. SOAR has many functions and benefits, including these abilities:
The use of predefined playbooks to enable automatic response to specific threats
The use of artificial intelligence to detect incidents and aid in incident analysis and response
A user is curious about how someone might know a computer has been infected with malware. What are two common malware behaviors? (choose two.)
The computer emits a hissing sound every time the pencil sharpener is used.
The computer beeps once during the boot process.
The computer gets increasingly slower to respond.
No sound emits when an audio cd is played.
The computer freezes and requires reboots.
- The computer gets increasingly slower to respond.
- The computer freezes and requires reboots.
Other symptoms:
- Appearance of files, applications, or desktop icons
- Security tools such as antivirus software or firewalls turned off or changed
- System crashes
- Emails spontaneously sent to others
- Modified or missing files
- Slow system or browser response
- Unfamiliar processes or services running
- Unknown tcp or udp ports open
- Connections made to unknown remote devices
Why would a rootkit be used by a hacker?
to try to guess a password
to reverse engineer binary files
to gain access to a device without being detected
to do reconnaissance
to gain access to a device without being detected
Which protocol is attacked when a cybercriminal provides an invalid gateway in order to create a man-in-the-middle attack?
ICMP
DNS
DHCP
HTTP or HTTPS
DHCP
A cybercriminal could set up a rogue DHCP server that provides one or more of the following:
Wrong default gateway that is used to create a man-in-the-middle attack and allow the attacker to intercept data
Wrong DNS server that results in the user being sent to a malicious website
Invalid default gateway IP address that results in a denial of service attack on the DHCP client
What is the result of a DHCP starvation attack?
Clients receive IP address assignments from a rogue DHCP server.
The IP addresses assigned to legitimate clients are hijacked.
The attacker provides incorrect DNS and default gateway information to clients.
Legitimate clients are unable to lease IP addresses.
Legitimate clients are unable to lease IP addresses.
A company has contracted with a network security firm to help identify the vulnerabilities of the corporate network. The firm sends a team to perform penetration tests to the company network. Why would the team use applications such as Nmap, SuperScan, and Angry IP Scanner?
to probe network devices, servers, and hosts for open TCP or UDP ports
to reverse engineer binary files when writing exploits and when analyzing malware
to detect installed tools within files and directories that provide threat actors remote access and control over a computer or network
to detect any evidence of a hack or malware in a computer or network
to probe network devices, servers, and hosts for open TCP or UDP ports
Which attack involves threat actors positioning themselves between a source and destination with the intent of transparently monitoring, capturing, and controlling the communication?
DoS attack
ICMP attack
SYN flood attack
man-in-the-middle attack
man-in-the-middle attack
What technique is a security attack that depletes the pool of IP addresses available for legitimate hosts?
reconnaissance attack
DHCP starvation
DHCP spoofing
DHCP snooping
DHCP starvation
To which category of security attacks does man-in-the-middle belong?
access
social engineering
reconnaissance
DoS
access
With a man-in-the-middle attack, a threat actor is positioned in between two legitimate entities in order to read, modify, or redirect the data that passes between the two parties.
How do cybercriminals make use of a malicious iFrame?
The attacker embeds malicious content in business appropriate files.
The iFrame allows multiple DNS subdomains to be used.
The attacker redirects traffic to an incorrect DNS server.
The iFrame allows the browser to load a web page from another source.
The iFrame allows the browser to load a web page from another source.
Which field in the IPv6 header points to optional network layer information that is carried in the IPv6 packet?
traffic class
version
flow label
next header
Next Header
Optional Layer 3 information about fragmentation, security, and mobility is carried inside of extension headers in an IPv6 packet. The next header field of the IPv6 header acts as a pointer to these optional extension headers if they are present.
Which field in the IPv4 header is used to prevent a packet from traversing a network endlessly?
Time-to-Live
Sequence Number
Differentiated Services
Acknowledgment Number
The value of the Time-to-Live (TTL) field in the IPv4 header is used to limit the lifetime of a packet.
The sending host sets the initial TTL value; which is decreased by one each time the packet is processed by a router.
If the TTL field decrements to zero, the router discards the packet and sends an Internet Control Message Protocol (ICMP) Time Exceeded message to the source IP address.
The Differentiated Services (DS) field is used to determine the priority of each packet.
Sequence Number and Acknowledgment Number are two fields in the TCP header.
What is the purpose of a reconnaissance attack on a computer network?
to prevent users from accessing network resources
to gather information about the target network and system
to steal data from the network servers
to redirect data traffic so that it can be monitored
to gather information about the target network and system
A user receives a phone call from a person who claims to represent IT services and then asks that user for confirmation of username and password for auditing purposes. Which security threat does this phone call represent?
social engineering
spam
anonymous keylogging
DDoS
social engineering
Which statement describes the term attack surface?
It is the network interface where attacks originate.
It is the total number of attacks toward an organization within a day.
It is the group of hosts that experiences the same attack.
It is the total sum of vulnerabilities in a system that is accessible to an attacker.
It is the total sum of vulnerabilities in a system that is accessible to an attacker.
Which action best describes a MAC address spoofing attack?
flooding the LAN with excessive traffic
bombarding a switch with
fake source MAC addresses
altering the MAC address of an attacking host to match that of a legitimate host
forcing the election of a rogue root bridge
altering the MAC address of an attacking host to match that of a legitimate host
Which type of network attack involves randomly opening many Telnet requests to a router and results in a valid network administrator not being able to access the device?
DNS poisoning
man-in-the-middle
SYN flooding
spoofing
SYN flooding
A threat actor uses a program to launch an attack by sending a flood of UDP packets to a server on the network.
The program sweeps through all of the known ports trying to find closed ports. It causes the server to reply with an ICMP port unreachable message and is similar to a DoS attack.
Which two programs could be used by the threat actor to launch the attack? (Choose two.)
WireShark
ping
Low Orbit Ion Cannon
UDP Unicorn
Smurf
- Low Orbit Ion Cannon
- UDP Unicorn
A threat actor can use a tool like UDP Unicorn or Low Orbit Ion Cannon to send a flood of UDP packets to launch a UDP flood attack that causes all the resources on a network to become consumed.
These types of programs will sweep through all the known ports trying to find closed ports. This causes the server to reply with an ICMP port unreachable message.
Because of the many closed ports on the server, there is so much traffic on the segment that almost all the bandwidth gets used. The end result is very similar to a DoS attack.
Which two types of hackers are typically classified as grey hat hackers? (Choose two.)
hacktivists
cyber criminals
vulnerability brokers
script kiddies
state-sponsored hackers
- Hacktivists
- Vulnerability brokers
Grey hat hackers may do unethical or illegal things, but not for personal gain or to cause damage.
Vulnerability brokers hack to uncover weaknesses and report them to vendors.
Which network monitoring capability is provided by using SPAN?
Real-time reporting and long-term analysis of security events are enabled.
Statistics on packets flowing through Cisco routers and multilayer switches can be captured.
Network analysts are able to access network device log files and to monitor network behavior.
Traffic exiting and entering a switch is copied to a network monitoring device.
Traffic exiting and entering a switch is copied to a network monitoring device.
When enabled on a switch, SPAN or port mirroring, copies frames that are sent and received by the switch and forwards them to another port, known as a Switch Port ANalyzer port, which has a analysis device attached.
What are the three major components of a worm attack? (choose three.)
A payload
A propagation mechanism
An infecting vulnerability
A probing mechanism
An enabling vulnerability
A penetration mechanism
A payload
A propagation mechanism
An enabling vulnerability
Match the security concept to the description.
A network administrator is checking the system logs and notices unusual connectivity tests to multiple well-known ports on a server. What kind of potential network attack could this indicate?
reconnaissance
access
denial of service
information theft
reconnaissance
Users in a company have complained about network performance. After investigation, the IT staff has determined that an attacker has used a specific technique that affects the TCP three-way handshake. What is the name of this type of network attack?
DNS poisoning
session hijacking
SYN flood
DDoS
SYN flood
The TCP SYN flood attack exploits the TCP three-way handshake. The threat actor continually sends TCP SYN session request packets with a randomly spoofed source IP address to an intended target.
Why would an attacker want to spoof a MAC address?
so that the attacker can capture traffic from multiple VLANs rather than from just the VLAN that is assigned to the port to which the attacker device is attached
so that a switch on the LAN will start forwarding frames to the attacker instead of to the legitimate host
so that a switch on the LAN will start forwarding all frames toward the device that is under control of the attacker (that can then capture the LAN traffic)
so that the attacker can launch another type of attack in order to gain access to the switch
so that a switch on the LAN will start forwarding frames to the attacker instead of to the legitimate host
Which type of security threat would be responsible if a spreadsheet add-on disables the local software firewall?
DoS
Trojan horse
buffer overflow
brute-force attack
Trojan horse
Which field in an IPv6 packet is used by the router to determine if a packet has expired and should be dropped?
TTL
No Route to Destination
Hop Limit
Address Unreachable
Hop Limit
What is a vulnerability that allows criminals to inject scripts into web pages viewed by users?
Cross-site scripting
XML injection
buffer overflow
SQL injection
Cross-site scripting
An attacker is redirecting traffic to a false default gateway in an attempt to intercept the data traffic of a switched network. What type of attack could achieve this?
MAC address snooping
DHCP spoofing
DHCP snooping
MAC address starvation
DHCP spoofing
What is the term used when a malicious party sends a fraudulent email disguised as being from a legitimate, trusted source?
backdoor
vishing
Trojan
phishing
phishing
What causes a buffer overflow?
sending too much information to two or more interfaces of the same device, thereby causing dropped packets
attempting to write more data to a memory location than that location can hold
sending repeated connections such as Telnet to a particular device, thus denying other data sources
downloading and installing too many software updates at one time
launching a security countermeasure to mitigate a Trojan horse
attempting to write more data to a memory location than that location can hold
What would be the target of an SQL injection attack?
DHCP
DNS
database
database
The IT department is reporting that a company web server is receiving an abnormally high number of web page requests from different locations simultaneously. Which type of security attack is occurring?
social engineering
adware
phishing
spyware
DDoS
DDoS
Which statement describes an operational characteristic of NetFlow?
NetFlow can provide services for user access control.
NetFlow captures the entire contents of a packet.
NetFlow flow records can be viewed by the tcpdump tool.
NetFlow collects basic information about the packet flow, not the flow data itself.
NetFlow collects basic information about the packet flow, not the flow data itself.
Which term is used for bulk advertising emails flooded to as many end users as possible?
spam
adware
brute force
phishing
spam
Match the security tool with the description. (Not all options apply.)
