Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Udemy Sections 1-3: Overview, Malware, and Malware Infections > Flashcards

Udemy Sections 1-3: Overview, Malware, and Malware Infections Flashcards

1
Q

The act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction

A

Information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The act of protecting the systems that hold and process critical data

A

Information systems security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA stands for

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Information has not been disclosed to unauthorized people

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Information has not been modified or altered w/out proper authorization

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Information is able to be stored, accessed, or protected at all times

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When a person’s identity is established w/ proof and confirmed by a system

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AAA stands for

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

5 methods of authentication

A

Something you know
Something you have
Something you are
Something you do
Somewhere you are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Occurs when a user is given access to a certain piece of data or certain areas of a building

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Tracking of data, computer usage, and network resources

A

Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The most cost effective security control to use

A

User training

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Hackers who find and exploit vulnerabilities before anyone else does

A

Elite hackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Hackers with little to no skill who only use the tools and exploits written by others

A

Script kiddies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Hackers who are driven by a cause like social change, political agendas, or terrorism

A

Hacktivists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Hackers who are a part of a crime group that is well-funded and highly sophisticated

A

Organized crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Highly trained and funded groups of hackers (often by nation states) w/ covert and open-source intelligence at their disposal

A

APT (Advanced Persistent Threats)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Property of an intelligence source that ensures it is up-to-date

A

Timeliness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Property of an intelligence source that ensures it matches the use cases intended for it

A

Relevancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Property of an intelligence source that ensures it produces effective results

A

Accuracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Property of an intelligence source that ensures it produces qualified statements about reliability

A

Confidence levels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Threat intelligence that comes as a commercial service offering, where access to updates and research is subject to a subscription fee

A

Proprietary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data that is derived from the provider’s own research and analysis efforts, such as data from honeynets that they operate, plus information mined from its customers’ systems, suitably anonymized

A

Closed-source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Data that is available to use w/out a subscription, which may include threat feeds similar to the commercial providers, and may contain reputation lists and malware signature databases

A

Open-source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Knowledge you can write down, see, feel, and touch

A

Explicit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Knowledge gained from experience

A

Implicit knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A proactive cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring

A

Threat hunting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What must you assume when threat hunting?

A

That the existing rules you’ve put in place to prevent compromise have failed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion

A

Kill chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The 7 linear steps of the kill chain

A

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
C2 (command and control)
Actions on objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The kill chain step in which the attacker determines what methods to use to complete the phases of the attack

A

Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

The kill chain step in which the attacker couples payload code that will enable access w/ exploit code that will use a vulnerability to execute on the target system. The attacker is merely writing the code; it has not yet been delivered or executed.

A

Weaponization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The kill chain step in which the attacker identifies a vector by which to transmit the weaponized code to the target environment

A

Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The kill chain step in which the weaponized code is executed on the target system

A

Exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The kill chain step in which the mechanism enables the weaponized code to run a remote access tool and achieve persistence on the target system

A

Installation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

The kill chain step in which the weaponized code establishes an outbound channel to a remote server that can then be used to control the remote access tool and possibly download additional tools to progress the attack

A

C2 (command and control)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

The kill chain step in which the attacker typically uses the access they’ve achieved to covertly collect information from target systems and transfer it to a remote system (data exfiltration) or achieve other goals and motives

A

Actions on objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

A method used to identify a defensive course-of-action matrix to counter the progress of an attack at each stage

A

Kill chain analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

A free, open-source knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures

A

MITRE ATT&CK Framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

A framework for analyzing cybersecurity incidents and intrusions by exploring the relationships between four core features: adversary, capability, infrastructure, and victim.

A

Diamond model of intrusion analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

The 4 core features of the Diamond model of intrusion analysis

A

Adversary
Capability
Infrastructure
Victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Software designed to infiltrate a computer system and possibly damage it without the user’s knowledge or consent

A

Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Malicious code that runs on a machine w/out the user’s knowledge and infects the computer when executed. Requires a user action to reproduce and spread.

A

Virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

A type of virus stored in the first sector of a hard drive and are loaded into memory upon boot up.

Difficult to detect because it is installed BEFORE the OS boots up. Requires an antivirus that specifically looks for this type of virus.

A

Boot sector virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Virus embedded into a document and is executed when the document is opened by the user

A

Macro

46
Q

A type of virus that infects an executable or application

A

Program virus

47
Q

A virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer.

This gives the virus persistence; if you are able to delete the program virus portion, the boot sector portion reinstalls it.

A

Multipartite virus

48
Q

An advanced version of an encrypted virus that changes its code every time it’s executed by altering the decryption module to avoid detection

A

Polymorphic virus

49
Q

A virus that encrypts its code to avoid detection

A

Encrypted virus

50
Q

A virus that is able to rewrite itself entirely before it attempts to infect a file. An advanced version of a polymorphic virus.

A

Metamorphic virus

51
Q

A type of virus that uses techniques to avoid detection by antivirus software.

A

Stealth virus

52
Q

A type of virus that has a layer of protection to confuse a program or a person analyzing it.

A

Armored virus

53
Q

A form of social engineering when a website or scam caller claims that you have a virus, and gives you a number to call or program to install in order to get rid of it.

A

Hoax virus

54
Q

Malicious software that is able to replicate itself without user interaction

A

Worm

55
Q

Malicious software disguised as a piece of harmless or desirable software. It performs the desired function, but also a secret malicious function.

A

Trojan horse

56
Q

A Trojan that provides the attacker with remote control of a victim computer and is the most commonly used type of trojan

A

RAT (Remote Access Trojan)

57
Q

Malware that restricts access to a victim’s computer or files until a ransom is received

A

Ransomware

58
Q

Malware that secretly gathers info about the user w/out their consent

A

Spyware

59
Q

A type of spyware that captures keystrokes made by the victim and takes screenshots that are sent to the attacker

A

Keylogger

60
Q

A type of spyware that displays advertisements based upon its spying on you

A

Adware

61
Q

Software that isn’t benign nor malicious and tends to behave improperly without serious consequences. For example, this can make the user jump to random places on the screen or turn the screen upside-down. It can be used as a prank.

A

Grayware

62
Q

Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime. This keeps the computer from understanding that it has malicious code installed.

It works by using a shim between the OS and the DLL. The shim will redirect the call between them with malicious code embedded in them.

A

DLL injection

63
Q

Software designed to gain administrative level control over a system without detection

A

Rootkit

64
Q

The method used commonly used by rootkits to maintain their persistent control

A

DLL injection

65
Q

An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level

A

Driver manipulation

66
Q

A piece of software code that is placed between two components to intercept calls and redirect them. This is used by both DLL injection and driver manipulation.

A

Shim

67
Q

Rootkits are known for using which two methods?

A

DLL injection and driver manipulation

68
Q

What is the best way to detect a rootkit?

A

Boot from an external device and scan the internal hard drive

69
Q

Activity that abuses electronic messaging systems, most commonly through email

A

Spam

70
Q

Why can’t we just block spammers’ email servers?

A

Spammers exploit reputable companies’ open mail relays to send their messages.

71
Q

A function of an email server that allows the server to send mail on the behalf of other organizations.

A

Open mail relay

72
Q

An governmental act made to put a stop to spammers exploiting companies’ open mail relays

A

CAN-SPAM

73
Q

Code that infects a computer when a file is opened or executed

A

Virus

74
Q

Method used by an attacker to access a victim’s machine

A

Threat vector

75
Q

Method used by an attacker to gain access to a computer in order to infect it with malware

A

Attack vector

76
Q

Difference between threat vector and attack vector?

A

Threat vector is how to get to the machine itself.

Attack vector includes both how to gain access to the machine and how to infect it.

77
Q

Malware placed on a website that you know your potential victims will access as part of routine activities

A

Watering hole

78
Q

Registering a domain name as a misspelled version of a well-known domain, hoping that a victim will type the URL incorrectly to access the attacker’s site.

A

Typosquatting

79
Q

A collection of compromised computers under the control of a master node

A

Botnet

80
Q

Occurs when a computer is placed between the sender and receiver and is able to capture or modify the traffic between them

A

Active interception

81
Q

Occurs when an attacker is able to exploit a design flaw or bug in a system to gain access to resources that a normal user isn’t able to access

A

Privilege escalation

82
Q

Used to bypass normal security and authentication functions

A

Backdoor

83
Q

A type of malware that works like a backdoor (maintaining persistent access)

A

RAT (Remote Access Trojan)

84
Q

Non-malicious code that when invoked, displays an insider joke, hidden message, or secret feature

A

Easter egg

85
Q

If Easter eggs are harmless, why are they dangerous?

A

Easter eggs are usually put in at the last second. They are additional code that have not gone through the rigorous testing and security practices.

86
Q

Malicious code that has been inserted inside a program and will execute only when certain conditions have been met

A

Logic bomb

87
Q

T/F: Logic bombs, easter eggs, and backdoors are all against security best practices and should not be found in your code.

A

True

88
Q

Symptoms of infection

A

Strange behavior
Hard drives, files, or apps not accessible
Strange noises
Unusual error messages
Display looks strange
Jumbled printouts
New or disappearing icons on desktop
Double file extensions
Antivirus won’t run
New files or folders
Corrupted/missing files or folders
System Restore will not function

89
Q

First action to take if you suspect your computer is infected

A

Scan with antimalware

90
Q

What should you do before you take action to clean up a virus?

A

Make a backup of your system

91
Q

7 steps to take care of a computer infection

A

Identify symptoms
Quarantine the infected systems
Disable System Restore (if using Windows)
Remediate the infected system
Schedule automatic updates and scans
Reenable System Restore and create a new restore point
Provide end user security awareness training

92
Q

How do you scan for a boot sector virus?

A

Reboot the computer from an external device and scan it.

This is because if you boot from the internal hard drive, the virus is loaded up before you can do anything from it.

OR you can move the hard drive to another computer and scan in there.

93
Q

A type of malware that acts as a go-between for the OS and the kernel

A

Rootkit

94
Q

How to prevent spammers from using your mail servers to send spam

A

Verify your email servers aren’t configured as open mail relays or SMTP open relays

95
Q

3 main ways to prevent malware

A

Install and continually update reputable antimalware
Update and patch your OS
End user training

96
Q

Describes the specific method by which malware code infects a target host

A

Exploit technique

97
Q

A type of malware that is executed directly as a script or a piece of shellcode that creates a process in the system memory without having to use the local file system

A

Fileless

98
Q

The 5 steps that APTs use to operate modern malware

A

Dropper or downloader
Maintain access
Strengthen access
Actions on objectives
Concealment

99
Q

Malware designed to install/run other types of malware embedded in a payload on an infected host

A

Dropper

100
Q

A piece of code that connects to the internet to retrieve additional tools after the initial infection by a dropper

A

Downloader

101
Q

Any lightweight code designed to run an exploit on the target, which may include any type of code format from scripting languages to binary code

A

Shellcode

102
Q

Exploit technique that runs malicious code with the identification number of a legitimate process

A

Code injection

103
Q

When an attacker’s dropper replaces a victim’s genuine executable with a malicious one

A

Masquerading

104
Q

When an attacker’s dropper forces a malicious process to run as part of the DLL

A

DLL injection

105
Q

When an attacker’s dropper exploits a vulnerability in a legitimate program’s manifest to load a malicious DLL at runtime

A

DLL sideloading

106
Q

When an attacker’s dropper starts a process in a suspended state, and then rewrites the memory locations containing the process code with the malware code

A

Process hollowing

107
Q

Anti-forensic techniques that droppers implement

A

Encrypting payloads
Compressing payloads
Obfuscating payloads

108
Q

Exploit techniques that uses the victim’s standard system tools (for example, PowerShell or BASH) and packages to perform intrusions. Makes it incredibly hard to find the attacker using this technique.

A

Living off the land

109
Q

Difference between armored virus and stealth virus?

A

Stealth virus hide themselves from the OS and/or antivirus software by making changes to file sizes or directory structure.

Armored virus are difficult to detect or analyze, and may be able to protect itself from antivirus programs.

110
Q

Difference between polymorphic and metamorphic viruses?

A

Polymorphic encrypts its code using a variable encryption key so each copy of the virus appears different.

Metamorphic rewrites its code itself in order to make each copy of the virus different, no encryption key necessary.

111
Q

Difference between phishing and pharming?

A

Phishing requires only successful social engineering. It is a one-time scam, usually involving the attacker trying to get victims to click on a link to a fraudulent site. It usually involves targeting one individual at a time.

Pharming requires an attacker to gain unauthorized access to a system. This involves creating a fake website for users to enter their credentials, and then redirecting them via DNS poisoning/spoofing/hijacking. It involves simultaneously targeting huge groups of people.

Security+ (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions