Security Assessment Flashcards

Question

What are file infection viruses

Answer 1

Viruses thay corrupts and attaches to executable files

Answer 2

Propogate via network protocol

Answer 3

Some malware is encrypted | Disguised as legitimate programs to prevent detection

Answer 4

Changes characteristics on every infection using complicated algorithms

Answer 5

Lay dormant and activated on defined date

Answer 6

Lay dormant and active on defined conditions

Answer 7

-unexplained size increases -significant unexplained memory loss -unusual error messages - unexpected reboots **usually discovered when damage is done Often difficlt to find when system is running

Answer 8

- scans data for signature of known malware - checks integrity of files againstbknown good hash - monitors unexpected file changes - recieves regular updates to logic and malware signature - reports valid malware instances - quarentines to remove suspected or known malware

Answer 9

- breaches may occur due to poor network desgin - Controll access points at every point where the trusted network connects to the public - monitor and filter traffic on the lan to external connecting - hide/mask internal hosts from external networks

Answer 10

Technique used during posture assessment

Answer 11

Scans large networks | Provides info about ports/ services running on network

Answer 12

Performs more sophisticated scans than namp -can check for default passwords

Answer 13

- The time, day, and duration - Source address Unsuccessful log in attempts (lockout)

Answer 14

Controls type and level of access granted to a device when it joins a network - need predefined access policy - non complaint devicr may be placef in quarantine until complaint

Answer 15

Routers may filter traffic bewteen netwprl Rules define permitted and denied traffic Generally based on layer 3 and 4 rules Eg wlan cant access internal network

Answer 16

Filter traffic Generaly more sophisticated than traffic access control - rules define permitted and denied rrafgic Generally based on layer 3-7 rules -used b/w public and dmz And bma and intertior trusted networks Often used between endpoint and server networks

Answer 17

Acts as an intermediary b/w ecternal amd internal network | -screens out all outgoing and incoming traffic

Answer 18

Network gost ru ning Application layer security Appears on interal server to outside traffic

Answer 19

Detects suspicious network activity | Typically dedicated service

Answer 20

Detects and reacts to suspicious network activity Typically dedicated device Prevents traffic flow

Answer 21

Software that gathers analyzes amd reports on the data from network device logs - routers, switches, ids, ips, os, databases can provide alerts - can be used for compliance and audit monitoring and reporting - May provide forensic analysis

Answer 22

Purposly vulnerable decoy designed to fool hackers and gaim info about their behaviours

Answer 23

A network of honey pots

Answer 24

Network segment that isnt public or local

Answer 25

Proxies act on behalf of whole network to separate packets from internal hosts and external hosts Proxy server- first recieves request, examines, breaks down and creates new packet to send to external server

Answer 26

Hides ip addressed of all devices on the internal network by exchanging its ip addr for the address of any requesting station

Answer 27

Handles http rquests on behalf 9f the sending work station Browser gets request and sends it to proxy server, Proxy changes the from address to its own network addresss and sends it to the internet web server

Answer 28

Deny any source address from your internal network Deny any local host addresses (127.0.0.0/8) Deny any reserved private addresses (RFC1918) Deny any addresses in the ip multicast address range (224.0.0.0/4)

Answer 29

At the end of every access list os an implicit deny -meaning if a packet doesnt match any lines in an access list it will be discarded Also if nothing but deny statements, the list will not permiy any packets