Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cisco Cyber Ops > 210-255 > Flashcards

210-255 Flashcards

1
Q

What is accomplished in the identification phase of incident handling?

A

Determining that a security event has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which two HTTP header fields relate to intrusion analysis? (Choose two)

A

User-agent

Host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which component of the NIST SP800-61 r2 incident handling strategy reviews data?

A

Post-incident analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which option is generated when a file is run through an algorithm and generates a string specific to the contents of that file?

A

Hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which data type is protected under the PCI compliance framework?

A

Primary account number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which CVSSv3 metric captures the level of access that is required for a successful attack?

A

Privileges required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

From a security perspective, why is it important to employ a clock synchronization protocol on a network?

A

To construct an accurate timeline of events when responding to an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

You see 100 HTTP GET and POST requests for various pages on one of your web servers. The user agent in the requests contain php code that, if executed, creates and writes to a new php file on the webserver. Which category does this even fall under as defined in the Diamond Model of Intrustion?

A

Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which option is misuse variety per VERIS enumerations?

A

Hacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which stakeholder group is responsible for containment, eradication, and recovery in incident handling?

A

Leaders and Managers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A user on your network receives an email in their mailbox that contains a malicious attachment. There is no indication that the file was run. Which category as defined in the kill-chain model does this activity fall under?

A

Delivery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

During which phase of the forensic process are tools and techniques used to extract the relevant information from the collective data?

A

Examination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which option allows a file to be extracted from a TCP steam within Wireshark?

A

File > Export Objects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which element can be used by a threat actor to discover a possible opening into a target network and can also be used by an analyst to determine the protocol of the malicious traffic?

A

Ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In Microsoft Windows, as files are deleted the space they were allocated eventIally is considered available for use by other files. This creates alternating used and unused areas of various sizes. What is this called?

A

Free space fragmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In the context of incident handling phases, which two activities fall under scoping?

A

Identifying the extent that a security incident is impacting protected resources on the network.

Identifying the attackers that are associated with a security incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which regular expression matches “color” and “colour”?

A

colou?r

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which description of a retrospective malware detection is true?

A

You can use historical information from one or more sources to identify the affected host or file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which process is being utilized when IPS events are removed to improve data integrity?

A

Data normalization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which element is included in an incident response plan?

A

Organization mission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which CVSSv3 metric value increases when attacks consume network bandwidth, processor cycles, or disk space?

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which Security Operations Center’s goal is to provide incident handling to a country?

A

National CSIRT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A CMS plugin creates two files that are accessible from the Internet myplugin.html and exploitable.php. A newly discovered exploit takes advantage of an injection vulnerability in exploitable.php. To exploit the vulnerability, one must send an HTTP POST with specific variables to exploitable.php. You see traffic to your webserver that consists of only HTTP Get requests to myplugin.html. Which category best describes this activitiy?

A

Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which goal of data normalization is true?

A

Reduce data redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which identifies both the source and destination location?

A

IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which type of analysis assigns values to scenarios to see what the outcome might be in each scenario?

A

Deterministic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which feature is used to find possible vulnerable services running on a server?

A

Listening ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which two options can be used by a threat actor to determine the role of a server? (Choose two)

A

Running processes

Applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which option creates a display filter on Wireshark on a host IP address or name?

A

ip.addr==or ip.host ==

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

You receive an alert for malicious code that exploits Internet Explorer and runs arbitrary code on the site visitor machine. The malicious code is on an external site that is being visited by hosts on your network. Which user agent in the HTTP headers in the requests from your internal hosts warrants further investigation?

A

Mozilla/5.0 (compatible, MSIE 10.0, Windows NT 6.2, Trident 6.0)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

A

Collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which information must be left out of a final incident reports?

A

Server hardware configurations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which two components are included in a 5-tuple? (Choose two)

A

Port number

Destination IP address

34
Q

In VERIS, an incident is viewed as a series of events that adversely affects the information assets of an organization . Which option contains the elements that every event is comprised of according to VERIS incident model?

A

actors, actions, assets, attributes

35
Q

You see confidential data being exfiltrated to an IP address that is attributed to a known Advanced Persistent Threat group. Assume that this is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Diamond Model of Intrusion?

A

action on objectives

36
Q

Which option has a drastic impact on network traffic because it can cause legitimate traffic to be blocked?

A

false positive

37
Q

Which CVSSv3 metric value increases when the attacker is able to modify all files protected by the vulnerable component?

A

Integrity

38
Q

Which type of analysis allows you to see how likely an exploit could affect your network?

A

Probabilistic

39
Q

Which network device creates and sends the initial packet of a session?

A

Source

40
Q

When performing threat hunting against a DNS server, which traffic toward the affected domain is considered a starting point?

A

UDP traffic

41
Q

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. Which term defines the initial event in the NIST SP800-61 r2?

A

Precursor -> is a sign that an incident may occur in the future

42
Q

You have run a suspicious file in a sandbox analysis tool to see what the file does. The analysis report shows that outbound callouts were made post infection. Which two pieces of information from the analysis report are needed or required to investigate the callouts? (Choose two)

A

Domain names

Host IP addresses

43
Q

Which option filters a LibPCAP capture that used a host as a gateway?

A

gateway host

44
Q

Which source provides reports of vulnerabilities in software and hardware to a Security Operations Center?

A

Internal CSIRT

45
Q

What information from HTTP logs can be used to find a threat actor?

A

IP address

46
Q

Which element is part of an incident response plan?

A

Organizational approach to incident response.

47
Q

What mechanism does the Linux operating system provide to control access to files?

A

File permissions

48
Q

Which string matches the regular expression r(ege)+x?

A

regeegex

49
Q

Which statement about threat actors is true?

A

They are perpetrators of attacks

50
Q

Which data element must be protected with regards to PCI?

A

full name / full account number

51
Q

What kind of evidence can be considered most reliable to arrive at an analytical assertion?

A

Direct

52
Q

Which CVSSv3 Attack Vector metric value requires the attacker to physically touch or manipulate the vulnerable component?

A

Physical

53
Q

Which option can be addressed when using retrospective security techniques?

A

How the malware entered our network.

54
Q

Which netstat command show ports? (Choose two)

A

netstat -a

netstat -l

55
Q

What is data mapping used for? (Choose two)

A

data accuracy (integrity)

data visualisation

56
Q

Filtering ports in Wireshark?

A

tcp.port == 80

57
Q

What attribute belonging VERIS schema?

A

confidentiality / possession
Integrity / authenticity
availability / utility

58
Q

What is NAC?

A

Network Access Control

59
Q

What protocol is related to NAC?

A

802.1X (EAP-TLS, EAP-PEAP or EAP-MSCHAP)

60
Q

What is the definition of confidentiality according to CVSSv3 framework?

A

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability

61
Q

Which of the following are examples of some of the responsibility of a corporate CSIRT and the policies it helps create? (Choose Four)

A

Incident classification and handling
Information classification and protection
Information dissemination
Record retention and destruction

62
Q

Which of the following is not an example of weaponization?

A

Connecting to a CnC server

63
Q

Which of the following has been used to evade IDS / IPS devices?

A

Fragmentation

64
Q

Which of the following is typically a responsibility of a PSIRT (Product SIRT)?

A

Disclosure of vulnerabilities in the organization’s products and services

65
Q

Which of the following is an example of a managed security offering where incident response experts monitor and respond to security alerts in a SOC?

A

Cisco’s Active Threat Analytics (ATA)

66
Q

Which of the following is one of the main goals of data normalization?

A

To purge redundant data while maintaining data integrity

67
Q

Which of the following can be identified by correlating DNS intelligence and other security events? (Choose two)

A

Communication to CnC servers

Malicious domain based on reputation

68
Q

Which of the following steps in the kill chain would come before the others?

A

Delivery

69
Q

Which of the following are core responsibilities of a national CSIRT and CERT?

A

Protect their citizens by providing security vulnerability info, security awareness training, best practices, and other info

70
Q

Which of the following is one of the main goals of the CSIRT?

A

Minimize and control the damage associated with incidents, provide guidance for mitigation and work to prevent future incidents

71
Q

Which of the following is not a metadata feature of the DIamond Model?

A

Devices

72
Q

Which of the following are the three metrics, or scores of the CVSS?

A

Base
Environmental
Temporal

73
Q

Which of the following are not components of the 5-tuple of a flow in NetFlow? (Choose two)

A

Flow record ID

Gateway

74
Q

Which of the following is an example of a coordination center?

A

CERT division of SEI

75
Q

Which of the following is the team that handles the investigation, resolution, and disclosure of security vulnerabilities in vendor products and services?

A

PSIRT

76
Q

Which of the following are the three broad categories of cybersecurity investigations?

A

Public, private and individual investigations

77
Q

In addition to cyber crime and attacks, evidence found on a system or network may be presented in a court of law to support accusations of crime or civil action, including which of the following?

A

Fraud, money laundering and theft
Drug-related crime
Murder and acts of violence
All of the above

78
Q

According to NIST what option is unnecessary for containment strategy?

A

The delayed containment

Monitoring with methods other than sandboxing

79
Q

At which stage attacking the vulnerability belongs in the Cyber Kill chain?

A

Exploitation

80
Q

Based on NIST SP800-61 r2 what are the recommended protections against malware?

A

Malware prevention software

81
Q

Choose the option that best describes NIST data integrity.

A

You must hash data & backup and compare hashes

82
Q

What is the process of remediation the system from attack so that responsible threat actor can be revealed?

A

Validating the attacking host’s IP address
Researching the attacking host through search engines
Using incident databases
Monitoring possible attacker communication channels.

Cisco Cyber Ops (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions