MSBs Flashcards

1
Q

What is the key input to the secure stage of a secure mission?

A

Risk Mitigation Plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

This provides the final report to capture all of the lessons learned from the survey and secure stages of a secure mission.

A

Summary Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Serves to complete COA selection and deploy approved risk mitigation’s as outlined in the RMP.

A

COA Implementation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Provides the final evaluation of deployed risk mitigation’s

A

Risk mitigation validation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Focused on conducting the training necessary to educate Local Cyber Defenders on the technical and procedural mitigation’s employed.

A

Education and Training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 supporting objectives executed during a secure mission?

A

Education and Training
Course of action implementation
Risk mitigation validation
Summary reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the key outputs of the Secure Mission?

A

Mission Defense Plan

Summary Report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This outlines the residual risks after implementation.

A

Mission Defense Plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This is the final product of the secure stage which captures all of the lessons learned.

A

Summary Report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Any piece of information that objectively describes an intrusion.

A

Indicator of Compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Three types of Indicators of Compromise

A

Atomic, Computed, Behavioral

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ip, addresses and email addresses

A

Atomic IOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A method an adversary uses to get to a target.

A

Threat Vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

3 phases of a network attack.

A

Access, persistence, control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Utilizing any number of tricks to hide nefarious means.

A

Malicious software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

One day exploits or improperly configured server software.

A

Unpatched software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Adversary gains legitimate credentials of an account users access to a system.

A

Stolen Credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Psychological manipulation of people into performing actions of divulging confidential information.

A

Social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in an electronic communication (email)

A

Phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Adversary exploits a website known to be visited by its target

A

Watering hole

21
Q

Two different entities that trust each other

A

Trust relationship

22
Q

Attacker uploads nefarious code.

A

SQL injection

23
Q

Scripts executed within the users browser under the security context of the site they are visiting

A

Cross-Site Scripting (XSS)

24
Q

What are the four vertices of the diamond mode of intrusion analysis?

A

Adversary, victim, capability, infrastructure

25
Q

Enables analysis to detect and mitigate intrusions.

A

Cyber kill chain

26
Q

What are the seven phases of the cyber kill chain?

A
Reconnaissance 
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives
27
Q

Captures network traffic from a mission partner, generate logs and stores Pcap data

A

DIP Sensor

28
Q

Passive open source traffic analyzer that performs live analysis of network events and creates log files . Conn, HTTP,DNS,FTP, Weird

A

Bro(Zeek)

29
Q

A real time network intrusion detection system (NIDS)

Parses network traffic against a set of user-defined signatures

A

Suricata

30
Q

An application that monitors and captures network traffic on an interface
Uses internal elastic search for indexing separate from the ELK stack on the collector

A

Atkins (Moloch) Capture

31
Q

This tool parses and normalizes data

A

Logstash

32
Q

Indexes logs , also known as heart of ELK Stack

A

Elastic search

33
Q

Visualization plugin for elastic search and dashboard tool, performs queries on indexed data

A

Kibana

34
Q

Monitor and detect suspicious activities on hosts
Agent based
Aggregate event data

A

Endgame

35
Q

Tool to view/search pcap data

A

Arkime (Moloch) viewer

36
Q

Open source firewall /router
Used for IPSec tunneling
Segregates the dip systems from mission partner network

A

pfsense

37
Q

Separate infrastructure from the mission partner network

Allows management through uncontested network

A

Out of Band

38
Q

Relays management across a possible contested network

A

In-band

39
Q

A text document that contains all the commands required to build an image

A

Dockerfile

40
Q

A read-only template with instructions for creating a docket container

A

Image

41
Q

A running instance of an image

A

Container

42
Q

A mapping of container data to docker file system data

A

Volume

43
Q

Containers can talk to each other, but they are isolated from the host

A

Bridge

44
Q

Containers are not isolated and may use the hosts network directly

A

Host

45
Q

Files are lost when the container turns on

A

Docker non persistence

46
Q

Store the data where docker chooses

A

Volume

47
Q

Stores the data in a specific spot

A

Bind-mount

48
Q

Tool for managing multiple containers from one configuration file

A

Docker compose