Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCNA Cyber Ops SECFND > *** Most important. Based on blueprint > Flashcards

*** Most important. Based on blueprint Flashcards

1
Q

CAPWAP

A

Encapsulates data between LWAP and WLC. Routable. Wireless IPS. Much more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ARP

A

Operates between L2 and L3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ARP Ethertype

A

0x0806

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

DNS Resolver

A

local client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

DNS Recursor

A

Internal DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Bridges vs. Switches

A

Bridges use SW bridging logic. Switches use HW bridging logic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cisco AMP

A

Advanced Malware Protection. Applies before, during, and after attack continuum. Examines SHA hash. Cloud tests files. Machine learning. Trajectory. Intel feeds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cisco WSA

A

Web Security Appliance. URL Filtering. Websense type features.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cisco CWS

A

Cloud Web Security. Basically, Websense in the cloud. Request goes from ASA to CWS where decision is made.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cisco ESA

A

Email Security Appliance. Incoming reputation filter, outgoing DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cisco CES

A

ESA in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Cisco Firepower

A

NGFW with VPN, IPS, AMP, DNS inspection, application visibility and control, reputation-based filtering, URL filtering, SSL decryption, and so on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Netflow

A

Collects/monitors network traffic flow data.
Audit trail.
Unidirectional series of packets bet. source and destination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does Netflow data contain?

A 
Metadata
5 Tuple
Interfaces
Duration of comms
Transmission rate
Amount of data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Netflow vs. IPS

A

Netflow looks at headers. IPS does deep packet analysis.

Netflow is information about comms. IPS can drop packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Runbook automation

A

Automated reactions. Can minimize time bet. discovery and remediation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Runbook parts

A

Tools, Workflows, Processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sliding Window

A

Relates to anomaly detection. Needs to be long enough to define normal traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Non-discretionary access control

A

Role Based AC. Job function related.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Network vs. Host AV

A

Network AV takes action on files that are traversing the network.

Host AV is run by endpoints.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Agent vs. Agentless

A

Netflow is agentless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SIEM Capabilities

A 
Monitoring
IR
Anomaly Detection
Real time rule based alerts
Correlation
Logging and reporting
Reports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

New Syslog name

A

rsyslog (old was syslogd)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Syslog config file location

A

/etc/syslog.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
27002:2013
provides guidelines for organizational information, security standards, and information security management practices,
26
Vulnerability management
identifying, classifying, remediating, and mitigating vulnerabilities in software, firmware, and hardware.
27
Configuration management
process for establishing and maintaining consistency of a product's performance, functional requirements, and design throughout the product's life cycle.
28
Digital signature creation
Hash the document Encrypt the hash with private key of signer Encrypted hash is appended to document
29
Digital signature verification
Recipient check public key of the signer Recipient decrypts the signature using he public key leaving the hash Recipient rehashes the document. Hash match means it's authentic.
30
CSR contains
System name, organization, location, enrolling systems public key info.
31
TACACS+ Hashing algorithm
MD5
32
MD5 vs. SHA-1
128 bit vs. 160 bit digest. | NIST recommends avoiding both
33
ECDHE_ECDSA
Authentication and Key Exchange
34
DSA
Assymetric. Digital Signature Algorithm. Creates digital sigs. (hashing)
35
PRF
Pseudorandom Function
36
Cipher Suite Contains...
``` Authentication Key Exchange Encryption Algorithm MAC (SHA) PRF ```
37
TLS 1.2
Defines mandatory cipher suites (RSA, AES, SHA)
38
TLS 1.2 Mandatory Cipher Squites
RSA, AES, SHA
39
PKCS
Public Key Crypto Standard.. Numbered standards for RSA, DH, PKI Syntax and more
40
Windows Process
Instance of an executing program
41
Windows thread
Basic unit that OS allocates processing time to. Can execute any part of the process code.
42
Windows object handle
Accesses resources (files, etc) on behalf of a process. Processes can't access resources directly. Must use handles.
43
Windows Memory allocated to which modes
Kernel mode and User mode
44
Transaction data
Log files for various services (HTTP, SMTP, Linux, etc.) Includes client action and system own action).
45
Session data
Metadata similar to NetFlow or phone bill. 5 tuple info, time stamps, etc. Summary of comms bet. 2 parties.
46
Extracted content
Mined from network traffic
47
Facility
application or process that submits the log message.
48
RFC 1918
Internal private addresses
49
NSA Suite B
``` RFC 6739 Crypto algorithms devices must support to meet federal standards. AES 128-256 (CTR-GCM) ECDSA, ECDH SHA256-384 ```
50
Linux PS command
Get information about processes
51
ps -f
Full output
52
ps -e
Everyone (all users)
53
ps -f
Full output for everyone
54
ps aux
ps -ef for BSD
55
ps -fC sshd
-C used to filter by process
56
Alert data
Generally produced by IPS/IDS
57
packets, bytes, and bandwidth =
NetFlow
58
Process# for forked process
0
59
AV vs. Anti-Malware
AV: Signature/heuristics/behavior based. Low efficacy AM: Anomaly, Big data, continuous analysis, advanced analytics
60
App visibility and control
Differentiating between parts of services (Allow IM, but not file transfer. Allow Facebook, but not facebook games)
61
NextGen FW Connection Event
Blocked connections based on rules. Time, hosts, protocols, amount of data
62
IPS/Intrusion Event
Based on IPS rule that triggers event. ``` Packet level info. Time 5 tuple Country Triggering rule ```
63
NGFW Host event
Host profile IOC's Category Event type
64
Network discovery events
Triggered by changes on the network
65
Netflow event
Used to detect data loss using Cisco Stealthwatch. Flows denied by access rule
66
NTP attacks
Amplification. Falsify time advertisement to throw off logs. Possible to auth time source (NTP Server)
67
Web proxy log
Precise logging of browsing sessions and can help investigate web based attacks.
68
Attack surface vs. Vulnerabilty
Surface is "total sum of all the vulnerabilities" Vulnerability is a defect in SW or HW.
69
Attack surfaces
Software, physical, network, human
70
SQL Injection
Can read, modify data, execute admin ops, and sometimes issue OS commands. Input validation.
71
Command injection attacks (2)
SQL injection. XSS Input validation and IPS
72
XSS
Injection of malicious scripts that run on client. Caused by weakness in client scripting languages
73
XSS Countermeasures
Input validation, DNS block, web proxy, IPS, Education
74
IPS Evasion methods
Traffic fragmentation Traffic substitution/insertion (Unicode characters) Encryption/Tunneling
75
Traffic fragmentation
IP Fragmentation. Fragment all IP traffic if IPS doesn't do fragment reassembly. TCP fragmentation:
76
TCP fragmentation
Fragment a TCP stream to overwrite/overlap previous TCP segment with new data. Hides attack
77
Traffic substitution
Substitute payload with other data that has the same meaning. Unicode, case sensitivity change, substitute spaces with tabs.
78
Evasion: Tunneling
Hide traffic over permitted protocol like DNS, HTTP. Or combine encryption & tunneling: HTTPS
79
Protocol-level misinterpretation
Change aspects of packets to confuse IPS sensor. TCP checksum Big/Little Endian
80
Hard links
Directories (not really links)
81
Malware (3)
Virus, Work, Trojan)
82
Remote vs. Local Exploit
Remote works over the network without prior access. Local exploit requires prior access (an account on the system). Lead to privilege escalation. (DOES NOT require physical access). Social engineering
83
AES CTR
Part of NSA Suite B, though GCM is more common Both are counter mode

CCNA Cyber Ops SECFND (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions