WK 4 Common Cybersecurity tools

Question 1

SIEM tools

Answer 1

An application that collects and analyzes log data to monitor critical activities in an organisation.

SIEM tools reduce the amount of data an analyst must review by providing alerts for specific types of threats, risks, and vulnerabilities.

SIEM tools provide a series of dashboards that visually organise data into categories.

Question 2

Logs

Answer 2

A log is a record of events that occur within an organisation’s systems

Question 3

Network protocol analyzers (packet sniffers)

Answer 3

A tool designed to capture and analyze data traffic in a network.

Question 4

Playbooks

Answer 4

A playbook is a manual that provides details about any operational action, such as how to respond to a security incident.

Playbooks vary from one organisation to the next, but they all have a similar purpose: To guide analysts through a series of steps to complete specific security-related tasks

Question 5

Chain of custody playbook

Answer 5

Chain of custody is the process of documenting evidence possession and control during an incident lifecycle

Question 6

Protecting and preserving evidence playbook

Answer 6

Protecting and preserving evidence is the process of properly working with fragile and volatile digital evidence

Question 7

Programming

Answer 7

process that can be used to create a specific set of instructions for a computer to execute tasks

Question 7

Programming

Answer 7

process that can be used to create a specific set of instructions for a computer to execute tasks

Question 8

Automation

Answer 8

The use of technology to reduce human and manual effort in performing common and repetitive tasks.

Reduce the risk of human error

Question 9

Structured Query Language (SQL)

Answer 9

SQL is used to create, interact with, and request information from a database.

Question 10

Database

Answer 10

A database is an organized collection of information or data.

Question 11

Data point

Answer 11

Specific piece of information.

Question 12

Operating system

Answer 12

An operating system is the interface between computer hardware and the user. Linux®, macOS®, and Windows are operating systems. They each offer different functionality and user experiences.

Question 13

Linux

Answer 13

An Open-source operating system
Open source means that the code is available to the public and allows people to make contributions to improve the software

Question 14

Command

Answer 14

An instruction telling the computer to do something

Question 15

Command-line

Answer 15

A command-line interface is a text-based user interface that uses commands to interact with the computer

Question 16

Web vulnerability

Answer 16

A unique flaw in a web application that a threat actor could exploit by using malicious code or behavior, to allow unauthorized access, data theft, and malware deployment.

Question 17

Antivirus software

Answer 17

Antivirus software is a software program used to prevent, detect, and eliminate malware and viruses. It is also called anti-malware. Depending on the type of antivirus software, it can scan the memory of a device to find patterns that indicate the presence of malware

Question 18

Intrusion detection system

Answer 18

An intrusion detection system (IDS) is an application that monitors system activity and alerts on possible intrusions. The system scans and analyzes network packets, which carry small amounts of data through a network. The small amount of data makes the detection process easier for an IDS to identify potential threats to sensitive data. Other occurrences an IDS might detect can include theft and unauthorized access.

Question 19

Encryption

Answer 19

Encryption makes data unreadable and difficult to decode for an unauthorized user; its main goal is to ensure confidentiality of private data. Encryption is the process of converting data from a readable format to a cryptographically encoded format.

Question 20

Cryptographic encoding

Answer 20

converting plaintext into secure ciphertext.

Plaintext is unencrypted information and secure ciphertext is the result of encryption.

Encoding and encryption serve different purposes. Encoding uses a public conversion algorithm to enable systems that use different data representations to share information.