Security+ Practice Tests 1-5 Flashcards
1
Q
Registering a misspelled domain name in the hopes of getting traffic from unsuspecting users who type the URL in wrong.
A
URL hijacking
AKA typosquatting
2
Q
Attaching a piece of data to the beginning of another
A
Prepending
3
Q
A form of cyberattack that targets a group of users by infecting websites that they commonly visit.
A
Watering hole attack
4
Q
What is the platform for watering hole attacks?
A
Websites
5
Q
Where does a fileless virus reside?
A
RAM
6
Q
What is the function of a C2 server?
A
Botnet control
7
Q
A computer controlled by an attacker used to send commands to systems compromised by malware.
A
C2 (Command and Control) server
8
Q
Malware that restricts access to a computer system by encrypting data.
A
Cryptomalware
9
Q
A type of trojan that enables remote access to a compromised system.
A
RAT (Remote Access Trojan)
10
Q
A collection of software tools used by a hacker to mask intrusion and obtain administrator-level access to a computer or computer network.
A
Rootkit
11
Q
Which attack uses a short list of commonly used passwords tried against a large number of user accounts?
A
Spraying attack
12
Q
The practice of making an unauthorized copy of a payment card.
A
Cloning
13
Q
An AI feature that enables it to accomplish tasks based on training data without explicit human instructions.
A
ML (machine learning)
14
Q
When a hashing algorithm produces the same hash value for two distinct pieces of data.
A
Hash collision.
15
Q
A cryptographic attack that forces a network protocol to revert to its older, less secure version.
A
Downgrade attack
16
Q
A means of restricting access to system resources based on the sensitivity of the information and the clearance of users to access information of such sensitivity.
A
MAC (Mandatory Access Control)
17
Q
Which attack would use this string?:
SELECT * FROM users WHERE userName=’Alice’ AND password =” OR ‘1’=’1’;
A
SQL injection
18
Q
A collection of precompiled functions designed to be used by more than one Microsoft Windows application simultaneously to save system resources.
A
DLL (dynamic link library)
19
Q
A type of application attack that relies on executing a library of code.
A
DLL injection
20
Q
Which type of attack would use these bits of string?:
Administrator)&))
Search.aspx?name=username)(zone=*)
A
LDAP injection attack
21
Q
A vulnerability in which queries are constructed from untrusted input without proper validation or sanitization.
A
LDAP injection
22
Q
A protocol that makes it possible for applications to query user information.
A
LDAP (lightweight directory access protocol)
23
Q
Which type of attack would use this string?
…p@$$w0rd</password></user><user><name>attacker</name></user>
A
XML injection attack
24
Q
A language format that’s commonly used for storing, transmitting, and reconstructing data.
A software- and hardware-independent tool for storing and transporting data.
A
XML (extensible markup language)
For example:
<note>
<to>Tove</to>
<from>Jani</from>
<heading>Reminder</heading>
<body>Don't forget me this weekend!</body>
</note>
25
A category of vulnerabilities where an application doesn't correctly validate/sanitize user input before using it in an XML document or query.
XML injection
26
A malicious attempt to trick a web application into displaying the contents of a directory other than the one requested by the user and gain access to sensitive files on a server.
Directory traversal attack
AKA dot-dot-slash attack
27
Which type of attack would use these URLs?:
http://www.example.com/var/../etc/passwd
http://www.example.com/var/www/../../../etc/passwd
http://www.example.com/var/www/files/../../../etc/passwd
http://www.example.com/var/www/files/images/../../../../etc/passwd
Directory traversal attack
AKA dot-dot-slash attack
28
A type of exploit that relies on overwriting contents of memory to cause unpredictable results in an application.
Buffer overflow
29
A situation in which an application writes to an area of memory it's not supposed to have access to.
Buffer overflow
30
A malfunction in a preprogrammed sequential access to a shared resource.
Race condition
31
An undesirable situation that occurs when a device or system attempts to perform two or more operations at the same time, but because of the nature of the device or system, the operations must be done in the proper sequence to be done correctly.
Race condition
32
A vulnerability caused by race conditions.
TOCTOU (time-of-check time-of-use)
33
A class of software bugs caused by a race condition involving the checking of the state of a part of a system and the use of the results of that check.
TOCTOU (time-of-check time-of-use)
34
When software checks the state of a resource before using that resource, but the resource's state changes between the check and the use in a way that invalidates the results of the check.
TOCTOU (time-of-check time-of-use)
35
The average time between system breakdowns.
MTBF (mean time between failures)
36
The average amount of time a non-repairable asset operates before it fails.
MTTF (mean time to failure)
37
Which 2 programming aspects are critical to secure application development processes?
Input validation
Error and exception handling
38
A situation in which a web form field accepts data other than expected
Improper input validation
39
A countermeasure against code injection
Input validation
40
When an attacker intercepts sensitive user data and resends it to the receiver with the intent of gaining unauthorized access or tricking the receiver into unauthorized operations.
Network replay attack
41
When an attacker steals a valid session ID of a user and resends it to the server with the intent of gaining unauthorized access or tricking the server into unauthorized operations.
Session replay attack
42
A programming error where an application tries to store a numeric value in a variable that's too small to hold it.
Integer overflow
43
A type of exploit that allows an attacker to take control over a server and use it as a proxy for unauthorized actions.
SSRF (server side request forgery)
44
An attack where an attacker executes arbitrary JavaScript within the browser of a victim user.
XSS (cross-site scripting)
45
An attack where an attacker induces a victim user to perform actions that they do not intend to.
XSRF (cross-site request forgery)
AKA CSRF
46
What enables the exchange of information between computer programs?
API (application programming interface)
Most web APIs sit between the application and the web server. The user initiates an API call that tells the application to do something, then the application will use an API to ask the web server to do something.
47
What is the purpose of a DoS attack?
Resource exhaustion
48
A situation in which an application fails to properly release memory allocated to it or continually requests more memory than required.
Memory leak
49
SSL stripping is a type of what two attacks?
Downgrade attack
On-path attack
50
An attack performed by a malicious user that leads to a downgrade from an HTTPS secure connection to a less secure encrypted HTTP connection. As a result, the whole web connection is not encrypted anymore.
SSL stripping
51
An attack where an attacker sits in the center between two stations and can catch and sometimes change the data that is being sent across the organization.
On-path attack
MITM attack
52
An attack that seeks to cause a connection, protocol, or cryptographic algorithm to drop to an older and less secure version.
Downgrade attack
AKA version rollback attack
AKA bidding-down attack
53
A software/hardware driver manipulation technique. A cyberattack technique that allows an attacker to alter the external behavior of an application without introducing any changes to the application's code.
Shimming
54
SDK stands for:
Software development kit
55
Installing software obtained from a third-party source rather than an official retailer.
Sideloading
56
A software/hardware driver manipulation technique. The practice of modifying an application's code without changing its external behavior.
Refactoring
57
The process of a client application submitting a request to an API and that API receiving the requested data from the external server or program and delivering it back to the client.
API call
58
2 methods that refer to software/hardware driver manipulation techniques.
Refactoring
Shimming
59
A technique that allows an attacker to authenticate to a remote server without extracting cleartext passwords from a digest.
Pass the hash.
60
The term that refers to a rogue WAP set up for eavesdropping or stealing sensitive user data.
This rogue WAP replaces the legitimate access point and by advertising its own presence with the same SSID (network name) appears as a legitimate access point to connecting hosts.
Evil twin
61
Gaining unauthorized access to a Bluetooth device.
Bluesnarfing
62
The practice of sending unsolicited messages over Bluetooth.
Bluejacking
63
A wireless disassociation attack is a type of which 2 attacks?
Deauthentication attack
DoS attack
64
An attack that sends forged deauthentication frames to a WAP or client device, causing the device to disconnect from the network.
Wireless deauthentication attack
65
An attack that sends forged disassocation frames to a WAP, causing the device to no longer be associated to the WAP.
The client can still be authenticated to a previously associated network, and they may send reassociation requests to the network they were disconnected from to resume connection.
Disassociation attack.
66
Wireless jamming is a type of which attack?
DoS attack
67
An attack in which an attacker transmits interfering wireless signals to decrease the signal-to-noise ratio at the receiving device.
RF (radio frequency) jamming
68
An attack in which an attacker sends random bits of data over a network to use up the bandwidth. This attack may happen intermittently, constantly, or by targeting times in which one individual is attempting to communicate.
Wireless jamming
69
A wireless technology that enables identification and tracking of tags attached to objects.
RFID
70
A type of identification badge that can be held within a certain distance of a reader device to authenticate its holder.
RFID badge
71
WTLS stands for
Wireless transport layer security
72
WAF stands for
Web application firewall
73
A hardware authentication device used to grant access to a restricted digital asset.
Hard token
For example, keys, USB drives, badges, etc.
74
A digital authentication device used to grant access to a restricted digital asset.
Soft token
For example, multi-factor authentication, authenticator apps, clickable authentication links, etc.
75
RFID is vulnerable to which attack(s)?
Spoofing
Eavesdropping
Data interception
Replay attacks
DoS attacks
All of the above
All of the above
76
A technology used for contactless payment transactions.
NFC (near field communication)
77
NFC is vulnerable to which attack(s)?
Data interception
Replay attacks
DoS attacks
All of the above
All of the above
78
Which 2 processes provide randomization during the encryption process?
Salting
IV (Initialization Vector)
79
A binary vector used as the input to initialize the algorithm for encryption to increase security by introducing additional cryptographic variance and to synchronize cryptographic equipment.
This produces a unique stream independent from other streams produced by the same encryption key.
IV (Initialization Vector)
80
A type of attack also known as a MITM attack.
Attackers place themselves on the communication route between two devices.
Attackers intercept or modify packages sent between two communicating devices.
On-path attack
81
An attacker managed to associate his/her MAC address with the IP address of the default gateway. In result, a targeted host is sending network traffic to the attacker's IP address instead of the IP address of the default gateway. Based on the given info, which type of attack is taking place in this scenario?
ARP poisoning
82
A network attack that compromises the security of a network switch by overflowing its memory used to store the MAC address table.
MAC (Media Access Control) flooding
83
An attack that relies on altering the burned-in address of a NIC to assume the identity of a different network host is known as which 2 names?
MAC spoofing
MAC cloning
84
A technique by which an attacker sends spoofed ARP messages onto a network. This does NOT spoof the IP or MAC address. The attacker merely responds first to the ARP request before the legitimate device is able to.
ARP poisoning
85
4 examples of layer 2 attacks
MAC cloning
ARP poisoning
MAC flooding
MAC spoofing
86
A situation in which domain registrants, due to unlawful actions of third parties, lose control over their domain names.
Domain hijacking
87
A type of network attack where the intruder attempts to disrupt the network's normalcy, modify data, and alter the system resources.
Active attack
88
A type of network attack where the intruder intercepts data traveling through the network. They eavesdrop, but do not modify the message. (MITM is a type of this network attack.)
Passive attack
89
A social engineering technique whereby attackers under disguise of a legitimate request attempt to gain access to confidential information is commonly referred to as:
Phishing
90
Which of the following answers refer to smishing? (Select 2 answers)
Social engineering
Email communication
SPIT
SPIM
Text messaging
Social engineering
Text messaging
91
The practice of using a telephone system to manipulate user into disclosing confidential information is known as:
Vishing
92
A term describing an unsolicited advertising message
Spam
Remember that adware causes spam, but adware is NOT the message itself. It is only the software that causes it.
93
What type of spam relies on text-based communication?
Vishing
SPIM
Bluesnarfing
SPIT
SPIM (spam over internet messaging)
94
Phishing scams targeting a specific group of people
Spear phishing
95
The practice of sifting through trash for discarded documents containing sensitive data.
Dumpster diving
96
A situation in which an unauthorized person can view another user's display or keyboard to learn their password or other confidential information is referred to as:
Shoulder surfing
97
Which of the following answers refer to the characteristic features of pharming? (Select 3 answers)
Domain hijacking
Traffic redirection
Fraudulent website
Password attack
Credential harvesting
Traffic redirection
Fraudulent website
Credential harvesting
Remember that pharming often involves the victim clicking on a link to redirect them to the fraudulent website.
98
Gaining unauthorized access to restricted areas by following another person
Tailgating
99
The use of casual conversation to extract non-public information from people without giving them the feeling they're being interrogated.
Elicitation
100
A type of social engineering attack that involves providing a high and low estimate in order to entice a more specific number
Bracketing
101
A type of social engineering attack that involves pretending to divulge confidential information in hopes of receiving confidential information in return
Confidential bait
102
A type of social engineering attack that involves saying something wrong in the hopes that the person will correct the statement with true information
Deliberate false statements
AKA Denial of the obvious
103
A type of social engineering attack that involves pretending to be ignorant of a topic in order to exploit the person’s tendency to educate
Feigned ignorance
104
A type of social engineering attack that involves using praise to coax a person into providing information
Flattery
105
Phishing scams targeting people holding high positions in a business
Whaling
106
Which of the following is used in data URL phishing?
Prepending
Typosquatting
Pretexting
Domain hijacking
Prepending
107
The use of emails to redirect recipients to a fake website and coerce them into divulging sensitive data.
Data URL phishing
108
Adding something to the beginning of something else.
Used when an attacker attaches a trustworthy value like “RE:” or “MAILSAFE: PASSED” to a message in order to make the message appear more trustworthy.
Prepending
109
Use of a fabricated story to gain a victim's trust and trick or manipulate them into sharing sensitive information, downloading malware, sending money to criminals, or otherwise harming themselves or the organization they work for.
Pretexting
110
An email message containing a warning related to a non-existent computer security threat, asking a user to delete system files falsely identified as malware, and/or prompting them to share the message with others would be an example of:
Virus hoax
111
What is the platform for watering hole attacks?
Websites
112
The internal telephone network of a business or other entity. It manages phone calls internally and externally for an organization.
PBX (Private Branch Exchange) system
113
A type of email server that protects an organization's or users' internal email servers. It acts as a gateway through which every incoming and outgoing email passes through.
Email gateway
114
The practice of registering misspelled domain name closely resembling other well established and popular domain name in hopes of getting Internet traffic from users who would make errors while typing in the URL in their web browsers.
URL hijacking
AKA typosquatting
115
An attacker impersonates a company's managing staff member to manipulate a lower rank employee into disclosing confidential data. The attacker informs the victim that the information is essential for a task that needs to be completed within the business hours on the same day and mentions potential financial losses for the company in case the victim refuses to comply. Which social engineering principles apply to this attack scenario? (Select 3 answers)
Urgency
Familiarity
Authority
Consensus
Intimidation
Scarcity
Urgency
Authority
Intimidation
Remember that this manager might not be very familiar with the lower ranking employee.
Urgency is because the task must be completed same-day.
Authority is because the attacker is impersonating the employee's manager.
Intimidation is because they threatened the employee with financial loss.
116
An attacker impersonating a software beta tester replies to a victim's post in a forum thread discussing the best options for affordable productivity software. A while later, he/she follows up by sending the victim private message mentioning the discussion thread and offering free access to a closed beta version of a fake office app. Which social engineering principles apply to this attack scenario? (Select 3 answers)
Authority
Intimidation
Consensus
Scarcity
Familiarity
Trust
Urgency
Scarcity
Familiarity
Trust
Scarcity because it is a closed beta version not available to anyone else
Familiarity because this is a person with whom the victim has already interacted with before
Trust because the attacker is impersonating a software beta tester
117
While conducting a web research that would help in making a better purchasing decision, a user visits series of Facebook pages and blogs containing fake reviews and testimonials in favor of a paid app intentionally infected with malware. Which social engineering principle applies to this attack scenario?
Scarcity
Authority
Consensus
Intimidation
Urgency
Consensus
118
Harmful programs used to disrupt computer operation, gather sensitive information, or gain unauthorized access to computer systems are commonly referred to as:
Malware
119
Malware that restricts access to a computer system by encrypting files or locking the entire system down until the user performs requested action is known as:
Ransomware
120
A type of software that performs unwanted and harmful actions in disguise of a legitimate and useful program. This type of malware might act like a legitimate program and have all the expected functionalities, but apart from that it will also contain a portion of malicious code that the user is unaware of.
Trojan horse
121
A standalone malicious computer program that typically propagates itself over a computer network to adversely affect system resources and network bandwidth is called:
Worm
122
A cyberattack to gain illicit access of elevated rights, permissions, entitlements, or privileges beyond what is assigned for an identity, account, user, or machine. This attack can involve an external threat actor or an insider threat.
Privilege escalation
123
Spam messages symptomatic of widely-used free instant messaging apps like Messenger, Whatsapp, Viber, Telegram, Skype and WeChat. These spam messages are usually commercial-type spam but can contain malware and spyware.
SPIM (spam over instant messaging)
124
Unsolicited bulk messages broadcast over VoIP (Voice over Internet Protocol) to phones connected to the Internet.
SPIT (spam over internet telephony)
AKA vam (voice/VoIP spam)
125
What is a PUP (Potentially Unwanted Program)? (Select 3 answers.)
Not explicitly classified as malware by AV software
An app downloaded and installed w/out the user's consent (illegal app)
A type of software that may adversely affect the computer's security and performance, compromise user's privacy, or display unsolicited ads
An app downloaded and installed with the user's consent (legal app)
Explicitly classified as malware by AV software
A type of free, utility software often bundled with a paid app
Not explicitly classified as malware by AV software
A type of software that may adversely affect the computer's security and performance, compromise user's privacy, or display unsolicited ads
An app downloaded and installed w/ the user's consent
126
A type of free, utility software often bundled with a paid app
Bloatware
127
A malware-infected network host under remote control of a hacker is commonly referred to as:
Bot
128
A private network similar to an intranet, but typically open to external parties, such as business partners, suppliers, key customers, etc.
Extranet
129
A private network contained within an enterprise that is used to securely share company information and computing resources among employees.
Intranet
130
A network set up to catch a hacker's attention. It's designed to look, feel, and act just like a network packed tight with valuable resources. But it also contains plenty of monitoring tools.
Honeynet
131
A keylogger is an example of what type of malware?
Spyware
132
Malicious software collecting info about users w/out their knowledge/consent is known as:
Spyware
133
A type of service that, through a joint digital channel, enables users to plan, book, and pay for multiple types of mobility services. The concept describes a shift away from personally-owned modes of transportation and towards mobility provided as a service.
MaaS (Mobility as a Service)
134
An undocumented (and often legitimate) way of gaining access to a program, online service, or an entire computer system
Backdoor
135
Which password attack bypasses account-lockout policies?
Birthday
Spraying
Dictionary
Replay
Spraying attack
136
T/F: One of the measures for bypassing the failed logon attempt account lockout policy is to capture any relevant data that might contain the password and brute force it offline.
True
137
T/F: Rainbow tables are lookup tables used to speed up the process of password guessing.
True
138
What are the contents of a rainbow table entry?
Hash/Password
139
Due to added functionality in its plug, malicious USB cables can be used for:
GPS tracking
Capturing keystrokes
Sending and receiving commands
Delivering and executing malware
Any of the above
Any of the above
140
Theft of personal data from a payment card is known as:
Skimming
141
A technique in which an attacker moves from one compromised system to the next in a network.
Pivoting
142
The process of unlocking or jailbreaking a device, such as a smartphone or tablet.
Rooting
143
RAD stands for
Rapid Application Development
144
A cryptographic attack that relies on the concepts of probability theory
Birthday
145
A type of attack where the attacker has an access to the ciphertext and its corresponding plaintext (crib). His goal is to guess the secret key (or a number of secret keys) or to develop an algorithm which would allow him to decrypt any further messages.
KPA (known-plaintext attack)
146
AAA stands for
Authentication, Authorization, Accounting
147
T/F: A situation where a cryptographic hash function produces two different digests for the same data input is referred to as a hash collision.
False
A hash collision is where 2 different data inputs have the same hash
148
A situation where a cryptographic hash function produces the same message digest for two distinct data inputs.
Hash collision
149
A type of cryptographic attack that forces a network protocol to revert to its older, less secure version is known as:
Downgrade attack
150
Which of the following facilitate(s) privilege escalation attacks? (Select all that apply)
System/application vulnerability
Principle of least authority
Social engineering techniques
MAC (Mandatory Access Control)
System/application misconfiguration
System/application vulnerability
Social engineering techniques
System/application misconfiguration
Remember that Mandatory Access Control and principle of least authority are both ways to PREVENT a privilege escalation attack.
151
Which of the following answers can be used to describe characteristics of a cross-site scripting attack? (Select 3 answers)
Exploits the trust a user's web browser has in a website
A malicious script is injected into a trusted website
User's browser executes the attacker's script
Exploits the trust a website has in the user's web browser
A user is tricked by an attacker into submitting unauthorized web requests
Website executes attacker's requests
Exploits the trust a user's web browser has in a website
A malicious script is injected into a trusted website
User's browser executes the attacker's script
152
Which of the following indicates an SQL injection attack attempt?
DELETE FROM itemDB WHERE itemID = '1';
SELECT * FROM users WHERE userName = 'Alice' AND password = '' OR '1' = '1';
DROP TABLE itemDB;
SELECT * FROM users WHERE email = 'example@example.com' AND password = '';
SELECT * FROM users WHERE userName = 'Alice' AND password = '' OR '1' = '1';
153
Which of the following fragments of input might indicate an LDAP injection attack attempt? (Select 2 answers)
... AND password = '' OR '1' = '1';
administrator)(&))
...
search.aspx?name=userName)(zone=*)
... p@$$w0rdattacker ....
administrator)(&))
search.aspx?name=userName)(zone=*)
154
Which of the following fragments of input might indicate an XML injection attack attempt?
...
search.aspx?name=userName)(zone=*)
... p@$$w0rdattacker ....
administrator)(&))
... AND password = '' OR '1' = '1';
... p@$$w0rdattacker ....
155
An attempt to read a variable value from an invalid memory address?
Null-pointer deference
156
A type of exploit that relies on overwriting contents of memory to cause unpredictable results in an application is called:
Buffer overflow
157
A type of attack in which the attacker uses mathematical algorithms to predict the IV in encryption. Once the IV is known, the attacker can use it to decrypt encrypted messages.
IV attack
158
An automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities. A tool injects these inputs into the system and then monitors for exceptions such as crashes or information leakage.
Fuzz test
159
A malfunction in a preprogrammed sequential access to a shared resource is described as:
Race condition
160
The process of reorganizing data in a database so that it meets two basic requirements: There is no redundancy of data, all data is stored in only one place.
Normalization
161
Which of the following are the characteristic features of a session ID? (Select 3 answers)
Stored on a server
A unique identifier assigned by the website to a specific user
Contains user's authentication credentials, e.g. username and password
A piece of data that can be stored in a cookie, or embedded as an URL parameter
Stored in a visitor’s browser
A unique identifier assigned to a server
A unique identifier assigned by the website to a specific user
A piece of data that can be stored in a cookie, or embedded as a URL parameter
Stored in a visitor's browser
162
Which type of exploit allows an attacker to take control over a server and use it as a proxy for unauthorized actions?
SSRF (Server-side request forgery)
163
Which of the following answers can be used to describe characteristics of a cross-site request forgery attack? (Select 3 answers)
Exploits the trust a website has in the user's web browser
A user is tricked by an attacker into submitting unauthorized web requests
Website executes attacker's requests
Exploits the trust a user's web browser has in a website
A malicious script is injected into a trusted website
User's browser executes attacker's script
Exploits the trust a website has in the user's web browser
A user is tricked by an attacker into submitting unauthorized web requests
Website executes attacker's requests
164
T/F: In an on-path attack, attackers generate forged packets and inject them in the network.
False
A MITM attack is AKA eavesdropping attack. It does not involve forging new data.
165
SDN stands for
Software-Defined Networking
166
An approach to networking that uses software-based controllers or application programming interfaces (APIs) to communicate with underlying hardware infrastructure and direct traffic on a network.
SDN (Software-Defined Networking)
167
PED stands for
Portable electronic device
168
The process of hiding original data with modified content such as characters or other data
Obfuscation
169
The process of hiding original data with modified content such as characters or other data
Obfuscation
170
A type of network attack which involves the attacker injecting their own forged packets into the data stream.
Packet injection attack
171
APT stands for
Active Persistent Threat
172
Remapping a domain name to a rogue IP address is what kind of exploit?
DNS poisoning
173
URL redirection is a characteristic feature of what kind of attack?
Pharming
174
Which has the biggest impact on domain reputation?
Domain age
Missing SSL certificate
Derivative content
Bounce rate
Distribution of spam
Distribution of spam
175
What is the most common form of DDoS attack?
Network-based
176
Which type of DDoS attack uses IoT devices as bots to carry out the attack?
IoT-based
177
OT stands for
Operational Technology
178
The use of hardware and software to monitor and control physical processes, devices, and infrastructure.
OT (Operational Technology)
179
Robots, industrial control systems (ICS), Supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), and computer numerical control (CNC) are examples of what?
OT (Operational Technology)
180
Which type of DDoS attack industrial equipment and infrastructure?
OT
181
Which type of DDoS attack targets application services such as web servers and application firewalls?
Application
182
ATT&CK stands for
Adversarial Tactics, Techniques, and Common Knowledge
183
A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
ATT&CK
184
IoC stands for
Indicators of Compromise
185
During a cybersecurity incident, the digital breadcrumbs that reveal that an attack has occurred, what tools were used in the attack, and who's behind it.
IoC (Indicators of Compromise)
186
Microsoft PowerShell script file extension
.ps1
187
A filename extension used in a cross-platform, general-purpose programming language?
.py (Python programming language)
188
A filename extension for a UNIX shell executable file.
.sh
189
A filename extension for a Microsoft Visual Basic file
.vbs
190
A filename extension for a batch file
.bat
191
DOM stands for
Document Object Model
192
An application programming interface (API) for HTML and XML documents. It defines the logical structure of documents and the way a document is accessed and manipulated.
It connects web pages to scripts or programming languages by representing the structure of a document in memory.
It represents a document with a logical tree. Each branch of the tree ends in a node, and each node contains objects. With them, you can change the document's structure, style, or content.
DOM (Document Object Model)
193
VBA stands for
Visual Basic for Applications
194
Which of the following enables running macros in Microsoft Office applications?
VBA (Visual Basic for Applications)
195
A computer programming language developed and owned by Microsoft.
Used to create macros to automate repetitive word- and data-processing functions, and generate custom forms, graphs, and reports.
VBA (Visual Basic for Applications)
196
A filename extension for JavaScript file
.js
197
A filename extension for a source code file created in Visual Basic language
.vb
198
Which statements best describe the attributes of an APT? (Select 3 answers)
Lack of extensive resources/funding
High level of technical sophistication
Extensive amount of resources/funding
Threat actors are individuals
Low level of technical sophistication
Typically funded by governments/nation states
High level of technical sophistication
Extensive amount of resources/funding
Typically funded by governments/nation states
199
A disgruntled employee abusing legitimate access to a company's internal resources is called
Insider threat
200
A person who uses existing computer scripts or code to hack into computers, lacking the expertise to write their own.
Script kiddie
201
Hackers that use their technical skills to defraud and blackmail others.
Black hat
202
Hackers that use their technical skills to protect the world from bad hackers.
White hat
203
Hackers that use their technical skills with good intentions, but do not take the ethical route. They may penetrate networks to look for vulnerabilities without your consent, but do not cause harm.
Gray hat
204
Hackers that use their technical skills with good intentions, but use extreme and sometimes illegal routes to achieve their goals. They deploy dangerous cyber attacks against black hat hackers.
Red hat
205
Hackers that work as security professionals outside the organization. They are invited to test new software and find vulnerabilities. They perform penetration testing without causing damage.
Blue hat
206
Hackers that are still learning about techniques and programming. This type is different from a script kiddie because this type of hacker works hard to continue to learn and develop skills.
Green hat
207
Which of the following statements does not match a typical description of nation states or state-funded groups identified as threat actors?
Political or economic motivation
High level of technical sophistication
Advanced Persistent Threat (APT)
High level of resources/funding
Typically classified as an internal threat
Typically classified as an internal threat
208
A person who breaks into a computer network or system for a politically or socially motivated purpose is usually described as a(n):
Hacktivist
209
Which statements best describe the attributes of a script kiddie? (Select 2 answers)
Motivated by money
Low level of technical sophistication
Motivated by ideology
High level of technical sophistication
Lack of extensive resources/funding
Low level of technical sophistication
Lack of extensive resoruces/funding
210
Threat actors whose sole intent behind breaking into a computer system or network is monetary gain
Criminal syndicates
211
People or groups who use their technology skills to facilitate hacking, sabotage, theft, misinformation and other operations on behalf of a country. They are state-sponsored.
Nation-state threat actors
212
A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period of time. Usually done to steal data.
APT (Advanced Persistent Threat)
213
Which types of hacking are authorized? (Select 2)
Black hat
Gray hat
White hat
Blue hat
Green hta
White hat
Blue hat
214
Which types of hacking are unauthorized?
Gray hat
White hat
Black hat
Blue hat
Black hat
215
Which type of hacking is semi-authorized?
Blue hat
Black hat
Gray hat
White hat
Gray hat
216
Software and hardware used w/in an organization, but outside of the organization's official IT infrastructure.
Shadow IT
217
Threat actors that engage in illegal activities to get the know-how and gain market advantage?
Competitors
218
Any combination of persons or enterprises engaging, or having the purpose of engaging, on a continuing basis in conduct that violates one or more provisions of a felony statute of a United States jurisdiction.
Criminal syndicate
219
Which of the following answers does not relate to a direct access threat vector?
Malicious USB cable
Backdoor
Malicious URL
Lack of physical security controls
Malicious flash drive
Malicious URL
220
Which of the following answers refer(s) to wireless threat vector(s)? (Select all that apply)
Network protocol vulnerabilities (WEP/WPA)
Rogue AP / Evil twin
Default security configurations
Malicious email attachments
Vulnerabilities in network security standards (WPS)
Network protocol vulnerabilities (WEP/WPA)
Rogue AP/ evil twin
Default security configurations
Vulnerabilities in network security standards (WPS)
221
WEP stands for
Wired Equivalent Privacy
It's a sucky security protocol.
222
WPA stands for
Wi-Fi Protected Access
More secure than WEP
223
WPS stands for
Wi-Fi Protected Setup
A feature supplied with many routers. It is designed to make the process of connecting to a secure wireless network from a computer or other device easier. It makes routers extremely vulnerable to cyberattacks.
224
A type of attack vector where the attacker gains physical access to a computer and performs malicious actions.
Direct access attack vector
225
Which of the following enables client-side URL redirection?
host
hosts
hostname
localhost
hosts
