Security Flashcards by ToK G

Prereq for AppSec

Supported version of Dynatrace (1.239+)
Deep monitoring enabled

How well did you know this?

Not at all

Perfectly

3 Modules of AppSec

RVA Runtime Vulnerability Analytics
RAP Runtime Application Protection
SPM Security Posture Management

How well did you know this?

Not at all

Perfectly

2 submodules of RVA

Code-level vulnerability detection
Third-party vulnerability detection

How well did you know this?

Not at all

Perfectly

Dependency between RAP and RVA

If RAP is enabled, RVA is also automatically enabled

How well did you know this?

Not at all

Perfectly

How is consumption tracked for RVA and RAP if you use DPS?

GiB-hour cosumned by hosts with the feature enabled

How well did you know this?

Not at all

Perfectly

How is consumption tracked for classic licensing model?

Application Security Units

How well did you know this?

Not at all

Perfectly

How are ASUs defined?

RAM in GB / 16 x number of activated features (RVA/RAP) x 24 x 365

How well did you know this?

Not at all

Perfectly

Why does RAP need RVA?

Because RAP uses RVA to analyse the vulnerability that the attack is based on

How well did you know this?

Not at all

Perfectly

3 locations to check consumption for RVA and RAP if you use DPS?

Account management
Data explorer
Environment API

How well did you know this?

Not at all

Perfectly

How is KSPM licensed?

Host hours

How well did you know this?

Not at all

Perfectly

2 types of SPM?

VSPM
CSPM

How well did you know this?

Not at all

Perfectly

How is VSPM licensed?

CPU sockets per year

How well did you know this?

Not at all

Perfectly

How is CSPM licensed?

host per year

How well did you know this?

Not at all

Perfectly

A host in the CSPM context applies to what kind of resources?

compute, database, and function

How well did you know this?

Not at all

Perfectly

What are users of the Security admin group allowed to do?

View and manage vulnerabilities if RVA is enabled and attacks if RAP is enabled

How well did you know this?

Not at all

Perfectly

How can i fine tune permissions for users?

Assign view rights per environment or management zone

How well did you know this?

Not at all

Perfectly

Which modules are affected if full stack monitoring is not used and why?

Code vulnerability and third party vulnerability because not sufficient environmental information, such as reachable data assets or public internet exposure

How well did you know this?

Not at all

Perfectly

To detect third-party vulnerabilities in your environment what components are evaluated?

Software components
Runtime components

How well did you know this?

Not at all

Perfectly

What attributes of the component or library are checked by application security?

Name and version

How well did you know this?

Not at all

Perfectly

What providers are used for Third-party vulnerabilitie feed and how often are they checked?

Snyk and NVD (National Vulnerability Database)
Once every 5 min

How well did you know this?

Not at all

Perfectly

For what kind of components is Snyk used for?

Software components (libraries)
Kube runtime components

How well did you know this?

Not at all

Perfectly

For what kind of components is NVD used for?

Java runtime components
.NET runtime components
Node.JS runtime components

What is the resolution time for a Third-party vulnerabilitie?

What could cause the resoultion of a Third-party vulnerabilitie? (5)

Affected process was stopped
Vulnerable component was updated or removed
App is not using the vulnerable component
After a restart there is no traffic to the app so the component doesnt load
Vulnerability has been fixed in the code

What is the severity of a code level vulnerability?

Critical

Resolution reasons for code level vulnerabilities? (4)

Has been fixed in the code Has been fixed outside the app Affected process doesnt receive any traffic Affected process was stopped

How can you enable RVA on a more granular level?

enable/disable per supported technology

Overriding monitoring rules for third party vulnerabilities can be defined for which entity properties?

Host tag Process tag Management zone

From where and how can you enable RVA?

Enable RVA Application Security > Vulnerability Analytics > General settings. Enable technology Enable OneAgent feature flag code-level vulnerability evaluation

What does the name of a vulnerability contain?

Dynatace ID Then depends on feed: Snyk: Snyk ID CVE:vulnerability id CWE: vulnerability name

What are the 4 Risk assessment properties of a vulnerability?

Public internet exposure Reachable data assets Vulnerable function in use Public exploit published

4 statuses of a vulnerability

Open Resolved Muted Open Muted Resolved

7 reasons for a status change of a vulnerability

Opend or resolved Muted or unmuted The number of affected process groups has decreased or increased The risk assessment has changed The Davis Security Score has changed The CVSS has changed A new software component is detected

What are the 4 metrics based on which the DSS is calculated?

CVSS Score Attack vector Confidentiality Integrity

Why is DSS more precise than CVSS?

CVSS assumes worst case scenario while DSS analyses the context as well based on public internet exposure and reachable data assets

6 types of entities that can be related to a vulnerability

App Service Database Host Kube cluster Kube workload

What views is a MZ filter affecting on the vulnerability details page?

Related entities Vulnerable components

How many MZ can be associated with a vulnerability at max?

1000

What are the 4 attributes of a recommendation from the security advisor?

Library that needs to be upgraded Library tech logo number of highest critical vulnerabilities solved total vulnerabilities solved

What happens to existing vulnerabilities if you define a "do not monitor" rule that targets them?

They get "Resolved"

4 code vulnerabilities that Dynatrace detects and their context?

SQL Injection - SQL statement Command injection - command SSRF - request URL Improper input validation - JNDI lookup name

When is an attack path shown?

When RVA is activated When there are fewer than 500 attacks on a vulnerability

What does the attack path contain?

Source IP Entry point Vulnerability Target

What are the 3 notification integrations for vulnerabilities?

Webhook Jira Email

When is a notification triggered?

Open resolved New process group affected

What are the 6 properties of attacks that can be used when you define an allow rule?

Attacker IP Attack type Entry point payload Entry point domain Entry point port Entry point path

What are the standards supported for SPM?

CIS DORA NIST STIG

What is the component used to capture compliance data for SPM?

Kube Node config collector

How can i fix vulnerabilities in DT? (2)

Set up tracking links Update version according to davis security advisor

Are restarts required for 3rd party vulnerabilities? If so, when?

Are restarts required for code level vulnerabilities? If so, when?

Yes. Enable Global Enable per tech Enable OA feature New monitoring rule

Are restarts required for attacks? If so, when?

Yes. Enable Global Enable per tech Enable OA feature New monitoring rule

How long are vulnerabilities stored?

365 days if resolved within a year Next anniversary after resolution if resolved after a year

How long are attacks stored?

550 days