Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CWO Block 7 > Student Text > Flashcards

Student Text Flashcards

1
Q

What are the standard computer capabilities and characteristics?

A
  • Speed
  • Accuracy
  • Diligence
  • Versatility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the fastest possible speed for information transmission?

A

Speed of light

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is limited by the efficiency of the programmed algorithms being computer and system components?

A

Computer speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a personal computer that may of may not be connected to a network?

A

Workstation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the different types of client workstations?

A
  • Thin client
  • Thick client
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a software program or actual computer relying heavily on another computer to do most of its work?

A

Thin client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What operates on a network with client software or computer acting as an interface & the network doing all the processing work?

A

Thin client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a workstation computer in a client server configuration functioning independent of the server?

A

Thick client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What pulls some data from a central server and may run on its own without being connected to the server?

A

Thick client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a computer on a network managing shared resources for other systems on the network?

A

A server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some common types of servers?

A
  • Application
  • Catalog
  • Database
  • DHCP
  • File
  • Mail
  • Proxy
  • Web
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a computer system weakness that is open to exploitation?

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a possible danger that may take advantage of a vulnerability?

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the likelihood that a threat will take advantage of a vulnerability?

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are some types of malicious code?

A
  • Viruses
  • Worms
  • Logic bombs
  • Spyware
  • Adware
  • Rootkits
  • Botnets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is code that spreads from one computer to another by attaching itself to other files?

A

A virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is code that spreads from one computer to another on its own but not by attaching itself to another file?

A

A worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is code that sits dormant on a target computer until it’s triggered by a specific event?

A

A logic bomb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What stealthily installs malicious software intended to track and report data from a target system?

A

Spyware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is software that automatically displays or downloads advertisements?

A

Adware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is code intended to take full of partial control of a system at low levels?

A

A rootkit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a collection of software robots run by a command & control (C2) program which in turn is controlled by a person?

A

A botnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are some common causes of vulnerabilities?

A
  • Configuration/familiarity
  • Implementation
  • Design
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What can a system or application misconfiguration cause?

A

A vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What can using well known software increase?

A

The probability of an attacker finding a vulnerability to exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What can lack of input validation cause?

A

A vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Is there a possibility that there are vulnerabilities that are inherent in protocols, applications, or architecture used in the design?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the primary threat categories?

A
  • Unstructured threats
  • Structured threats
  • Internal threats
  • External threats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are unfocused attacks on one or more network systems often by individuals with limited skill?

A

An unstructured threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What types of threats are focused by one or more individuals with high skills actively working to compromise a specific system?

A

A structured threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What threats originate from individuals who have (or had) authorized access to the network?

A

Internal threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What threats originate from individuals outside the organization?

A

External threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are common vulnerability sources?

A
  • Common Vulnerability and Exposure (CVE)
  • US National Vulnerability Database (NVD)
  • Exploit Database (DB)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What was developed by MITRE in 1999 and has a list of vulnerability entries?

A

Common Vulnerability Sources (CVE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What contains an ID number, description, and at least one public reference?

A

A Common Vulnerability Source (CVE) entry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What was launched by the US National Vulnerability Database (NVD) in 2005?

A

The US National Vulnerability Database (NVD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is a vulnerability database built upon & fully synchronized with the CVE list?

A

The US National Vulnerability Database (NVD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What provides a Common Vulnerability Scoring System (CVSS)?

A

The US National Vulnerability Database (NVD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is maintained by Offensive Security and is an archive of exploits, shell code, & security papers?

A

Exploit Database (DB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is on the motherboard and controls the number of tasks the computer may accomplish at once and how quickly it can complete those tasks?

A

The Central Processing Unit (CPU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is on the motherboard and is the circuitry responsible for managing specific hardware components?

A

Chipsets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is on the motherboard and is a small chip the CPU relies on to synchronize & control timing on all computer operations?

A

The system clock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is on the motherboard and is a small plastic slot used to install various devices?

A

Expansion slots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is on the motherboard, translates processor requests into instructions the component can understand and executes Power-On-Self-Test (POST)?

A

The BIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is on the motherboard, contains the computer’s inventory list & advanced setup options, and stores data read by the BIOS?

A

The CMOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the two types of memory?

A

RAM (Random Access Memory) and ROM (Read Only Memory)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is a memory chip on a computer responsible for storing temporary data and is volatile in nature?

A

RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is a chip with read-only data that are essential instructions when the system is turned on and is non-volatile in nature?

A

ROM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What stores changing digital data in a relatively permanent form with the most popular being SCSI, SAS, and SATA?

A

Hard drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the two basic distributed system architectures?

A
  • Client-server model (centralized environment)
  • Peer-to-peer model (decentralized environment)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is an architecture where smart clients contact the server for data then format and displays it to the user?

A

The client-server model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is an architecture where there are no special machines that provide a server or manage the network resources and every node can serve as both client and server?

A

The peer-to-peer model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What are the security basics?

A
  • The CIA triad
  • Enforce system policies & procedures
  • The four A’s
  • System hardening
  • Vulnerability management
  • Due care, due diligence, & due process
  • Operations continuity & disaster recovery plans
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the CIA Triad?

A

Confidentiality, Integrity, and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What does a policy statement do?

A

Outlines a plan for the user security component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What measures the level of adherence to the security policy?

A

Standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are recommendations or best practices for how to meet the policy standard?

A

Guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are step-by-step instructions that detail how to implement components of the policy?

A

Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What are the four A’s?

A

Authentication, authorization, access control, auditing/accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is the process of uniquely ID’ing a particular individual or entity?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is the process of determining what rights & privileges a particular entity has?

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the process of determining & assigning privileges to resources, objects, or data?

A

Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is the process of tracking & recording system activities & resource access?

A

Auditing/accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What is system hardening?

A

Eliminate as many security risks as possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are some examples of system hardening?

A
  • Disabling unnecessary services
  • Protecting management interfaces & applications
  • Disabling unnecessary accounts
  • Password protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is an ongoing comprehensive process or program that aims at managing an organization’s vulnerabilities in a holistic & continuous manner?

A

Vulnerability management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are some types of vulnerability management?

A
  • Asset management
  • Software management
  • Vulnerability assessment
  • Patch management
  • Change management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a policy describing how individuals should use & maintain organization issued hardware & software and includes both using the equipment safely & using it in an approved manner?

A

Due Care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is investing & researching all issues & options relating to a particular subject, ensuring security policies & practices are effective, and ensuring no violations in laws, statutes, or individual human rights?

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

The organization does not assume an individual is guilty?

A

Due process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What defines how an organization will maintain normal day-to-day Ops during a disruption or crisis?

A

Operations continuity plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What defines how people & resources will be protected in case of a natural or man-made disaster?

A

Disaster recovery plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What are the capabilities & benefits of websites?

A
  • Reduces communication costs
  • Enhances communication & coordination
  • Accelerates the distribution of knowledge
  • Improves the customer service & customer satisfaction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What are some capabilities & benefits of databases?

A
  • Data sharing is improved in the organization
  • Improvement in data security
  • Effective data integration
  • DBMS minimizes data inconsistency
  • Better access to data
  • Increase in productivity of the end user
  • Quick decision making
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What are the 10 most critical security risks?

A
  • Injection
  • Broken authentication
  • Sensitive data exposure
  • XML External Entities (XXE)
  • Broken access control
  • Security misconfiguration
  • Cross-site scripting (XSS)
  • Insecure deserialization
  • Using components with known vulnerabilities
  • Insufficient logging & monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is it called when untrusted data is sent to an interpreter as part of a command or query and tricks it into accessing data without proper authorization?

A

Injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is it called when issues with application functions related to authentication & session management allow someone to assume another users’ identity temporarily or permanently?

A

Broken authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is it called when lack of encryption for data at rest or in transit leads to the release of PII, healthcare, etc?

A

Sensitive data exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What is it called when someone fails to enforce authenticated user restrictions?

A

Broken access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What allows someone to exploit unpatched flaws or default configurations?

A

Security misconfigurations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is it called when theirs insufficient input validation and attackers are able to add malicious content to a website & content executed on other victim’s browser?

A

Cross-Site Scripting (XSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What is it called when existing data structures are used but content is changed?

A

Insecure deserialization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

When you use preconfigured client/server-side components but you don’t understand the component patch state what are you possibly doing?

A

Using components with known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

When you are not validating logging & monitoring capabilities what are you setting yourself up for?

A

Insufficient logging and monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What are the various website components?

A
  • Web page
  • Web content
  • Websites
  • Web browser
  • Web applications
  • Browser engine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What is a computer file that is suitable for the World Wide Web & a web browser?

A

Web page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What are the two types of web pages?

A

Static and dynamic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is a flat/stationary web page called?

A

Static web pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What web page is controlled by application server processing server-side scripts and client web browser processing client-side scripts?

A

Dynamic web pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What is the textual, visual or aural content that is encountered as part of the user experience on a website?

A

Web content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What is a collection of related web pages ID’d by a common domain name, published on at least one web server and accessible by IP networks or private LAN by URL?

A

Websites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What is an application for accessing information on WWW by retrieving web page & content by distinct URLs onto the user’s device?

A

Web browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What is a client-server program which the client runs in a web browser?

A

Web application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What is the core software component of every major web browser?

A

Browser engine

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What are some common database terms?

A
  • Data
  • Database
  • Database system (Schema)
  • Database Management System (DBMS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What are recorded facts & figures called?

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What is a collection of meaningful information organized for searching & retrieving that information?

A

Database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What is the logical layout for the database?

A

Database system (Schema)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What is a set of programs & utilities executed on a computer to create, process, & administer a database?

A

Database management system (DBMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What are the four major components?

A

Data, hardware, users, software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What is known facts recorded & implicit meaning?

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What are data characteristics?

A

Persistent, integrated, shared

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What is computing equipment needed to use & maintain the database?

A

Hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What are individuals manipulating or maintaining aspects of the database?

A

Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What are the four broad classes of users?

A
  • End-user
  • Database designers
  • Database administrators (DBA)
  • Applications programmers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

What are the DBMS key components?

A
  • Data dictionary
  • Data security
  • Performance management
  • Data recovery
  • Data integrity
  • Data interface
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What are the four web language types?

A
  • Markup languages
  • Style sheets
  • Client-side scripting languages
  • Server-side scripting languages
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What is a modern system for annotating a document in a way syntactically distinguishable from text?

A

Markup languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

What are the general categories of markup languages?

A
  • Presentational
  • Procedural
  • Descriptive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What are the most common markup languages?

A
  • HyperText Markup Language (HTML)
  • Extensible HyperText Markup Language (XHTML)
  • Extensible Markup Language (XML)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

What is a form of separation of presentation & content for web design?

A

Style sheets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

What are some examples of style sheets?

A
  • Cascading Style Sheets (CSS)
  • Extensible Stylesheet Language (XSLT)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

What is a class of computer programs on the web executed client-side instead of server-side (on the Web Server)?

A

Client-side scripting languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

What is executed by the web server when the user requests a document?

A

Server-side scripting languages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

What are embedded in server-side scripts to retrieve data from databases?

A

Database Management System Languages

116
Q

What are the two major categories of database design?

A

Flat file databases and relational databases

117
Q

What consists of only one large table, records no structured relationships, and has tables found in Microsoft Excel & Apple Numbers?

A

Flat file databases

118
Q

What consists of numerous tables containing rows & columns of data where tables are associated with each other through shared data values?

A

Relational databases

119
Q

What is a characteristic or property of the entity that will be stored?

A

Attribute (Column Name)

120
Q

What refers to storing information about an object?

A

Entity (Table Name)

121
Q

What are the top ten proactive controls?

A
  • Define security requirements
  • Leverage security frameworks and libraries
  • Secure database access
  • Encode and escape data
  • Validate all inputs
  • Implement digital identity
  • Enforce access controls
  • Protect data everywhere
  • Implement security logging and monitoring
  • Handle all errors and exceptions
122
Q

What is derived from industry standards, applicable laws, & vulnerability history?

A

Security requirements

123
Q

What is guarding against security-related design & implementation flaws?

A

Leveraging security frameworks and libraries

124
Q

What is securing data stores including queries, configuration, authentication, & communication?

A

Securing database access

125
Q

What are defensive techniques meant to stop injection attacks?

A

Encode and escape data

126
Q

What is a programming technique that ensures only properly formatted data may enter a software system component?

A

Input validation

127
Q

What is a name for using authentication and session management?

A

Implementing digital identity

128
Q

What is a name for granting or denying specific requests from a user, program or process?

A

Enforcing access controls

129
Q

What is another name for protecting sensitive data?

A

Protect data everywhere

130
Q

What are the two parts of security logging?

A

Log and monitor the logs

131
Q

What is a name for allowing an application to respond to errors correctly?

A

Handle all errors and exception

132
Q

What are the six AF cyber weapon systems?

A
  • Cyber Command & Control Mission System (C3MS)
  • AF Cyber Security and Control System (CSCS)
  • AF Intranet Control (AFINC)
  • AF Cyberspace Defense (ACD)
  • Cyberspace Defense Analysis
  • Cyberspace Vulnerability Assessment/Hunter (CVA/H)
133
Q

What provides 24/7/365 awareness, management, & control of the AF domain?

A

Cyber Command & Control Mission System (C2MS)

134
Q

What provides 24/7/365 NetOps & management functions enabling enterprise services within AF unclassified & classified networks?

A

AF Cyber Security and Control System (CSCS)

135
Q

What manages top-level boundary & entry point into the AFIN and controls flow of all external & inter-base traffic through 16 gateways?

A

AF Intranet Control (AFINC)

136
Q

What prevents, detects, responds to, & provides forensics of intrusions intro unclassified & classified AF networks?

A

Af Cyberspace Defense (ACD)

137
Q

What executes vulnerability, compliance, pen-testing & Hunter missions on AF & DoD networks & systems and performs defensive sorties world-wide via remote or on-site access?

A

Cyberspace Vulnerability Assessment/Hunter (CVA/H)

138
Q

What characterizes and then eliminates threats for the purpose of mission assurance?

A

Hunter ops

139
Q

What are the delivery vector categories?

A
  1. Reconnaissance
  2. Authorized User
  3. Social Engineering
  4. Configuration Management
  5. Software Flaw
  6. Transitive Trust
  7. Resource Exhaustion
  8. Physical Access
  9. Other
  10. Unknown
140
Q

What are the sub categories of delivery vector category 1?

A

A. Information gathering & data mining
B. Network scan
C. System scan

141
Q

What are the sub categories of delivery vector category 2?

A

A. Purposeful
B. Accidental

142
Q

What are the sub categories of delivery vector category 3?

A

A. E-mail
B. Website
C. Other

143
Q

What are the sub categories of delivery vector category 4?

A

A. Network
B. OS
C. App

144
Q

What are the sub categories of delivery vector category 5?

A

A. Exploited new vulnerability
B. Exploited known vulnerability

145
Q

What are the sub categories of delivery vector category 6?

A

A. Other IS compromise
B. Masquerading

146
Q

What are the sub categories of delivery vector category 7?

A

A. Non-distributed network activity
B. Distributed network activity

147
Q

What are the sub categories of delivery vector category 8?

A

A. Mishandled or lost resource
B. Local access to system
C. Abuse of resources

148
Q

What are the sub categories of delivery vector category 9?

A

A. New delivery vector

149
Q

What are the sub categories of delivery vector category 10?

A

A. Unable to determine

150
Q

What provides operational level C2 & situational awareness of AF cyberspace forces, networks & mission systems?

A

Cyber Command & Control Mission System (C3MS)

151
Q

What are the major sub-components of C3MS?

A
  1. Situational Awareness (SA)
  2. Intelligence, Surveillance & Reconnaissance (ISR)
  3. Planning
  4. Execution
  5. Integration
152
Q

What provides 24/7/365 network ops & management functions by enabling key enterprise services within AF unclassified & classified networks and supports DCO within those networks?

A

Cyberspace Security and Control System (CSCS)

153
Q

What are the major subcomponents of CSCS?

A
  1. DoDIN Ops & Management
  2. Enterprise Services
154
Q

What consists of two Integrated Management Suites (IMS)?

A

AF Intranet Control

155
Q

What are the sub discipline areas of AFINC?

A
  1. Defense in depth
  2. Situational awareness
  3. Proactive defense
  4. Network standardization
156
Q

What are the sub-discipline areas of ACF?

A
  1. Incident prevention
  2. Incident detection
  3. Incident response
  4. Computer forensics
157
Q

What are the sub-discipline areas of CDA?

A
  1. Telephony
  2. Radio frequency
  3. Email
  4. Internet based capabilities
  5. Cyberspace op risk assessment
  6. Web risk assessment
158
Q

What are the sub components of CVA/H?

A
  1. Mobile Interceptor Platform (MIP)
  2. Deployable Interceptor Platform (DIP)
  3. Garrison Interceptor Platform (GIP)
  4. Information Ops Platform (IOP) Flyaway Kit
159
Q

What is a collection of computing environments (includes personnel & physical security) connected by one or more internal networks under the control of a single authority?

160
Q

What is the name for the AF network used to change unclassified information and provides users access to the Internet, email, file storage, etc?

161
Q

What is the largest private network in the world, is comprised of routers and nodes owned by the US DoD, and is part of the Defense Information System Network (DISN)?

162
Q

What is the name of the private US IP network used to exchange secret information and provides access to the DoDs classified intranet services?

163
Q

What is comprised of routers and nodes owned by the US DoD but is also used by the US Department of State?

164
Q

What are the DCO Tactical Mission Types?

A
  • Surveillance
  • Reconnaissance
  • Access
  • Strike
  • Escort
  • Strike Coordination and Reconnaissance (SCAR)
    -Secure
  • Threat emulation
165
Q

What mission type has the object of collecting relevant data & information in/on the AO?

A

Surveillance

166
Q

What are some tasks that could be part of a surveillance mission?

A
  • Collect/monitor network infrastructure status, changes, trends & events
  • Collect/monitor network user characteristics & trends
  • Collect/monitor data from individual system(s)
167
Q

What mission type has the objective of collecting relevant data & information on threats within the AO?

A

Reconnaissance

168
Q

What are some tasks that could be part of a reconnaissance mission?

A
  • Find & track specified enemies, adversaries, & threats in the cyber
    terrain
  • Understand & characterize specified enemies, adversaries, & threats in the assigned AO
169
Q

What mission type has the objective of providing sufficient access for support cyber forces?

170
Q

What are some tasks that could be part of an access mission?

A
  • Configuring firewall rules and/or policies
  • Routing configuration changes
  • Provisioning/configuring accounts
  • Configuring permission(s)
171
Q

What mission type has the object of damaging or destroying an objective or a capability?

172
Q

What are some tasks that could be part of a strike mission?

A
  • Destroying resident adversary/malicious code or other artifacts in
    assigned AO
  • Quarantining malicious code and/or preventing code execution
  • Manipulating, denying, degrading, or disrupting adversary network traffic
173
Q

What mission type has an objective of providing defensive support to cyber weapon systems or mission partners conducting primary missions in the AO?

174
Q

What are some tasks that could be part of an escort mission?

A
  • Deploying countermeasures
  • Ensuring all required forces have the necessary level of access to assigned AO during the mission vulnerability window
175
Q

What mission type has an objective of conducting strike coordination and reconnaissance in response to adversary activity within the AO?

176
Q

What are some tasks that could be part of a SCAR mission?

A
  • Patrolling the AO, or a portion of the AO
  • Conduct or support strike and/or follow-on Intelligence Preparation of the Environment (IPOE) missions
177
Q

What mission type has an objective of enhancing the defenses of the assigned AO in response to active threats?

178
Q

What are some tasks that could be part of a secure mission?

A
  • Enhancing the defenses of cyber key terrain
  • Reconfiguring network appliances to a more secure configuration in response to active threats
179
Q

What mission type has an objective of replicating realistic TTPs of specific cyber threats to evaluate cyber defenses?

A

Threat emulation

180
Q

What are some tasks that could be part of a threat emulation mission?

A
  • Emulate known adversary TTP
  • Identify unmitigated vulnerabilities
  • Assesses defensive posture and processes
181
Q

What units operate the CDA?

A
  • 68th Network Warfare Sq out of JBSA, TX
  • 860th Network Warfare Flt out of Offutt AFB, NE
182
Q

What units operate the ACD?

A

33rd Network Warfare Sq out of JBSA, TX

183
Q

What units operate the AFINC?

A

26th Network Ops Sq out of Gunter Annex, AL

184
Q

What units operate the CSCS?

A
  • 83rd Network Ops Sq out of JBLE, VA
  • 561st Network Ops Sq out of Peterson AFB, CO
  • 690 Cyberspace Ops Sq out of JBPHH, HI
  • 691st Cyberspace Ops Sq out of Ramstein Air Base, Germany
185
Q

What units operate C3MS?

A

616th Ops Center out of JBSA, TX

186
Q

What is a worldwide collection of interconnected public telephone networks that are circuit switched to allow users to make landline calls?

A

Public Switch Telephone Networks (PSTN)

187
Q

What are able to deliver voice communications & multimedia over the internet and are packet-switched networks allowing users to make calls?

A

Voice over Internet Protocol (VoIP)

188
Q

What is world wide non-secure voice, secure voice, data, facsimile, & video teleconferencing services for DoD C2 elements and assures non-blocking services for users with flash & flash override precedence capabilities?

A

Defense Switched Network (DSN)

189
Q

What are communication networks with last link being wireless and able to connect to PSTN & Internet?

A

Cellular Networks

190
Q

What are some vulnerabilities of Public Switched Telephone Networks (PSTN)?

A
  • Phreaking
  • War dialing
  • Dialup modems
191
Q

What are some vulnerabilities of Voice over Internet Protocol (VoIP)?

A
  • Registration hijacking
  • Session initiation protocol attack vectors
192
Q

What are some vulnerabilities of cellular networks?

A
  • Tower hijacking
  • Generic computer exploits
193
Q

What is reverse engineering the system tones used to route long-distance calls for free calls?

194
Q

What is a technique to automatically scan a list of telephone number to search for modems?

A

War dialing

195
Q

What is an overlooked “backdoor” through a
PSTN into another IT network used by admins to remote into Control System equipment?

A

Dialup modems

196
Q

What is rogue device which registers as the registration server by impersonating a valid user?

A

Registration server hijacking

197
Q

What are Session Initiation Protocol (SIP) attack vectors?

A
  • Enumeration
  • Fuzzing
  • Man-in-the-Middle
198
Q

What is enumeration?

A

Means to ID SIP systems

199
Q

What is a type of DoS attack used to send malformed data packets to crash the SIP system?

200
Q

What is it called when an attacked intercepts SIP call-signaling traffic, masquerades as the calling & the called parties, and hijacks calls via redirection server?

A

Man-in-the-middle

201
Q

What is it called when an attacker ID’s bug in base transceiver station software services, exploits vulnerabilities and takes over the tower transceiver

A

Tower Hijacking

202
Q

What is it called when incorrect system permission settings grant great access to other areas in the device or there are exposed internal communication protocols that pass messages internally within the device to itself or to other apps?

A

Mobile device software?

203
Q

What connects to multiple class 4 and 5 offices and a class 1 (regional center) office?

A

Class 4 (toll office)

204
Q

What connects to class 4 and 5 offices and is the only office that connects to individual or business subscribers?

A

Class 5 (end office)

205
Q

What is the physical connection between a carrier’s class 5 and the subscribers’ premises?

A

Local loop (“Last Mile”)

206
Q

What is the telephone exchange, typically owned by the customer, where calls are made at no cost?

A

Private Branch Exchange (PBX)

207
Q

What uses VoIP technologies allowing telephone calls to be made over an IP network?

A

IP phone/softphone (Skype)

208
Q

What is the entity that receives registrations from a UAC (User Client Access/User Agent Client) and extracts info about current location and stores it?

A

Registration server

209
Q

What forwards requests on behalf of the endpoint by consulting the register and handles the Session Initiation Protocol (SIP) requests of the user agent?

A

Proxy Server

210
Q

What accepts a request, maps the address of the called party or more addresses & returns to the client but does not pass the request on to other servers?

A

Redirect server

211
Q

What provides consolidated services and sets up & monitors calls, maintains the dial plan, and performs phone number translations?

A

Call manager

212
Q

What is the interfacing IP network based voice communications w/ traditional circuit-switched networks?

A

Media gateway

213
Q

What routes calls to other nodal switches and is a multifunction switch?

A

DSN backbone switches

214
Q

What is the name for switches at bases, posts, camps & stations?

A

Installation switches

215
Q

What is the primary switch for long distance services for either an installation or group of installations in a geographic area?

A

End Office (EO)

216
Q

What switch serves as the primary switch, is used at smaller DoD installations and will not service installation with critical missions?

A

Small End Office (SMEO)

217
Q

What are switches with Multilevel Precendences & Preemption (MLPP) capabilities?

A

Private Base Exchange 1 (PBX-1)

218
Q

Which type of Private Branch Exchange does not have MLPP capabilities?

219
Q

What has a switching capability that is connected to a host as a remote and is dependent on the host switch for software control?

A

Remote Switch Unit (RSU)

220
Q

What is considered the “Radio Tower” with “RF”?

A

Base Transceiver Station (BTS)

221
Q

What controls one or more BTS (“Radio Towers”) and can be thought of as a cell?

A

Base Station Controller (BSC)

222
Q

What acts like a PTSN Local Loop for cellular networks and combines the BTS & BSC?

A

Base Station System (BSS)

223
Q

What is considered the PTSN Central Office but for cellular networks and each carrier in each city runs one office?

A

Mobile Telephone Switching Office (MTSO)

224
Q

What represents an area within which a diverted Regional Bell Operating Company (RBOC) is permitted to offer exchange telecommunications & exchange access services?

A

Local Access & Transport (LATA)

225
Q

What is a system used to direct telephone calls to a particular region and provides a telephone numbering scheme?

A

North American Numbering Plan (NANP)

226
Q

What is used for call set up (INVITE) & terminate/call transfer (BYE), uses two types of messages (requests & responses), leverages port 5060, and is similar to the TCP three-way handshake except with more steps?

227
Q

What is a media protocol that describes the packet format for the actual data?

A

Realtime Transport Protocol (RTP)

228
Q

What is the workload standard for cellular networks and uses subscriber Id module (SIM) cards for different service providers in different countries?

A

Global System for Mobile Communication (GSM)

229
Q

What is an American standard which assigns each call a certain portion of time on a designated frequency?

A

Time Division Multiplexing (TDMA)

230
Q

Which is an American standard which gives a unique code to each call and spreads it over the available frequencies?

A

Code Division Multiple Access (CDMA)

231
Q

What are the different network data technologies?

A
  • 1G
  • 2G
  • 3G
  • 4G
  • 5G
232
Q

What are the different types of Public Switched Telephone Networks (PSTN) security?

A
  • Physical security
  • Network security
233
Q

What are the different types of Voice over Internet Protocol (VoIP) security?

A
  • Physical security
  • Layer-2 network segregation
  • Layer-3 address segregation
234
Q

What are the different methods to encrypt VoIP?

A
  • Voice over Secure IP (VoSIP)
  • Secure VoIP (SVoIP)
  • Secure Voice over Secure IP (SVoSIP)
235
Q

What are the different types of cellular network security?

A
  • Physical security
  • Mobile device
    • Patch Management
    • Treat it like a computer
    • Encryption
    • Two-factor Authentication
236
Q

What is a general term that encompasses several types of control systems?

A

Industrial Control System (ICS)

237
Q

What is a computerized system that is capable of gathering & processing data & applying operational controls over long distances?

A

Supervisory Control & Data Acquisition (SCADA)

238
Q

What is it called when control is achieved by intelligence that is distributed about the process to be controlled?

A

Distributed Control System (DCS)

239
Q

What are the ICS industrial sectors?

A

Manufacturing and distribution industries

240
Q

What are the different ways the manufacturing industry can be divided?

A

Process based and discrete based

241
Q

What are the different ways a process based industry can be divided?

A

A continuous manufacturing process or a batch manufacturing process

242
Q

What is run continuously, often w/ transitions for different grades of a product?

A

A continuous manufacturing process

243
Q

What manufacturing process is divided into distinct processing steps?

A

A batch manufacturing process

244
Q

What process is a series of steps on a single device to create an end product?

A

Discrete based

245
Q

What is used to control geographically dispersed assets?

A

A distribution industry

246
Q

What is similar between manufacturing and distribution systems?

A

Control systems

247
Q

What systems are usually located within a confined area?

A

Manufacturing systems

248
Q

What systems are spread over large areas?

A

Distribution systems

249
Q

What are multiple, independent systems combined to form larger more complex systems called?

A

System of systems

250
Q

What are some features of critical infrastructure?

A
  • System of systems
  • Interconnected and mutually dependent in complex ways
251
Q

What uses sensors, actuators, and controllers to manipulate some controlled process?

A

Control loops

252
Q

How does the control loop process work?

A
  • Sensors measure a physical property and sends info to controllers
  • Controllers interprets the signals and generates corresponding variables based on algorithms and target set points
    Actuators (e.g. valves, switches, and motors) directly manipulate the controlled process based on commands sent by the controller
253
Q

What is used by operators/engineers to monitor & configure elements of the controllers & actuators and displays process status information & historical information?

A

Human-machine Interface (HMI)

254
Q

What are used to prevent, identify, & recover from abnormal operation or failures?

A

Remote diagnostics

255
Q

What are the different design considerations?

A
  • Control Timing Requirements
  • Geographic Distribution
    ‐ Hierarchy
    ‐ Control Complexity
    ‐ Availability
    ‐ Impact of Failures
    ‐ Safety
256
Q

What has a wide range of requirements, humans might not be reliable or consistent enough, and systems might require computation to take place as close to the sensor as possible?

A

Control timing requirements

257
Q

What has varying degrees of distribution?

A

Geographic distribution

258
Q

What allows human operators to have a comprehensive view?

259
Q

What drives some systems to require more than just controllers and preset algorithms?

A

Control complexity

260
Q

What requires more redundancy?

A

Systems with high availability requirements and high impact of failure

261
Q

What are some safety considerations?

A
  • Systems need ability to detect unsafe conditions
  • Take actions to reduce those conditions
  • Human oversight in safety critical operations
262
Q

What is used to control dispersed assets where centralized data acquisition is as important as control, is designed to collect field information, transfer it to a central computer facility & display the information to the operator so they can monitor or control an entire system?

A

Supervisory Control and Data Acquisition (SCADA)

263
Q

What is the typical hardware in a SCADA system?

A
  • Control center
  • Communications equipment
  • Remote terminal units (RTUs)
  • Programmable Logic Controllers (PLC)
264
Q

What is used to control production systems within the same geographic region and is usually process control or discrete part control systems?

A

Distributed Control Systems (DCS)

265
Q

What is implemented as the primary controller in smaller control system configurations to provide operational control of a discrete process and generally lacks a central control server & HMI?

A

Programmable Logic Controller (PLC)

266
Q

What controls the physical world?

A

ICS systems

267
Q

What manages data?

A

IT systems

268
Q

What are the similarities and differences between ICS systems and IT systems?

A
  • Different risks & priorities
    • Risk to health & safety, damage to environment, financial loss
      ‐ Different performance & reliability requirements
      ‐ May use OSs & Apps that may be considered unconventional in a typical IT network
269
Q

What are some different components of Security Architecture?

A

‐ Network Segmentation & Segregation
‐ BoundaryProtection
‐ Firewalls
‐ Logically Separated Control Network
‐ NetworkSegregation
‐ Recommended Defense-in-Depth Architecture
‐ General Firewall Policies for ICS
‐ Recommended Firewall Rules
‐ Specific ICS Firewall Issues

270
Q

What is one of the most effective architectural concepts to protect ICS?

A

Network segmentation & segregation

271
Q

What are the different methods for network segmentation & segregation?

A
  • Logical network separation (VLANs, VPNs, unidirectional gateways)
  • Physical network separation
  • Network traffic filtering (IP/route based, restrict based on function, port/protocol filtering, application filtering)
272
Q

What are key to enforcement of security policies, can be used to isolate ICS & enterprise components, and includes gateways, routers, firewalls, IDS, etc?

A

Boundary protection

273
Q

What controls flow of traffic between networks employing differing security postures and is most often deployed between ICS and enterprise networks?

274
Q

What are some special considerations with firewalls?

A
  • Possible addition of delay to control system communications
  • Lack of experience in the design of rule sets suitable for ICS
275
Q

At a minimum how should ICS be separated from enterprise networks?

A

Logically separated

276
Q

What can enhance security using different architectures and lead to the rule that no system should be dual-NIC’d?

A

Network segregation

277
Q

What is it called when overlapping security mechanisms are used?

A

Defense in depth

278
Q

What are the best practices for general firewall policies?

A

‐ The base rule set should be deny all, permit none
‐ All “permit” rules should be both IP address and TCP/UDP port specific
‐ All rules should restrict traffic to a specific IP address or range of addresses

279
Q

What are some recommended firewall rules?

A
  • In most cases there is little reason to allow DNS requests out of the control network to the corporate network and no reason to allow DNS requests into the control network
  • HTTP should not be allowed to cross from the public/corporate to the control network
  • All TFTP communications should be blocked, while FTP communications should be allowed for outbound sessions only
  • Use SSH over Telnet
280
Q

What are specific ICS firewall issues?

A
  • Data Historians
  • Remote Support Access
  • Multicast Traffic
  • Unidirectional Gateways
  • Single Points of Failure
  • Redundancy and Fault Tolerance
  • Preventing Man-in-the-Middle Attacks
  • Authentication & Authorization
  • Monitoring, Logging, and Auditing
  • Incident Detection, Response, & System Recovery
281
Q

What was introduced because of incomplete, inappropriate, or nonexistent security policy?

A

Policy & procedure and predisposing conditions

282
Q

What can occur in hardware, firmware, software, and large complex systems and networks?

A

System and predisposing conditions

283
Q

What are some possible sources for system and predisposing conditions?

A
  • Design Flaws
  • Development Flaws
  • Misconfigurations
  • Poor Maintenance
  • Poor Administration
  • Connections with other systems & networks
284
Q

What are some examples of adversarial incidents?

A

‐ Denial of Control Action
‐ Control Devices Reprogrammed
‐ Spoofed System Status Information
‐ Control Logic Manipulation
‐ Safety Systems Modified
‐ Malware on Control Systems

CWO Block 7 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions