Security Tools and Technologies Flashcards
What kind of tool is Wireshark?
Steganography
Malware
Protocol analyzer
Protocol analyzer
Wireshark is a protocol analyzer that can make visual displays of IP traffic
There are reports of a worm going through your company that communicates to other nodes on port TCP/1337. What tool would you use to find infected nodes on your network?
Protocol analyzer
Advanced malware tool
Network scanner
Network scanner
A network scanner that searches for particular ports can help detect infected machines
Why should you never use a network scanner on a network you are not authorized to scan?
A network scanner or port scanner is the same tool that an attacker would use.
It might crash the network switch.
Being too efficient at finding network information will cause you to get more work.
A network scanner or port scanner is the same tool that an attacker would use.
Because a network scanner operates the same way that an attacker would operate a port scanner against your network to search for vulnerable machines, many companies prohibit the use of a network scanner on any corporate machines
Your manager comes to you with an audit finding that 85 percent of the machines on your network are vulnerable to a variety of different exploits. He wants you to verify the findings of the report. What would be the best tool for this?
Protocol analyzer
Network scanner
Vulnerability scanner
Vulnerability scanner
A vulnerability scanner is the best tool for the task. A protocol analyzer allows you to examine packets, not systems for vulnerabilities. A network scanner maps systems, but has limited vulnerability scanning capability
What is the most common use of data sanitization tools?
Clearing web-form fields between user sessions
Erasing hard drives before computers are recycled
Removing PII from a database
Erasing hard drives before computers are recycled
The most common use of a data sanitization tool is to erase hard drives of any potential sensitive data before they are recycled
Your organization has been hit with multiple targeted network attacks over the last few months resulting in two data breaches. To attempt to discover how the attackers are getting into your systems, you set up a few vulnerable virtual machines with fake data on them that look like the organization’s real machines. What defense mechanism have you built?
Passive sensors
DMZ
A honeynet
A honeynet
A honeynet is composed of several vulnerable machines deployed to purposely be attacked
The tcpdump command-line tool is classified as which of the following?
Network scanner
Password cracker
Protocol analyzer
Protocol analyzer
The tcpdump command-line tool is a protocol analyzer that allows you to filter and display all the network traffic going to a machine, or save it in files for later viewing
Why should you compare hashes of the files you download from the Internet to a library of known hash values?
It prevents the spread of malware by checking a file’s integrity.
It prevents you from running the incorrect application.
It protects the data stored in the file.
It prevents the spread of malware by checking a file’s integrity.
Comparing the file’s hash ensures that the file has not been altered from the known good file, which prevents the spread of malware because most changes are due to a virus being implanted in the file
What two things can removable media control do to improve security?
Prevent data sharing and prevent executables from running
Prevent infiltration of malware and prevent exfiltration of data
Provide secure log storage and provide portable encryption
Prevent infiltration of malware and prevent exfiltration of data
Removable media control can prevent a path for malware to enter the organization, and can prevent the exfiltration of sensitive data from the organization
Which of the following describes most network tools that are designed to detect an attack?
Active
Passive
Linux based
Passive
The majority of detection tools are passive, in that they wait for something in the environment to change as an indicator of an attack. Most tools have equivalents for both Windows and Linux, since the detection is not dependent upon the host system being attacked
