16-A Flashcards

Question

Define vishing.

Answer 1

Phishing conducted through voice channels like telephone or VoIP.

Answer 2

Using a rogue wireless access point to harvest credentials from users.

Answer 3

An information-gathering threat where the attacker learns about the configuration of the network and security systems.

Answer 4

An attack where the threat actor masquerades as a trusted user or computer.

Answer 5

A specific type of spoofing where the threat actor intercepts traffic between two hosts.

Answer 6

An attack that causes a service to fail or become unavailable to legitimate users.

Answer 7

A DoS attack launched from multiple compromised systems, known as a botnet.

Answer 8

Distributed Denial of Service ## Footnote DDoS attacks are launched from multiple compromised systems referred to as a botnet.

Answer 9

A network of compromised systems used to launch coordinated attacks ## Footnote Botnets are established by compromising machines and installing bots on them.

Answer 10

To coordinate attacks using compromised devices ## Footnote C&C hosts manage the botnet and direct the attack.

Answer 11

By obtaining a password file or sniffing unencrypted traffic ## Footnote Unencrypted protocols make it easy for threat actors to intercept credentials.

Answer 12

A fixed-length string produced from a variable-length input using a one-way function ## Footnote Hashing is used for secure storage of data where recovery of the original input is not needed.

Answer 13

* Dictionary attack * Brute force attack ## Footnote Dictionary attacks use common words, while brute force tries all combinations.

Answer 14

An attack that exploits input validation vulnerabilities in web applications ## Footnote XSS allows attackers to inject malicious scripts that run in the client's browser.

Answer 15

Nonpersistent XSS does not change server data, while persistent XSS does ## Footnote Persistent XSS inserts code into a back-end database that affects other users.

Answer 16

An attack that modifies SQL queries to execute unauthorized commands ## Footnote SQL injection can extract, insert, or alter data in a database.

Answer 17

* Symmetric encryption * Asymmetric encryption * Cryptographic hashing ## Footnote Each type serves different roles in securing data.

Answer 18

A method that uses a single secret key for both encryption and decryption ## Footnote Security risks arise if the key is lost or stolen.

Answer 19

A method that uses a key pair (private and public keys) for encryption and decryption ## Footnote Only the linked key can reverse the operation performed by the other key.

Answer 20

A message cannot be larger than the key size ## Footnote This limitation necessitates the use of symmetric encryption for larger messages.

Answer 21

A cryptographic method that verifies the integrity and authenticity of a message ## Footnote It involves hashing the message and encrypting the hash with a private key.

Answer 22

To allow two hosts to share a symmetric encryption key securely ## Footnote Key exchange uses asymmetric encryption to protect the exchange of the secret key.

Answer 23

on-path attack ## Footnote On-path attacks can intercept data as it travels across the network.

Answer 24

False ## Footnote Zero-day vulnerabilities can affect any system, not just those that are end-of-life.

Answer 25

Phishing attack ## Footnote This attack often uses social engineering to entice users to click on malicious links.

Answer 26

Tailgating is unauthorized entry following an authorized user, while shoulder surfing is observing someone entering sensitive information ## Footnote Both are physical security threats but target different aspects of security.

Answer 27

Brute force attack ## Footnote Short and non-complex passwords can be cracked quickly using brute force techniques.

Answer 28

Public key ## Footnote Digital certificates bind a public key to an entity, enabling secure communication.

16-A Flashcards

(52 cards)