1.0

Question 1

Agentless protection

Answer 1

Has a central security server or application that monitors all devices on the network to enforce security.

Question 2

SOAR

Answer 2

Automates tasks related to detecting and remediating exploits. IE: It can delete or quarantine a malicious file.

Question 3

Run Book automation

Answer 3

Compiled procedures or task that can guide you or complete tasks for you via scripts.

Question 4

Sliding window anomaly detection

Answer 4

Detects anomalies in real time and denies the associated packets.

Question 5

Discretionary access control

Answer 5

(DAC) The owner decides permissions of the files.

Question 6

Threat intelligence platform (TIP)

Answer 6

Platform that allows you to generate and collect data from many different places to assist in defending and remediating against malicious software.

Question 7

Risk scoring vs Risk assessment

Answer 7

Risk assessment is to weigh the likelihood and the impact of a potential attack, risk scoring is giving that a score (usually red, yellow, or green) to compare it to others.

Question 8

Defense-in-Depth

Answer 8

Implement security on all different layers.
1. physical with MFA.
2. technical controls such as VLANs or port control.
3. Administrative with policies such as limiting junior personals privilege.

Question 9

Application security systems

Answer 9

Protects layer 5-7, found on device.

Question 10

Mandatory access control

Answer 10

The system automatically denies permission depending on the user and the sensitivity of the file.

Question 11

Nondiscretionary access control

Answer 11

Access based on different types of rules, such as IT, Security, and user groups and gives access to said groups.

Question 12

Rule-based access control

Answer 12

Sets a rule for a file, such as you can only view the file or that you cannot delete it.

Question 13

Role-based access control

Answer 13

Sales team can access sales files and IT can access IT files.

Question 14

CVSS terms:
Attack Vector
Attack complexity
Privileges required
User interaction
scope

Answer 14

Common Vulnerability Scoring System higher scores are more dangerous (10 is the highest)
Attack Vector: what it targets such as the network, physical or the system.
Attack complexity: how hard/how much information the need before executing
Privileges required: What level of privilege does the require in need to execute the exploitation.
User interaction: Does the attacker need any user interaction?
Scope: What other systems are affected if a system gets compromised?