Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security > Security Operations > Flashcards

Security Operations Flashcards

1
Q

Security professionals often discuss two general conceptual classes of intrusion security mechanisms:

A

intrusion detection systems (IDSs) and intrusion prevention systems (IPSs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

intrusion prevention system (IPS) is a solution that

A

monitors the environment and automatically takes action when it recognizes malicious attempts to gain unauthorised access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

IDS/IPS solutions can be deployed as

A

Perimeter placement
Host-based
Network-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IDS/IPS can detect malicious activity in a number of ways

A

Deviation
Signature
Pattern matching
Heuristic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

SIEM

A

Security Information and Event Management (system)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISCM

A

Information Security Continuous Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

DLP

A

Data loss protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DLP tools function by

A

comparing data leaving the control of the organization against a rule set to determine whether that action is allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The DLP rule set can be defined by the following

A

Signature, Pattern Matching, Labelling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

UEBA

A

User and Entity Behaviour Analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Perhaps the most striking example of the limitations of monitoring tools was shown in the ____________ compromise, also known as the ____________ hack

A

Perhaps the most striking example of the limitations of monitoring tools was shown in the SolarWinds compromise, also known as the SUNBURST hack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data loss prevention (DLP) tools can serve many functions including the following except:
A. Compliance
B. Security
C. Asset management
D. Intrusion detection

A

The correct answer is D.

Intrusion detection is not one of the functions. DLP tools can serve many functions, but it depends on how they are deployed and what settings the organization applies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ITIL

A

Information Technology Infrastructure Library

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

One of the more widely adopted information technology change practices is defined in the Information Technology Infrastructure Library (ITIL) version 4, under the name of …

A

Change Enablement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The ITIL process distinguishes changes among three levels based on their urgency

A

Standard changes, which are relatively low-risk and follow established procedures,
Emergency changes are those which must be implemented immediately, and
Normal changes, which do not fall into either of the other two levels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Once the organization has identified its Configuration Items, the minimum set of security controls associated with that item are identified. This is the …

A

baseline (or, less ambiguously, the security baseline) for that particular CI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

During the initiation phase, Requests for Change (RFC) typically address all of the following except:
A. Identification of change requirements
B. Risk assessment
C. Documentation of the RFC
D. Evaluating the RFC for completeness

A

The correct answer is D.

Evaluating the RFC for completeness is part of the change review and approval process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the difference between an incident and an event

A

Events occur when a change in a systems state occurs. The event becomes an incident when there’s a possibility of harm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

NIST Special Publication 800-61, Computer Security Incident Handling Guide, structures incident response activities in a four-phase lifecycle:

A

Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ISO/IEC 27035 phases of incident management consist of

A

Planning and preparation
Detection and reporting
Assessment and decision
Response
Lessons learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

NIST SP 800-61 phases of incident management consist of:

A

Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Under the Gramm-Leach-Bliley Act (GLBA), how long do organizations have to report cyber related compromises of a customer’s personally identifiable information (PII)?

A

36 hours

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What ISO/IEC standard defines security incident management in five phases?

A

27035

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

List four standards that identify incident response as an essential control.

A

PCI DSS (Payment Card Industry Data Security Standard)
COBIT (Control Objectives for Information and Related Technologies)
SOC 2 (Trust Services Criteria) and the EU Network Information Security Directive 2016/1148

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the four primary steps necessary for a cyber-forensic investigation?

A

Collection
Examination
Analysis
Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the processes of SOAR?
A. Security orchestration, security automation, security response
B. Security, orchestration, automation, response
C. Security, orchestration, automation, recovery
D. Security, orchestration, authorization, response

A

A Security orchestration, security automation, security response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are honeypots

A

machines that exist on the network but do not contain sensitive or valuable data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Typically, honeypots are placed in the network …

A

demilitarized zone (DMZ)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What type of security is threatening the defence in depth model

A

Software defined security (SDS)

30
Q

What is the difference between a differential backup and an incremental backup

A

A differential backup backs up all files since the last full backup. An incremental backs up all files since the last incremental backup

31
Q

Hot site activation is typically measured in

A

minutes to hours

32
Q

Warm site activation tends to be measured in

A

in hours to days

33
Q

Cold backup site activation times are measured in

A

weeks if not months.

34
Q

RAID 0

A

Not actually a redundancy configuration, as the array has no parity bits. RAID 0 stripes data across two devices, optimizing the performance over a single device.

35
Q

RAID 1:

A

RAID 1: Another method that does not typically use parity bits (and RAID 1 does not even use striping); instead, the data is fully duplicated across two identical drives so that any part of the data set can be recovered if a single drive fails. This can be costly but also serves as a backup for the production data.

36
Q

RAID 2: 

A

A legacy technique not currently in wide use.

37
Q

RAID 3 and 4: 

A

Data is striped across multiple drives, and a distinct drive is used to store parity information. RAID 3 stripes data at the byte level; RAID 4 at the block level.

38
Q

These RAID configurations may not be optimum for organisations seeking high availability environments, as the parity drive in each represents a potential single point of failure.

A

Raid 3 and 4

39
Q

RAID 5

A

Both the data and the parity bits are striped across multiple disks; provides high availability.

40
Q

RAID 6:

A

 Uses data striping and two sets of parity bits striped across multiple disks; two drives can fail and the data can still be recovered.

41
Q

What is CPTED

A

By directing the flow of people, using passive techniques to signal who should and should not be in a space and providing visibility to otherwise hidden spaces, the likelihood decreases that someone will commit a crime in that area

42
Q

Status of the Uptime Institute 4 Tier model

A

Not in statute but widely adopted

43
Q

SCIF

A

sensitive compartmented information facilities

44
Q

Which type of water-based fire suppression system combines elements of wet and dry pipe actions?
A. Wet pipe
B. Dry pipe
C. Deluge
D. Pre-action

A

Pre-action
Fire sensors initiate pre-action charging of the water pipes that can then activate independently as in a wet pipe system. In other instances, the system may require both an independent fire sensor and one or more sprinklers to activate prior to water entering the system.

45
Q

True or False: Halon is an older type of water-type fire protection system and is mostly no longer in use.
True
False

A

Halon is an older type of gas-type fire protection system and is mostly no longer in use.

46
Q

BCDR

A

Business continuity and Disaster Recovery

47
Q

In the case of a disaster who is responsible for protecting the environment

A

Everyone

48
Q

In the case of disaster who Identifies evidence and potential sources of evidence:

A

The forensics team and the first responder

49
Q

What are the advantages of UEBA

A

UEBA provides information at the user level, and not just security information provided by more conventional solutions, such as firewalls. UEBA can provide information about deviations in normal user behavior based upon statistical analysis coupled with machine learning.
This is promising, because it means UEBA can assist in the detection of
insider threats,
compromised accounts,
brute-force attacks,
changes in permissions and creation of super-users
breaches of protected data.

50
Q

What tool or device collects security information from multiple, disparate sources for better security examination?
Question options:

A) SIM (Security Information Management)
B) SEM (Security Event Management)
C) SIEM (Security Information and Event Management)
D) They all can

A

The correct answer is D. Many network devices can collect log data
but these logs may well be in different formats and in different
locations. SIMs provide historical data whereas SEMs provide realtime data. Although there is no formal industry standard for SIEM, these devices combine the functionality of the SIMs and SEMs.

51
Q

Referred to as “Change Enablement,” the Information Technology Infrastructure Library (ITIL) version 4, is one of the more widely adopted practices used in change management. ITIL defines three levels based on urgency, but which of the following is not one of them?
Question options:

A) Standard
B) Emergency
C) Zero-Day
D) Normal

A

The change management process
encompasses all elements of change and is not restricted to software
alone. ITIL defines these levels as the following: Standard changes which are relatively low-risk and follow established procedures; emergency changes, which are those which must be implemented immediately; and normal changes, which do not fall into either of the other two levels. Zero-day vulnerabilities, typically software-related, might be an example of an emergency level but it is not one of ITIL’s classifications.

52
Q

Which of the following statements is true about digital evidence?
Question options:

A) Evidence is useless if the original version has been changed in any way.
B) Evidence can expire.
C) Electronic evidence is inadmissible.
D) Evidence should be believable.

A

The correct answer is D. Evidence is material used to support a
theory and argument concerning the events of an alleged crime.
It must be presented in a format that is understandable to the
intended audience (perhaps a jury) who must believe in the veracity
of said evidence. While crimes might have a lifespan (a statute of
limitations), evidence typically does not. Evidence that has been
changed may be admissible, if the changes have been documented
to a court’s satisfaction. Electronic evidence is admissible.

53
Q

Alternate Site

A

A general term for a contingency or continuity of operations (COOP) site used to assume system or organizational operations in the event that the primary site is not usable for a period of time

54
Q

Types of baselines

A

*Enumerated baselines, which are inventory lists generated by systems cataloging, discovery, and enumeration tools.
*Configuration baselines, which have a revision or version identifier associated with each CI.
*Build or deployment baselines, which are configuration baselines for instances of a system being built for a specific purpose (such as security assessment) or environment (such as production or delivery to end users).
*Modification, update, or patch baselines, which are subsets of a total system baseline. These would contain only those CIs which have been modified.
*Security baselines associate the minimum acceptable set of security controls for each CI within a configuration baseline.

55
Q

Creating a total inventory of a system, component by component, part by part.

A

Baselining

56
Q

The practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

A

Cyber Forensics

57
Q

Service provided to on-premises data centers to recover to/from the cloud.

A

Disaster Recovery as a Service (DRaaS)

58
Q

Monitoring the flow of information out of an organization’s control boundaries.

A

Egress monitoring

59
Q

Any form of user, such as a hardware device, software daemon, task, processing thread or human, which is attempting to use or access systems resources.

A

Entity

60
Q

In incident response, the activities which remove the cause of the incident from the environment. This often requires the use of a formal root cause analysis process.

A

Eradication

61
Q

Any observable occurrence in a network or system

A

Event

62
Q

Incorrectly classifying a benign activity, system state or configuration as malicious or vulnerable.

A

False Positive

63
Q

Actions taken by a victim of hacking to compromise the systems of the alleged attacker .

A

Hackback

64
Q

A method of machine learning, which identifies patterns of acceptable activity so that deviations from the patterns will be identified.

A

Heuristics

65
Q

A fully operational offsite data processing facility equipped with hardware and software, to be used in the event of an information system disruption.

A

Hot Site

66
Q

The mitigation of violations of security policies and recommended practices

A

Incident response

67
Q

A technical artifact or observable occurrence that suggests an attack is imminent or is currently underway, or that a compromise may have already occurred.

A

Indicator

68
Q

A signal that an intrusion, malware, or other predefined hostile or hazardous set of events is occurring or has occurred

A

Indicators of Compromise (IOC)

69
Q

Any entity or collaboration created or employed by public- or private-sector organizations, for purposes of gathering and analyzing critical cyber and related information in order to better understand security problems and interdependencies related to cyber systems, to ensure their availability, integrity, and reliability.

A

Information Sharing and Analysis Center (ISAC)

70
Q

A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system or system resource without having authorization to do so

A

Intrusion

71
Q

Use available information to determine if an attack is underway, send alerts, but also block the attack from reaching its intended target.

A

Intrusion Prevention Systems (IPS)

72
Q

Signals from events that suggest a possible change of conditions (internal or external to the organization) may alter the current threat landscape. An increase in tensions in the local political or social environment, or complaints or grievances by employees or customers going viral in social media, are examples

A

Precursor(s)

Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions