Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SOC Leaning > SOC - technical q > Flashcards

SOC - technical q Flashcards

1
Q

What does OSI stand for and what’s it used for?

A

Open System Interconnection, a framework that divides and details the steps on network communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 7 layers of the OSI model?

A

Application Layer – human-computer interaction layer

Presentation Layer – Ensures that data is in a usable formation and is where data encryption occurs

Session Layer – Maintain connections and is responsible for controlling ports and sessions

Transport Layer – Transmit data using transmission protocols (tcp/udp)

Network Layer – decides the physical path the data will take

Data Link – defines the format of the data on the network

Physical – transmit raw bot stream over the physical medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the “Pyramid of Pain” model?

A

Ranks the IOCs from the least valuable to the most valuable. Bottom being trivial to the top being most difficult

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the layers of the Pyramid of Pain?

A

TTP - Tactics, techniques and procedures

Tools

Network/ Host Artifact

Domain name

IP Addresses

Hash Values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is NIST and its purpose?

A

National Institute of Standards and Technology
Designed to help businesses understand, manage and reduce cyber security risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the steps of NIST?

A

Identity

Protect

Detect

Respond

Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Punycode?

A

Used by attackers to redirect to a malicious domain that looks legitimate. Punycode is a way of converting words that cannot be written in ASCII, into unicode ASCII coding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Any.Run?

A

Is a sandboxing service that executes samples, that we can review any connections such as http requests, DNS requests or processes communicating with an IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Fuzzy hashing?

A

Allows you to perform similarity analysis to match two files with minor differences based on fuzzy hash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Pass-the-Hash?

A

Exploits Single Sign-On (SS0) through NT Lan Manager (NTLM), Kerberos, and other authentication protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Mitre Attack?

A

Is a globally accessible knowledge base of adversary tactics and techniques used based on real world observations. The mitre attack knowledge base is now a foundation used to develop models and methodologies in the private sector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a vulnerability?

A

a flaw or a weakness in some parts of a system security procedure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a threat?

A

A threat is a potential negative occurrence that can have consequences for a business operation/function/reputation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a risk?

A

the probability that a particular threat will occur, either intentionally or accidently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the difference between asymmetric and symmetric encryption?

A

Symmetric encryption uses the same key to encrypt and decrypt, while asymmetric encryption requires a pair of keys using a public key to encrypt and a private key to decrypt the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between UDP and TCP?

A

UDP (user datagram protocol) is a connectionless protocol.

TCP, on the other hand, is connection-oriented, best described as requiring a three-way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an IPS, and how does it differ from IDS?

A

IPS (Intrusion Prevention System) can prevent traffic, while IDS (Intrusion Detection System) can only detect traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is encoding?

A

Encoding ensures that different systems or programs can correctly interpret data in its proper format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is encryption?

A

Encryption ensures the data is secure and that only those with an encryption key have access to the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is hashing?

A

hashing maintains the integrity of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the CIA triad?

A

Model of security orders with 3 principles :

Confidentiality 
Integrity 
Availability 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How do you keep updated with information security news?

A

Twitter and websites like bleepingcomputer.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Ports to know : FTP

A

20/21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Ports to know : SMTP

A

25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Ports to know : HTTP

A

80

26
Q

Ports to know : HTTPS

A

443

27
Q

Ports to know : POP3

A

110

28
Q

Ports to know : Telnet

A

23

29
Q

Ports to know : SSH

A

22

30
Q

What does a SOC perform?

A

Monitor and analyse the organisations computer and network, to identify and mitigate threats.
A typical role would be to respond to security alerts and incidents, conduction investigations and implement security controls.

31
Q

Talk through a TCP handshake?

A

Syn – the client picks a sequence of numbers, which is sent in the first syn packet
Syn-ack – server responds with a syn-ack flag set
Ack – final step, where the client acknowledges the response of the server and a connection is established

32
Q

How would you approach a problem you have not seen before?

A

Google, chatGPT, experienced colleagues and peers.
Next step once resolved would be to document the process and add to KB

33
Q

Potential malicious binary – what do you do?

A

Use VirusTotal to see virus hash, so see if someone else has loaded anything similar. Load it up onto the database to see if it’s a known malicious signature.
Can also load it into a contained environment to see if it exhibits malicious activity
Tools like Process explorer could help monitor its activity.

34
Q

What is EDR tool and give examples?

A

Fireeye, crowdstrike and eset

35
Q

What is a true positive?

A

A true positive is a correct identification of a positive event.

36
Q

What is a false positive?

A

A false positive is an identification of a positive event that is not actually happening

37
Q

What is a false negative?

A

A false negative is when the system doesn’t identify an issue when there isnt one

38
Q

Scenario – a colleague has set up a customer facing webserver, how would you secure it?

A

Ensure its fully patched
Configure FW for only allowed traffic
Implement strong password policies for accounts
ACL’s for users who need access only
Logging and monitoring tools on the server
Perform pentest and regular VA’s
WAF – place a WAF infront of the application

39
Q

What is data leakage?

A

This is when data is leaked by unauthorised means due to internal errors

40
Q

What are the common means of user authentication?

A

Username and password, PIN, biometrics

Something you know
Something you have
Something you are

41
Q

What’s the importance of Domain Name System monitoring?

A

Helps prevent domain based cyberattacks – DNS is a popular target for attackers

DDOS – where multiple requests are sent to crash a server

DNS poisoning - hackers insert false information into your DNS cache and spoof a version of your site

42
Q

Name the tools you can use to secure a standard network?

A

FW, IDS, SIEM solution, VPN’s, EDR, WAF’s, VA, PT, policies and procedures, adopting frameworks

43
Q

Describe the salting process and its application?

A

Password salting is a techniques to protect passwords by adding a string of 32 characters and then hashing it. Salting prevents hackers from reverse-engineering passwords.

44
Q

What’s the difference between penetrative testing and software testing?

A

Sofware testing revolves arounds code review and secure coding practices

Pentesting simulates a full exploitation attack on a system/network

45
Q

What is a man-in-the-middle attack?

A

This is a common attack where the attacker ‘listens’ to a two way conversation.

46
Q

Give examples of MITM attacks?

A

Rogue access points who can trick nearby devices to join its domain, the traffic can then be manipulated by the attacker.

ARP spoofing is when an attacker poses as another host and tries and respond with its own MAC address, where the attacker can sniff the private traffic between two hosts.

MDNS – multicast is done on a local network using a broadcast like ARP

DNS spoofing – where the attacker attempts to corrupt DNS cache in an attempt to make other hosts access their site

Sniffing – packet capture tools so try and intercept packages

Session hijacking - sniff sensitive traffic to identify session token for a user

47
Q

What is payload attack?

A

malicious code that is designed to execute a specific action

48
Q

How do you prevent a MITM attack?

A

Strong encryption on AP’s
Strong router login credentials
Using VPN’s
Force HTTPS

49
Q

How would you secure a wireless access point?

A

Strong password and encryption
Up to date
FW
Don’t broadcast
VPN

50
Q

Difference between vlan and subnet

A

VLAN is software based and Subnets are hardware based.

VLAN’s create logical networks that are independent of the physical network topology.

VLAN’s are based on layer 2 and subnets are done at layer 3

51
Q

What is the cyber kill chain?

A

This is a model for identification and cyber intrusion activity. The model identifies what the adversaries must complete in order to achieve their objective.

52
Q

What are the steps of the cyber kill chain?

A

Reconnaissance – harvesting email address, conference info etc

Weaponization – coupling exploit with backdoor into deliverable payload

Delivery – delivering weaponised bundle to the victim via email, web, web etc

Exploitation – exploiting a vulnerability to execute code on victims system

Installation – installing malware on asset

Command & control (C2) - command channel for remote manipulation of victim

Actions on objectives – intruder accomplishes their original goal

53
Q

What is SIEM?

A

Security Information and Event Management (SIEM), is a security solution that provides the real time logging of events in an environment - example will be sentinel.

54
Q

What is TCP/IP Model?

A

Four-layer model that divides network communications into four distinct categories.

55
Q

What layers does the TCP/IP model have?

A

Application Layer
Transport Layer
Internet Layer
Network Access Layer

56
Q

What is ARP?

A

The Address Resolution Protocol (ARP) is a communication protocol used for discovering the Data Link Layer address, such as a MAC address, associated with a given Network Layer address, typically an IPv4 address.

57
Q

What is DHCP?

A

automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.

58
Q

Explain OWASP Top 10?

A

The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. (OWASP)

59
Q

What is SQL Injection?

A

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.

60
Q

What is the difference between static and dynamic malware analysis?

A

Static Analysis: It is the approach of analyzing malicious software by reverse engineering methods without running them.

Dynamic is the approach that examines the behavior of malicious software on the system by running it

61
Q

What is ISO27001

A

ISO 27001 can help organizations reduce risk, optimize operations within an organization due to clearly defined responsibilities and business processes

62
Q

What does PCI DSS stand for?

A

Payment Card Industry Data Security Standard

A set of security standards for handling major credit cards.

SOC Leaning (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions