Weak Points

Question 1

RFC

Answer 1

Request for Comments:
Published by ISOC
Not all RFCs are standards documents (experimental, best practice, standard track)
Many informal RFCs analyze threats

An RFC is authored by individuals or groups of engineers and computer scientists in the form of a memorandum describing methods, behaviors, research, or innovations applicable to the working of the Internet and Internet-connected systems

Question 2

AIS

Answer 2

Automated Indicator Sharing:
A US government initiative for real-time sharing of cyber threat indicators

Intelligence industry needs a standard way to share important threat data (share info freely)

Ex: STIX & TAXII

Question 3

STIX

Answer 3

Structured Threat Information Expression:
A standardized XML programming language for conveying data about cybersecurity threats in a common language that can be easily understood by humans & security tech

Describes cyber threat info (motivations, capabilities, response info)

Designed to be shared via TAXII (but can be shared by other means)

Question 4

TAXII

Answer 4

Trusted Automation Exchange of Intelligence Information:
Defines how cyber threat information can be shared via services and message exchanges
Securely shares STIX data

Question 5

SRTP

Answer 5

Secure Real-Time Transport:
RTP for delivering A/V over IP networks
Uses AES
Authentication, integrity, & replay protection
HMAC-SHA1

Question 6

SFTP vs. FTPS

Answer 6

SFTP: SSH FTP

FTPS: FTP over SSL/TLS

Question 7

CE vs. SE vs. Zero-Fill

Answer 7

Cryptographic Erase:
Sanitizes a self-encrypting drive by erasing the media encryption key and then reimaging the drive

Secure Erase:
Used to perform the sanitization of flash-based devices (such as SSDs or USB devices) when cryptographic erase is not available

Zero-Fill:
Relies on overwriting a storage device by setting all bits to the value of zero (0), but this is not effective on SSDs or hybrid drives, and it takes much longer than the CE method

Question 8

SPI

Answer 8

Sensitive Personal Information:
Information about a subject’s opinions, beliefs, and nature afforded specially protected status by privacy legislation

Question 9

Rules of Engagement (Pentesting)

Answer 9

Can state things like no social engineering is allowed, no external website scanning, etc

Question 10

IoC

Answer 10

Indicator of Compromise:
An artifact observed on a network or in an operating system that, with high confidence, indicates a computer intrusion.

Typical IoCs are virus signatures and IP addresses, MD5 hashes of malware files or URLs, or botnet command and control servers’ domain names

Question 11

First action after forensically imaging a hard drive for evidence

Answer 11

The first thing that must be done after acquiring a forensic disk image is to create a hash digest of the source drive and destination image file to ensure they match.

A critical step in the presentation of evidence will be to prove that analysis has been performed on an identical image to the data present on the physical media and that neither data set has been tampered with.

Question 12

Protecting Data Center Servers: 4 Best Features

Answer 12

FM-200 (gas), Biometric Locks, Mantrap, Antivirus

Question 13

DPO (Data Protection Officer)

Answer 13

The primary role of the data protection officer (DPO) is to ensure that her organization processes the personal data of its staff, customers, providers, or any other individuals (also referred to as data subjects) in compliance with the applicable data protection rules.

They must understand how any privacy information is used within business operations

Question 14

EDM (Exact Data Match)

Answer 14

A pattern matching technique that uses a structured database of string values to detect matches. For example, a company might have a list of actual social security numbers of its customers.

Since it is not appropriate to load these numbers into a DLP filter, they could use EDM to match the numbers’ fingerprints instead based on their format or sequence

Ex: xxx-xx-xxxx

Question 15

Identifying rogue devices on a wired network

Answer 15

The best option is MAC address reporting from a source device like a router or a switch.

If the company uses a management system or inventory process to capture these addresses, then a report from one of these devices will show what is connected to the network even when they are not currently in the inventory.

Question 16

GLBA

Answer 16

Gramm-Leach-Bliley Act:
A United States federal law that requires financial institutions to explain how they share and protect their customers’ private information

Question 17

Data Sovereignty

Answer 17

Refers to a jurisdiction (such as France or the European Union) preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction. Data sovereignty may demand certain concessions on your part, such as using location-specific storage facilities in a cloud service.

Question 18

Staging

Answer 18

Staging environments can mimic the actual production environment, leading to a realistic test environment that minimizes the risk of failure during a push to the production environment

Question 19

LDAP: Shared Authentication?

Answer 19

LDAP can be used for single sign-on but is not a shared authentication protocol. OpenID, OAuth, and Facebook Connect are all shared authentication protocols.

Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. OAuth is designed to facilitate the sharing of information (resources) within a user profile between sites.

Question 20

Which protocol is paired with OAuth2?

Answer 20

OpenID Connect:
OAuth 2 is explicitly designed to authorize claims and not to authenticate users.

The implementation details for fields and attributes within tokens are not defined. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields.

Question 21

Investigating Spam: Most important info

Answer 21

You should first request a copy of one of the spam messages, including the full email header.

By reading through the full headers of one of the messages, you can determine where the email originated from, whether it was from your email system or external, and if it was a spoofed email or a legitimate email

Question 22

Banner Grabbing

Answer 22

Banner grabbing is conducted by actively connecting to the server using telnet or netcat and collecting the web server’s response.

This banner usually contains the server’s operating system and the version number of the service being run.

Question 23

Hping

Answer 23

Hping is a handy little utility that assembles and sends custom ICMP, UDP, or TCP packets and then displays any replies. It was inspired by the ping command but offered far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation.

Hping is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities.

Hping also allows you to map out firewall rule sets. It is also great for learning more about TCP/IP and experimenting with IP protocols.

Hping does not support IPv6 (NMAP creators made Nping to make up for this)

Question 24

Call List/Escalation List

Answer 24

This list should detail who should be called, what order, and how high up the organizational leadership chart a particular issue would reach.

In almost every case, the incident response team lead should be contacted before the CEO or CIO is notified of the incident

Question 25

FERPA

Answer 25

Protects the privacy of student educational records

Question 26

Incident Response: Preservation of Evidence

Answer 26

Occurs during Containment, Eradication, & Recovery

Question 27

SAML: SP

Answer 27

Service Provider:
SAML allows a service provider (SP) to establish a trust relationship with an identity provider (IdP) so that the SP can trust the identity of a user (the principal) without the user having to authenticate directly with the SP.

Question 28

Polymorphic Virus

Answer 28

A polymorphic virus alters its binary code to avoid detection by antimalware scanners that rely on signature-based detection. By changing its signature, the virus can avoid detection.

Question 29

Strongest Containment Technique

Answer 29

Isolating affected systems

Question 30

Detecting Buffer Overflows

Answer 30

Buffer overflows are most easily detected by conducting a static code analysis.

Manual peer review or pair programming methodologies might have been able to detect the vulnerability. Still, they do not have the same level of success as a static code analysis using proper tools.

Question 31

Degaussing: Media Sanitization Classification

Answer 31

Purging:
Eliminates information from being feasibly recovered even in a laboratory environment. Purging includes degaussing, encryption of the data with the destruction of its encryption key, and other non-destructive techniques.

Question 32

Credentialed vs. Non-credentialed Scans

Answer 32

Credentialed scans log into a system and retrieve their configuration information. Therefore, it should provide you with the best results.

A non-credentialed scan relies on external resources for configuration settings that can be altered or incorrect.

Question 33

Biggest Disadvantage of SSO

Answer 33

It introduces a single point of failure

Question 34

Threat + ? = Risk

Answer 34

Vulnerability

Question 35

PCI-DSS Breach Notification

Answer 35

Any organization that processes a credit card will be required to work with their credit card processor instead of working directly with the card issuers (Visa and Mastercard).

Question 36

Data Breach Notifications

Answer 36

Conduct notification to all affected customers within 72 hours of the discover of the breach

Generally speaking, most laws require notification within 72 hours, such as the GDPR

Question 37

Hardware Write Blocker

Answer 37

Both hardware and software write blockers are designed to ensure that forensic software and tools cannot change a drive inadvertently by accessing it.

Hardware > Software

Question 38

ABAC

Answer 38

Attribute-based access control (ABAC) provides the most detailed and explicit type of access control over a resource because it is capable of making access decisions based on a combination of subject and object attributes, as well as context-sensitive or system-wide attributes.

Information such as the group membership, the OS being used by the user, and even the machine’s IP address could be considered when granting or denying access.

Question 39

Captive Portal Authentication

Answer 39

Captive portals usually rely on 802.1x, and 802.1x uses RADIUS for authentication.

The IEEE 802.1x standard is a network authentication protocol that opens ports for network access when an organization authenticates a user’s identity and authorizes them for access to the network. This defines port security.

Question 40

FIDM: RP

Answer 40

Relying parties (RPs) provide services to members of a federation.

Also known as the service provider because it consumes the tokens generated by the IdP