Section 4.4 Applying mitigation techniques or controls

Question 1

Where are the approved applications listed? If an application is not listed, it cannot be launched.

Answer 1

Approved Application list

Question 2

What is the list of applications deemed dangerous, such as certain offensive security tools? If the application is on this list then it can not be run.

Answer 2

Application Block List/Deny List

Question 3

What is it called when a device has been infected with a virus and removed from the network?

Answer 3

Quarantining

Question 4

With _____________, a user is authenticated and the device is checked to confirm it is patched and compliant before being granted access.

Answer 4

Network Access Control (NAC)

Question 5

What can be used to block traffic and we can use either an MDM solution or group policy to change the configuration on endpoint devices?

Answer 5

Firewall Rules

Question 6

What can be used to push configuration changes to mobile devices? Can enforce device settings from password policy to blocking cameras.

Answer 6

Mobile Device Management (MDM)

Question 7

What do you call policy-based protection of sensitive data, usually based on labels or patter matching? Protects data at rest or in transit, in email, Intranet, cloud drives, etc…

Answer 7

Data Loss Prevention (DLP)

Question 8

Changes in attacks might require___________ on either a proxy server or a UTM firewall?

Answer 8

an update to the content filters

Question 9

Endpoints reporting a host or trust error may indicate what kind of problem?

Answer 9

A certificate problem

Question 10

A certificate problem may require what?

Answer 10

updating a certificate that has expired or revoke a certificate because it has been compromised.

Question 11

Internet-facing services need a certificate issued by who?

Answer 11

A commercial Certificate Authority

Question 12

__________ means blocking access altogether.

Answer 12

Isolation

Question 13

_____________ endpoints are used to view classified data to isolate the endpoint from the network to protect against a network-based attack.

Answer 13

Air gapped

Question 14

__________ eliminates all network connectivity (wired, Wi-Fi)

Answer 14

Air gap

Question 15

The only way to add or extract data from an air gapped computer is by using?

Answer 15

A removable device

Question 16

Users entering an area for confidential meetings or to view secret research must place their phones in a what? It blocks electromagnetic signals from entering or exiting, rendering cellular signals useless.

Answer 16

Faraday Cage

Question 17

___________ is about minimizing damage and limiting the scope of an incident.

Answer 17

Containment

Question 18

If an endpoint has been compromised and may be infected by a virus, IT security will do what to stop the malware from spreading?

Answer 18

Contain it

Question 19

Containing the incident comes __________ finding the root cause and full remediation.

Answer 19

before

Question 20

In a BYOD mobile device scenario, ____________ will keep personal and business data separate? Prevents personal data from being removed in remote wipe.

Answer 20

Mobile Application Management (MAM)

Question 21

Within a private subnet, ___________ can be used to carry out segmentation and traffic filtering for sensitive applications and data? These rules could be enforced with subnets and firewalls.

Answer 21

VLAN’s

Question 22

What kind of system collects data from many other sources within the network? Provides real-time monitoring, traffic analysis, and notification of potential attacks.

Answer 22

Security Information and Event Management (SIEM)

Question 23

What kind of system provides centralized alert and response automation with threat-specific playbooks? Response may be fully automated or single-click.

Answer 23

Security Orchestration, Automation, and Response (SOAR)

Question 24

What do you call documents with information on events and the necessary actions to stop threats? Can be used to configure automated response in a playbook and documents the human analyst response steps.

Answer 24

Runbooks

Question 25

What contains a set of rules and actions to identify incidents and take preventative action? May need to be amended for better automated response as threats evolve. (This is the response automation)

Answer 25

Playbooks