Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Review NSVT > Part 6 > Flashcards

Part 6 Flashcards

1
Q

What is the service that allows hardware and software access and information transfer between different security domains or levels of classification either manually or automatically?

A

Cross Domain Services / Multi-Layer System

CDS/MLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What eliminates the need for multiple workstations to access different enclaves?

A

Secure Office Trusted Thin Client (SOTTC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is used to restrict the data flow from applications and users to the management resources in each enclave?

A

Virtual Routing and Forwarding (VRF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

On CANES, encryption methods for laptops with SECNET 54 devices attached utilizing SECRET wireless need what compartment?

A

HAIPE-compliant devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many wireless access points do platforms hosting CANES with CISCO Aironet 1242 AG have?

A

30

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 accounts of HBSS?

A

Sqlsrvusr: used for local log on for the SQL service
Sqlsrvagt: used for local log on for the SQL Server Agent service
Eposql: this account is built into SQL Server Management, and is the account that ePO uses to “talk” to the MSSQL database
Proxy.epo: this AD account is used for Master Repository replication and other off-ship communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which account does ePO use to talk to SQL?

A

Eposql

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which account does HBSS use for off ship communication?

A

Proxy.epo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the CANES implementation, rogue sensors must be installed on which following servers?

A

BU01, BU02, MTS, VC01, WEB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which server should NOT have a rogue sensor as it is a DHCP server and has conflicts with the Threat Management Gateway (TMG)?

A

IAEXET

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the name of the agent that handles audit records?

A

NetIQ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which appliance controls access to the CANES network?

A

Identity Service Engine (ISE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What applies local security at the end of its software installation and provides an automated way to apply the local security portion by itself?

A

Security Configuration Module (SCM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What term signifies that the system is secured to the highest degree possible, while still allowing for the operational environment in which the systems must function?

A

Hardening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Where is Symantec Endpoint Security Manager installed?

A

Ex01

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Symantic Mail Security for Microsoft Exchange (SMSME) scans email messages that pass through the exchange server and protects the exchange server from what?

A

Threats (virus, worms, Trojan horses, DOS
Security risks (adware, spyware)
Unwanted content
Unsolicited email (spam)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What kind of server is the Threat Management Gateway (TMG)?

A

Member server not a domain server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What can you set to limit internal users access to the internet?

A

River City

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a predefined access rule that protects networks by blocking all traffic that is not explicitly allowed by other, user defined l, access rules and is always processed last?

A

Default Deny Rule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What products is installed and configured manually and if the product has a broad scope or is a client application, then Microsoft SCCM is used to deploy the product and the configuration is automated?

A

Operating Environment applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CANES architecture has how many SADRs?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What has state-of-the-art antivirus software, was built to secure virtual infrastructure, anti-spyware, firewall and intrusion prevention?

A

Symantic Endpoint Manager (SEM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

If you have an inspection and some portion of a POR system failed or needs correction what do you do?

A

Contact the POR for changes to the configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a trading security concern for routers and switches?

A

An attacker could console in and reconfigure the router or switch or control the routing and switching.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are concerns in traditional security?

A 
Access control
Storage media 
Password storage
Physical security
Emergency procedures 
Personal electronic devices 
Wireless devices 
Classified material handling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which CE verifies CND?

A

CE-06

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which CE demonstrates cyber ops casualty and incident response procedures?

A

CE-11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How many stages are there in a CCRI?

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the stages of a CCRI?

A

Admin review
TAV
Inspection CSI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a stage 2 ccri looking at?

A

5 IA facets as well as the stage 1 findings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How long is the stage 3?

A

5 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does the McAfee Whitelisting of Rogues check portion of the inspection look at?

A

List of exceptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the two HIP categories?

A

HIP firewall policy is enabled

Firewall Connection Aware Group / Location Aware Group (FCAG/LAG) prevents cross Domain violations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What systems need a waiver?

A

Systems that are not or cannot be configured to have HBSS installed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What were two significant attacks to DOD networks?

A

Operation Rolling Tide, Task Force Cyber Awakening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are actions that are conducted to address System or network security incidents, restore systems to their operation states, and correct any technical or administrative flaws to prevent future attacks?

A

Computer Incident Response

37
Q

What is the terminology for when operations or actions that disrupt, deny, degrade or destroy information within a computer network, or the system or network itself?

A

Computer network attack

38
Q

What is an unauthorized access to an information system?

A

Intrusion

39
Q

What occurs when information from a higher classification/restriction is placed on machines or networks of lower classification/restriction either intentionally or inadvertently?

A

Electronic spillage

40
Q

What Delivery Vector category is when a user with authorized access took specific actions that resulted in jeopardizing ISs or data?

A

Category 2 - Authorized user

41
Q

What Delivery Vector category is when a compromise resulted from the inadequate or improper configuration of an IS?

A

Category 4 - configuration management

42
Q

What category of Delivery Vector is when a compromise resulting from the implicit or explicit trust relationship between security domains?

A

Category 6 - ACAS Transitive Trust

43
Q

What event incident category is unauthorized privileged access (administrative or root access to a DOD system?

A

Category 1 - Root level intrusion (incident)

44
Q

What event incident category is when unauthorized non privilage access (user level permissions) to a DOD system. Automated tools, targeted exploits, or self-propagating malicious logic may also attain these privileges?

A

Category 2 - User Level Intrusion (Incident)

45
Q

What event incident category is when there has been an attempt to gain unauthorized access to the system, which is defeated by normal defensive mechanisms. Attempt fails to gain access to the system(e.g. attack attempted valid or potentially valid username and password combinations) and the activity cannot be characterized as exploratory scanning. Can include reporting of quarantined malicious code.

A

Category 3 - unsuccessful activity attempted (event)

46
Q

What event incident category is an activity that impairs, impedes, or halts normal functionality of a system or network?

A

Category 4 - Denial of Service (Incident)

47
Q

What event incident category is used for activity that due to DOD actions (either configuration or usage) makes DOD systems potentially vulnerable (e.g., missing security patches, connections across security domains, installation of vulnerable applications, etc.) In all cases, this category is not used if an actual compromise has occurred. Information that fits this category is the result of non-compliant or improper configuration changes or handling by unauthorized users.

A

Category 5 - Non-Compliance Activity (Event)

48
Q

What event incident category is for events that are initially suspected as being malicious but after investigation are determined not to fit the criteria for any of the other categories (e.g., system malfunction or false positives)?

A

Category 9 - explained anomaly (Event)

49
Q

How do you determine if there has been an incident or event?

A

Signs of an occurrence are identified by comparing abnormal activity to established baselines and thresholds of known good system performance and operation.

50
Q

What port is FTP?

A

21

51
Q

What port is SSH?

A

22

52
Q

What port is Telnet?

A

23

53
Q

What port is DNS?

A

53

54
Q

What port is RPC?

A

135

55
Q

What are the procedures to identify, isolate, mitigate, resolve, recover, and repair systems in response to a cyber event?

A

Incident response

56
Q

What phase of incident response involves the establishment and training an incident response team, as well as acquiring acquiring necessary tools/resources to perform the response?

A

Preparation

57
Q

What incident response phase assists the management of an incident and prevention of further attacks?

A

Detection and analysis

58
Q

What phase of incident response assists the management of the incident and prevention of future attacks?

A

Containment

59
Q

What incident categories must be sanitized and rebuilt from trusted media?

A

1, 2, 7

60
Q

Which incidents potentially necessitate a gateway block?

A

1, 2, 3, 4, 6, 7

61
Q

What two block lists are provided by NCDOC?

A

Ip block list

DNS Black hole

62
Q

What are are three tiers of CND?

A

Global
Regional (NCDOC which is the CSSP)
Local

63
Q

Who is the principal advisor to the CO?

A

CSM

64
Q

Who shall ensure that the ES is contained and cleaned from affected systems in accordance with guidance provided by the CO, CSM, and the OCA?

A

ISSM

65
Q

What form do you fill out for spillage?

A

Electronic Spillage Action Form

66
Q

Who tracks ESAF?

A

Navy Net War Com

Submit to the ESC

67
Q

What two programs does NCDOC use for collection and preservation of volatile data?

A

Dumpit

Helix Pro

68
Q

What is important to remember concerning volatile data?

A

Do not turn it off

69
Q

What system state command is used for user accounts?

A

Net user

70
Q

What system state command is for ARP table

A

ARP -a

71
Q

What system state command is used for network interfaces?

A

Ipconfig /all

72
Q

What system state command is used for network connections?

A

Netstat -abn

73
Q

What system state command shows running tasks?

A

Task list

74
Q

Where can you find files belonging or related to applications such as executables, configuration files, log scripts, scripts, graphics and icons?

A

Application files

75
Q

Where can you find files used to extend the amount of memory available by allowing programs to swap pages of data in and out of RAM?

A

Swap files

76
Q

Where can you find files created to preserve the state of a system such as the memory contents and open files that are used to restore a system when it has been turned back on?

A

Hibernation files

77
Q

Where can you find files that have been deleted

A

Deleted files

78
Q

What should you do when you have collected data?

A

Make a copy
Master copy
Working copy

79
Q

What two tools of HBSS have the ability to monitor files?

A

ABM & FIM

80
Q

What is the process of identifying, analyzing, and characterizing information gathered from affected systems?

A

Malware analysis

81
Q

Where should you perform malware analysis?

A

Isolated environment

82
Q

What are two places you can perform malware analysis?

A

Isolated dedicated computer or a virtual machine

83
Q

What are abnormal combinations of seemingly uninteresting events that could be one of the first precursors to an attack?

A

Unrecognized connection to the web server
Unrecognized configuration change
Unrecognized user creation or privilage elevation

84
Q

When will you determine the training needs to prevent future attacks?

A

Post incident analysis

85
Q

What is the process of collecting messages from different systems and finding all messages that belong to one single event?

A

Correlation analysis

86
Q

What is the most important feature for correlation analysis?

A

Time stamps

Clock settings

87
Q

What are two sources for information on attacks?

A

CVE, USCYBERCOM

88
Q

Who provides logs to NCDOC?

A

Shipboard personnel

Review NSVT (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions