Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

NSVT > Week 7 > Flashcards

Week 7 Flashcards

1
Q

How are occurrences identified?

A

By comparing abnormal activities to establish baseline and thresholds of known good system performance and operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is collection?

A

The identification, labeling, recording, and acquisition of data for the possible sources of relevant data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

2 ways that an incident can be classified:

A
  • Precursors

- Indicators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What port is SSH

A

22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are common sources that can facilitate the identification of precursors and indicators?

A
  • antivirus software

- people from within

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the main objectives within incident response?

A
  • resolving the incident according to official requirements
  • mitigating the risk or threat
  • restoring integrity of affected system
  • implementation of proactive and reactive defensive and productive measures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What incident categories must be sanitized and rebuilt from trusted media?

A

1,2, or 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who will make the block determination and provide guidance to the affected commands?

A

NCDOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Incidents of what category would potentially trigger gateway blocks?

A

1, 2, 3, 4, 6, 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The implementation of NCDOC IP black lists and DNS Black Holes Lists are mandatory.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Who is responsible for Tier 2?

A

NCDOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who serves as the principal advisor and representative to the CO in matters pertaining to the ES?

A

CSM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is volatile data?

A

Data on a live system that will be lost when the system is rebooted or powered off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What’s the system state command used for user accounts?

A

Net user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Verifying data integrity is accomplished by?

A

Creating a message digest hash such as MD5 or SHA1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can the working copy be used for?

A

Search for the evidence and to perform any required analysis of the data without the risk of affecting the original data or the master copy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Our networks are configured to a level of risk that can be deemed acceptable

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is static analysis?

A

The process of examining and interpreting the contents of the malware sample without executing the file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the abnormal combinations of seemingly uninteresting events?

A
  • an unrecognized connection to a web server
  • an unrecognized configuration change
  • an unrecognized user creation or privilege escalation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is one of the primary objectives for post-incident analysis?

A

Identifying technical or operational training needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the response we use for the increase in security events?

A

Operation rolling tide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is data compromise?

A

The compromise or probably compromise of classified information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Event flow chart matching

A
  1. Generated event
  2. Event discovery
  3. Consolidated and aggregated events
  4. Event analysis
  5. Is it an event incident?
24
Q

After the evident has been I defined as an incident, then what is it called?

A

Incident response

25
Q

Delivery Vector Category 1A:

A

Reconnaissance, information gathering and data mining

26
Q

Delivery Category Vector 6A

A

Other IS compromise: compromise resulting from access previously gained on another IS

27
Q

Cyber events are generally detected when?

A

When a person or security system detects suspicious behavior or known threat

28
Q

When do you determine a detected event is reportable?

A

Once an event has been detected

29
Q

If trained personnel are available, what do we do?

A

Capture volatile data and then ship to NCDOC for analysis

30
Q

Order of incidents

A
  1. Root level intrusion
  2. User level intrusion
  3. Unsuccessful activity attempted
  4. Denial of service
  5. Non-compliance activity
31
Q

What is root level intrusion?

A

Unauthorized privileged access to a DOD system

32
Q

What is User Level Intrusion?

A

Unauthorized non-privileged access to a DOD system

33
Q

What is unsuccessful activity attempted?

A

Attempt to gain unauthorized access to the system

34
Q

What is Denial of Service?

A

Activity that impairs, impedes, or halts normal functions

35
Q

What is non-compliance activity?

A

Used for activity hat due to DOD actions makes DOD systems potentially vulnerable

36
Q

HBSS is what kind of application?

A

Host based software application

37
Q 
Matching
Application: 
Host:
Internal network:
Perimeter:
Physical:
A 
Application: white-listing
Host: HBSS
Internal network: internal firewalls
Perimeter: external intrusion detection systems
Physical: alarm systems
38
Q

Signs of an occurrence are identified by?

A

Comparing abnormal activity to establish baseline and thresholds of known good system performance and operation

39
Q

two types of antivirus software that the Navy uses.

A

McAfee

Symantec

40
Q

What do COA’s focus on?

A

Containment, eradication, recovery

41
Q 
Matching
Net user:
ARP-a
Ipconfig /all:
Netstat:
Tasklist
A 
Net user: user accounts
Arp-a: ARP table
Ipconfig /all: network interfaces
Netstat-Ann: network connections
Tasklist: running tasks
42
Q

What is the working copy used for?

A

To search for the evidence and to perform any required analysis of the data without he risk of affecting the original data or the master copy

43
Q

Our networks are configured with a level of risk that has been deemed acceptable.

A

True

44
Q

What is static analysis?

A

The process of examining and interpreting the contents of the malware samples without executing the file

45
Q

What is a primary objective post incident analysis?

A

Identifying operational training needs

46
Q

What are the severity levels for HIPS?

A

High
Medium
Low
Informational

47
Q

What does operational reporting do?

A

Reporting provides commanders with information regarding their network security and its potential impact of the mission

48
Q

Information that reveals specific DOD vulnerabilities that are not commercial public knowledge for all DoD systems are classified as what?

A

SECRET

49
Q

How long do you have for a final report?

A

24 hours or as directed

50
Q

Loss of PII, how much time to report?

A

1 hour

51
Q

What is JIMS and what systems does it work with?

A

Joint Incident management systems and works with SIPR to classify messages

52
Q

What CYBERCON is most restrictive?

A

1

53
Q

What CYBERCON is least restrictive?

A

5

54
Q

LINUX record log information in what directory?

A

/var/log

55
Q

What does a medium event consist of in HBSS?

A

Signatures of behavioral activity where applications operate outside their envelope or normal operating environment

56
Q

What is the process of reviewing events and information across more Han one incident to identify trends, patterns, signatures, or hacker modes of operation?

A

Correlation

57
Q

What is done during post activity? And when is it mandatory?

A

Hold a lessons learned

  • mandatory for major incidents
  • optional for otherwise

NSVT (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions