Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-294 IT & DATA ASSURANCE > Test 1 > Flashcards

Test 1 Flashcards

Pass

1
Q

What are the four use cases for the MITRE ATT&CK Framework?

A

Threat intelligence

Detection
and analysis

Adversary emulation
and red teaming

Assessment and engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How many levels of maturity are associated with each use case of the MITRE ATT&CK Framework?

If you worked for a small- to medium-sized business, which of the maturity levels of MITRE ATT&CK Framework
would you more than likely implement and why

A

3 levels of maturity.

For a small to medium
sized business you should consider levels 1 to 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the ATT&CK Navigator?

A

It helps do annotation and navigation for different attack techniques.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Tools such as Sysmon, Windows Event Logs and EDR platforms can be used to perform what type of defensive actions?

A

Process command line, file, and registry monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Adversary Emulation? How does it differ from a Purple Team engagement?

A

Trying to evade your created analytics by executing the types of attacks and evasions that we know adversaries use in the real world.

Purple Teaming involves a back and forth between red team and the developers to try and update the analytic to seek different ways to stay safe from a certain attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Atomic Red Team project?

A

An open source project that provides red team content that aligns with ATT&CK that can be
used to test analytics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the Pyramid of Pain?

A

The Pyramid of Pain defines levels of indicators, each escalating in difficulty for adversaries to alter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the six levels of the Pyramid of Pain? Which is the most difficult to defend against.

A

TTPs
Tools
Network/Host Artifacts
Domain names
IP address
Hash Values
The most difficult to detect and protect against are TTPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What pentest requires you to act like an insider?

A

Internal penetration test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an external pentest?

A

Simulate an attack via the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a white hat hacker?

A

An individual who uses hacking skills to identify security vulnerabilities in hardware, software or networks. Does so with respect of the law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a black hat hacker?

A

A black hat is a computer hacker who violates laws or ethical standards for nefarious purposes, such as cybercrime, cyberwarfare, or malice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a greyhat hacker?

A

A computer hacker who may sometimes violate laws or typical ethical standards, but usually does not have the malicious intent typical of a black hat hacker.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a red team?

A

Ethical hackers who are authorized by an organization to emulate real attackers’ tactics, techniques and procedures (TTPs) against your own systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a blue team?

A

The group responsible for defending an enterprise’s use of information systems by maintaining its security posture against a group of mock attackers (i.e., the Red Team).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a purple team?

A

An org is attacked and defended multiple types, strengthening an org’s defense with defense.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Netcraft and what do they offer?

A

Netcraft is a company that logs the uptime of websites and makes queries about the underlying software.
IE… When a website was first seen, how it was registered, and What OS and server it is running.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Whois?

A

Gives information about a website like the owner, register, address of registrar and register.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Nslookup?

A

Provides IP’s and addresses, can also be used to search for mail servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is theHarvester?

A

theHarvester searches Google, bing, to find email addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the phases of the COMPTIA penetration testing process?

A

Planning and Scoping (asking the client about the rules of the engagement (subnets, systems))

Information Gathering (When engagement is stared, what relevant info can be gathered about the target organization to make them easier to attack)

Vulnerability Identification (What services are running on open ports and can we take advantage of them)

Attacking and Exploiting (How can access be gained using the vulnerabilities discovered)

Reporting and Communication results (Showing the client gaps in their security and helping them understand what is wrong and how to correct it)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a vulnerability assessment?

A

Gathers data from public resources and various tools to identify open ports and identify potential vulnerabilities that can be exploited.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a risk assessment?

A

An assessment of an organization’s ability to protect its information and information systems from cyber threats.

24
Q

What are the phases of the Attacker Methodolgy?

A

Reconnaissance

Scanning and Enumeration

Exploitation & Gaining Access

Maintaining Access & Covering Tracks

25
Q

What is OSINT?

A

Open Source Intelligence, used to gather as much relevant information about a target organization.

Typically uses free resources but can include searched of Deep Web and Dark Web content.

Used during the Reconnaissance phase of the attacker methodology.

26
Q

What is CherryTree?

A

An application used to organize screenshots taken while exploiting machines.

27
Q

What is being looked for during Reconnaissance?

A

Domain Names
Subnets, IP’s
Email Addresses
Physical Locations
Employee Names
Social media accounts

28
Q

What is google dorking?

A

Involves using operators in the Google search engine to locate specific sections of text on websites that are evidence of vulnerabilities or findings of interest.

29
Q

What is nmap and what are some common switches?

A

Nmap is an application used for port scanning.

SYN Scan -sS

UDP scan -sU

Output results -o

Service Scan -sV

Script Scan -sC

TCP Scan -sT

No ping -Pn

30
Q

What are the phases of ATT&CK?

A

PRE-ATT&CK consists of Recon and Weaponize

ATT&CK for Enterprise consists of
Deliver
Exploit
Control
Execute
Maintain

31
Q

What are tactics in terms of ATT&CK?

A

Details the approach by a specific threat actor at each phase of an attack.

32
Q

What are the 12 tactics of ATT&CK?

A

Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Exfiltration
Command & Control
Impact

33
Q

What are techniques

A
34
Q

John is conducting a pen test, during he finds a number of credentials for the institution from a data breach website and tries to login. What is this called?

A

Credential stuffing

35
Q

Burp Suite is the most commonly used tool to conduct what specific type of pen testing?

A

Web application testing

36
Q

What is DNSlytics?

A

DNSlytics is used to access main components of OSINT analysis including WHOIS records, along with ASN (autonomous system number), IP subnets and domain enumeration.

Can perform Reverse IP Lookup.

37
Q

DNSdumpster?

A

Used to enumerate hosts, subdomains and ASNs associated with a domain

38
Q

Shodan?

A

Can be used to search across the Internet for systems, open ports and vulnerabilities based on search terms

39
Q

builtwith.com ?

A

Enumerates the different components used to build a specific website

40
Q

bgp.he.net ?

A

Enumeration based on Autonomous System Numbers (ASNs) used in BGP routing

41
Q

netcraft.com

A

Used to view a profile of particular sites

42
Q

SpiderFoot?

A

Written by Steve Micallef (@binarypool), SpiderFoot takes an automated “shotgun” approach to gathering as much OSINT information about a target.

43
Q

Recon-ng

A

Written by Tim Tomes (@lanmaster53), recon-ng works as a framework to assist with the OSINT gathering process in a “scalpel” version (vs SpiderFoot “shotgun”)

44
Q

STIX (Structured Threat Information Expression) ?

A

Designed as a structured language to be used for effectively sharing cyber security intelligence data related to a threat, focused on sharing “high fidelity” information.

45
Q

What is Cyber Threat Intelligence?

A

Provides context to data from a cyber security perspective, based primarily on Indicators of Compromise (IOCs) for detection of malicious activity.

46
Q

Grey box pentest?

A

The tester has access to the knowledge of a user, perhaps with elevated privileges. Allows testing of security inside the hardened perimeter and simulates an attacker with longer-term access to the network.

47
Q

Black box pentest?

A

The pentester is acting as if they are a true black hat hacker. Testers aren’t given any data that is not publicly available.

48
Q

Crystal box pentest?

A

Also called a white box pentest, testers are given full access to the source code, architecture, and even documentation of a system. They sift through that data and determine any potential points of weakness in the system.

49
Q

Reverse shell attack?

A

When an app is vulnerable to a remote code execution vulnerability, a threat actor can execute commands on the targets machine by making a shell session.

50
Q

buffer overflow attack?

A

Abusing the bounds of a programming language to input your own code onto a program or website.

51
Q

Cross-site scripting?

A

Also called a XSS attack, an attacker inject client-side scripts into web pages that are viewed by others. When another user visits the page the script is activated.

52
Q

Lateral movement attack?

A

Threat actor gains access to a device and then uses a shell to issue commands. The machine is compromised, reconnaissance, is used and then the threat actor gets what they came for.

53
Q

privilege escalation attacks?

A

A threat actor gains access to an employee’s account , bypasses authorization channels and is granted access to data.

Vertical is when an attacker gains access directly to an account with the intent to perform actions as that person.
Horizontal gains access to an account and then elevates their privileges.

54
Q

SQL injection attack?

A

An attacker sends malicious code into an SQL server, the server than reveals information that shouldn’t be seen.

55
Q

DNS tunneling?

A

Abuses the DNS protocol to tunnel malware and other data via a client-server model.

IST-294 IT & DATA ASSURANCE (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions