Udemy Exam 2 Flashcards

Question

Which of the following will an adversary so during the installation phase of the Lockheed Martin kill chain? (SELECT FOUR) "Time stomp" on a malware file to appear as if it is part of the operating system Collect user credentials Install a webshell on a server Open two-way communications channel to an established C2 infrastructure Create a point of presence by adding services, scheduled tasks, or AutoRun keys Install a backdoor/implant on a client victim

Answer 1

During the installation phase, the adversary is taking actions to establish a footprint on the target system and is attempting to make it difficult for a defender to detect their presence. The attack may also attempt to confuse any attempts to remove the adversary from the system if the detection of their presence occurs. Due to this, an attacker will attempt to install multiple backdoors, implants, web shells, scheduled tasks, services, or AutoRun keys to maintain their access to the target. "Time stomping" I also conducted to hide the presence of malware on the system. Opening up two-way communication with an established C2 infrastructure occurs in the command and control phase. Collecting user credentials occurs in the actions on objectives phase.

Answer 2

LDAP can be used for single sign-on but is not a shared authentication protocol. OpenID, OAuth, and Facebook Connect are all shared authentication protocols. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. OAuth is designed to facilitate the sharing of information (resources) within a user profile between sites.

Answer 3

This question tests your ability to determine if an IP address is a publicly routable IP (external connection) or private IP (internal connection). During your CompTIA A+, Network+, and Security+ studies, you should have learned that private IP addresses are either 10.x.x.x, 172.16-31.x.x, or 192.168.x.x. All other IP addresses are considered publicly routable over the internet (except localhost and APIPA addresses). Therefore, the answer must be 192.186.1.100 since it is not a private IP address.

Answer 4

It is common for attackers to log in remotely using the ssh service and the root or other user accounts. The best way to protect your server is to disable password authentication over ssh. Since your company just enabled key-based authentication on the SSH server, all legitimate users should be logging in using their RSA key pair on their client machines, not usernames and passwords. Based on the logs, you see the server is running SSHv2, so there is no need to disable SSHv1 (it may already be disabled). You don't want to fully disable remote root SSH logins, either, since this would make it difficult for administrators to conduct their work. Finally, based on the logs, it doesn't appear that anonymous SSH logins are an issue, either, as we don't see any anonymous attempts in the logs.

Answer 5

You should first request a copy of one of the spam messages, including the full email header. By reading through the full headers of one of the messages, you can determine where the email originated from, whether it was from your email system or external, and if it was a spoofed email or a legitimate email. Once this information has been analyzed, you can then continue your analysis based on those findings, whether that be analyzing your email server, the firewalls, or other areas of concern. If enough information cannot be found by analyzing the email headers, you will need to conduct more research to determine the best method to solve the underlying problem.

Answer 6

Encrypting data in transit leads to more integrity and confidentiality of the data, and therefore trust. Hashing files using MD5 to check against known valid checksums would provide integrity, and therefore validation and trust. Implementing a file integrity monitoring program, such as Tripwire, would also improve data validation and trust. Decrypting data at rest does not improve data validation, or trust since the data at rest could be modified when decrypted.

Answer 7

While there are many different formats used by attackers to obfuscate their malicious code, Base64 is by far the most popular. If you see a string like the one above, you can decode it using an online Base64 decoder. In fact, I recommend you copy the string above and decode it to see how easy it is to reverse a standard Base64 encoded message. Some more advanced attackers will also use XOR and a key shift in combination with Base64 to encode the message and make it harder to decode, but using a tool like CyberChef can help you decode those. Structured Query Language (SQL) is used to communicate with a database. Extensible Markup Language (XML) is a markup language that defines a set of rules for encoding documents in a human-readable and machine-readable format. SQL and XML are not considered obfuscation techniques. A QR Code is a two-dimensional version of the barcode, known from product packaging in the supermarket. QR coding is the process of converting some data into a single QR code. QR coding might be considered a form of obfuscation, but it is not shown in this question's example output.

Answer 8

When collecting evidence, you should always follow the order of volatility. This will allow you to collect the most volatile evidence (most likely to change) first and the least volatile (least likely to change) last. You should always begin collecting the CPU registers and cache memory (L1/L2/L3/GPU). The contents of system memory (RAM), including a routing table, ARP cache, process tables, kernel statistics, and temporary file systems/swap space/virtual memory. Next, you would move onto the collection of data storage devices like hard drives, SSDs, and flash memory devices. After that, you would move onto less volatile data such as backup tapes, external media devices (hard drives, DVDs, etc.), and even configuration data or network diagrams.

Answer 9

When you have a limited amount of hardware resources to utilize but have a requirement to test multiple operating systems, you should set up a virtualized environment to test the patch across each operating system before deployment. You should never deploy patches directly into production without testing them first in the lab.

Answer 10

The dd command is used in forensic data acquisition to forensically create a bit by bit copy of a hard drive to a disk image. The bs operator sets the block size when using the Linux dd command. This question may seem beyond the scope of the exam. Still, the objectives allow for "other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered" in the objectives' bulletized lists. The exam tests the equivalent of 4 years of hands-on experience in a technical cybersecurity job role. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination's content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don't let questions like this throw you off on test day. If you aren't sure, take your best guess and move on!

Answer 11

This is a post request to run the "cat /etc/passwd" command from an outside source. It is not known from the evidence provided if this command were successful or not, but it should be analyzed further as this is not what would be expected, normal traffic. While the browser's default language was configured for Chinese (zh), this is easily changed and cannot be used to draw authoritative conclusions about the threat actor's true location or persona. The User-Agent used is listed as Mozilla, which is used by both Firefox and Google Chrome. For an in-depth analysis of the full attack this code snippet was taken from, please visit https://www.rsa.com/content/dam/en/solution-brief/asoc-threat-solution-series-webshells.pdf. This 6-page article is definitely worth your time to look over and learn how a remote access web shell is used as an exploit.

Answer 12

Any organization that processes a credit card will be required to work with their credit card processor instead of working directly with the card issuers (Visa and Mastercard). Conducting notification to your bank or credit card processor is one of the first steps in the incident response effort for a breach of this type of data. Typically, law enforcement does not have to be notified of a data breach at a commercial organization.

Answer 13

Policies are formalized statements that apply to a specific area or task. Policies are mandatory, and employees who violate a policy may be disciplined. Guidelines are general, non-mandatory recommendations. Best practices are considered procedures that are accepted as being correct or most effective but are not mandatory to be followed. Configuration settings from the prior system could be helpful, but this is not a mandatory compliance area like a policy. Therefore, Jay should first follow the policy before the other three options if there is a conflict.

Answer 14

FTP cannot be used to conduct a banner grab. A cybersecurity analyst or penetration tester uses a banner grab to gain information about a computer system on a network and the services running on its open ports. Administrators can use this to take inventory of the systems and services on their network. This is commonly done using telnet, wget, or netcat.

Answer 15

Risk score provides a numeric representation of the potential impact of a vulnerability, taking into account factors such as severity, ease of exploitation, and potential harm. This can help prioritize remediation efforts. While patch availability is an important factor in the remediation process, it does not help prioritize which vulnerabilities should be addressed first. The age of a vulnerability is not the primary factor for the prioritization of remediation efforts. The reputation of the vendor is not typically a key consideration in prioritizing vulnerabilities for remediation.

Answer 16

The evidence section typically contains all detailed information, data, and artifacts related to the incident, supporting the claims and conclusions made in the executive summary. The executive summary is meant to provide a high-level overview of the incident, and while it should be accurate, it typically does not include detailed evidence. Public relations communications are intended for external stakeholders and are not typically used for providing detailed evidence related to an incident. Regulatory reporting is focused on providing information to regulatory bodies and usually does not include detailed evidence supporting an executive summary.

Answer 17

This involves determining who needs to be aware of the incident and making sure they receive appropriate information about it. This refers to the process of officially recognizing an incident and escalating it through the organization's hierarchy for response, not communicating the incident to all stakeholders. This refers to the process of determining the primary cause(s) of an incident, not communicating about the incident to stakeholders. While this may include communication to some stakeholders, it primarily refers to the process of documenting and analyzing an incident, not the overall communication process.

Answer 18

The mean time to respond is a key metric that measures the average time taken to initiate a response after a security incident has been detected. The mean time to detect refers to the average time it takes to discover a security incident, not the time it takes to initiate a response to it. The mean time to remediate measures how long it takes to resolve a security incident after it has been detected, not the time it takes to initiate the response. The alert volume measures the number of alerts generated by your security systems, not the time taken to initiate a response to a security incident.

Answer 19

In this scenario, the corporation is conducting a forensic analysis, which is a detailed and systematic examination of an incident to understand its origin, extent, and impact. Root cause analysis is a method used to identify the primary cause or causes of an incident. Although this may be part of the overall process, the scenario specifically mentions a detailed and systematic examination, which aligns more with forensic analysis. Lessons learned is the process of reflecting on a completed incident to identify what was done well and what needs improvement for future incidents. While it's a part of post-incident activity, it's not the specific activity described in this scenario. An incident response plan is a set of procedures and processes to handle and manage an incident effectively. Although a plan likely guides their steps, the specific activity described here is forensic analysis.