Attacks, Threats, and Vulnerabilities

Question 1

Cross-site Request Forgery (XSRF)

Answer 1

is a malicious script hosted on the attacker’s site that can exploit a session started on another site in the same browser.

Question 2

Cross-site scripting (XSS)

Answer 2

is a malicious script hosted on the attacker’s site or coded in a link injected onto a trusted site designed to compromise clients browsing the trusted site.

Exploits the fact that the browser is likely to trust scripts that appear to come from a site the user has chosen to visit

Question 3

Shimming

Answer 3

is the process of developing and implementing additional code between an application and the operating system to enable functionality that would otherwise be unavailable.

Question 4

How serious are Memory leaks in the OS kernel? What could it mean?

Answer 4

are extremely serious. A memory leak may itself be a sign of a malicious or corrupted process.

Question 5

If the pointer that references an object at a memory location was set to a null value by a malicious process,

Answer 5

then this can create a null pointer exception, causing instability and crashes.

Question 6

When does a memory leak vulnerability occur?

What does it lead to?

Answer 6

A memory leak vulnerability occurs when software does not release allocated memory when it has finished using it, potentially leading to system instability.

Question 7

If the pointer is set to a null value by a malicious process

Answer 7

this creates a null pointer exception, and the process will crash. Programmers can use logic statements to test that a pointer is not null before trying to use it.

Question 8

Document Object Model (DOM) Cross-Site Scripting (XSS) exploits vulnerabilities in …

Answer 8

client-side scripts to modify the content and layout of a web page.

Question 9

What is a Stored (or persistent) Cross-Site Scripting (XSS)

Answer 9

is a server-side script attack that inserts code into a back-end database used by the trusted site.

Question 10

Reflected Cross-Site Scripting (XSS)

Answer 10

is a server-side input validation exploit that injects a script into a website. Once the victim visits the infected website, the malicious code executes in the user’s browser.

Question 11

Clickjacking

Answer 11

occurs when the attacker inserts an invisible layer into a trusted web page that can intercept or redirect input without the user realizing it.

Question 12

What Error or exception handling?

Answer 12

is the process of responding to the occurrence of an error in the form of an outputted message. This can provide insight to issues in the code which are not necessarily related to security.

Question 13

What is a client-side (or cross-site) request forgery?

Answer 13

is an attack that forces a user to execute unwanted actions to a web server that the user is currently authenticated to.

Question 14

What does a “server-side request forgery” do?

Answer 14

abuses the functionality and services of backend servers to read and update internal resources. This can expose, for example, database information, even without an authenticated session

Question 15

What does a command injection attack do?

What does it allow?

Answer 15

runs OS shell commands from the browser, and allows commands to operate outside of the server’s directory root, allowing commands to run as the web “guest” user.

Question 16

describe a DLL injection

Answer 16

is not a vulnerability of an application, but of the way the operating system allows one process to attach to another, and then forces it to load a malicious link library.

Question 17

Improper input handling exposes …

Answer 17

software to input validation attacks. When an attacker exploits improper input handling, it crashes the process hosting the code, performs

Question 18

What is “Refactoring” (coding, programing)

Answer 18

means the code performs the same function by using different methods. Refactoring means that the antivirus software may no longer identify the malware by its signature.

Question 19

Pointer dereference, what is it and what would it do?

Answer 19

is a software vulnerability that can occur when the code attempts to remove the relationship between a pointer and the thing it points to (pointee). Dereferencing may crash the application and corrupt memory.

Question 20

An integer overflow attack

Answer 20

causes the target software to calculate a value that exceeds the upper and lower bounds.

Question 21

How To exploit a buffer overflow vulnerability,

Answer 21

the attacker passes data that deliberately overfills the buffer (an area of memory) that the application reserves to store the expected data.

Question 22

Default application settings may expose more information than necessary when errors occur.

Answer 22

Exposing such information over an HTTP connection may provide insight of the environment to the attacker.

Question 23

An application programming interface (API) intrusion occurs when

Answer 23

an attacker takes advantage of unsecure communication with application services to perform denial of service attacks using multiple API calls, for example.

Question 24

An application programming interface (API) intrusion occurs when …

Answer 24

an attacker takes advantage of unsecure communication with application services to perform denial of service attacks using multiple API calls, for example.

Question 25

Why are API calls use keys, made up of alphanumeric characters, used for?

Answer 25

to authorize requests to the web application. These keys are exposed over an unsecure connection such as HTTP. An attacker can use the key to perform other API calls.

Question 26

A "time of check to time of use" (TOCTTOU) vulnerability

Answer 26

will take advantage of this timing to modify data before finally using it. - it's a race condition.

Question 27

Describe a race condition (software vulnerability) When does it occur? What do Attackers used this as?

Answer 27

It's when the execution processes are dependent on the timing of certain events, and those events fail to execute in the order and timing intended. Occurs when multiple threads are attempting to write at the same memory location. Attackers have used race conditions as an anti-virus evasion technique

Question 28

An integer overflow attack causes ...

Answer 28

the target software to calculate a value that exceeds the upper and lower bounds.

Question 29

A pointer is a reference to ...

Answer 29

An object in memory. Attempting to access that memory address is called dereferencing. An integer is a positive or negative whole number.

Question 30

A shim is a ...

Answer 30

Code library that intercepts and redirects calls to enable legacy mode on a system. The shim database represents a way that malware with local administrator privileges can run on reboot (persistence).

Question 31

Transitive access describes...

Answer 31

the problem of authorizing a request for a service that depends on an intermediate service.

Question 32

Directory traversal occurs when...

Answer 32

The attacker gets access to a file outside the web server's root directory. The attack uses specific code to request for information from a web server's root directory by submitting the directory path.

Question 33

An SQL injection attack inserts...

Answer 33

An SQL query as part of user input, which allows an attacker to extract or insert information into the database or execute arbitrary code.

Question 34

A replay attack consists of...

Answer 34

Intercepting a key or password hash, then reusing it to gain access to a resource. Using once-only session tokens or timestamping sessions prevents this type of attack. - Cookie Stealing An attacker with system access is able to obtain keys from system memory or pagefiles/scratch disks. Privilege escalation is the practice of exploiting flaws in an operating system or other application to gain a greater level of access than intended for the user or application.

Question 35

Pass-the-hash occurs when...

Answer 35

The attacker steals hashed credentials and uses them to authenticate to the network. Using once-only session tokens or timestamping sessions prevents this type of attack.

Question 36

In what layer does packet filtering operate? What does it do?

Answer 36

Layer 3 firewall technology that compares packet headers against ACLs to determine which network traffic to accept.

Question 37

A DoS attack causes ...

Answer 37

A service at a given host to fail or to become unavailable to legitimate users. DoS attacks focus on overloading a service by using up CPU, system RAM, disk space, or network bandwidth (resource exhaustion). Reconfiguring default web settings to throttle or limit calls can prevent this. AKA resource exhaustion

Question 38

DRDoS or amplification attack is ...

Answer 38

A more powerful TCP SYN flood attack where the adversary spoofs the victim's IP address and attempts to open connections with multiple servers.

Question 39

SYN attacks cause ...

Answer 39

resource exhaustion on the host's processing requests, consuming CPU cycles, and memory. This delays the processing of legitimate traffic and could potentially crash the host system completely.

Question 40

What is a mine? (cyber security) Is it easily detectable?

Answer 40

scripted trap that runs in the event an account gets deleted or disabled. Anti-virus software is unlikely to detect this kind of malicious script or program, so the security specialist would not be able to discover the script during an investigation. The security specialist would uncover the mine once it gets executed and causes damage.

Question 41

Fileless malicious software (malware)

Answer 41

does not write code to disk. The malware uses memory resident techniques to run in its own process. can be classified as using low observable characteristics (LOC) attacks which can make it less intrusive than other malware. uses "live off the land" techniques rather than compiled executables to evade detection. This means that the malware code uses legitimate scripting tools like Windows PowerShell.

Question 42

What is a rootkit?

Answer 42

backdoor malware that changes core system files and programming interfaces so that local shell processes no longer reveal their presence.

Question 43

Man-in-the-Middle (MitM) attack is a ...

Answer 43

form of eavesdropping in which the attacker makes an independent connection between two victims and steals information to use fraudulently

Question 44

Pass-the-Hash attacks

Answer 44

if an attacker obtains the hash of a user's password, it is possible to authenticate with the hash, without cracking it

Question 45

Describe Birthday Attack Describe a collision. What can this attack do?

Answer 45

Is a type of Brute force attack aimed at exploiting collisions in hash functions. A collision is where a function produces the same hash value for two different plaintexts. This type of attack can forge a digital signature.

Question 46

Macro Virus uses

Answer 46

The programming features available in Microsoft Office file

Question 47

Program Virus

Answer 47

Sequences of code insert themselves into another executable program. When executing the application, the virus code becomes active.

Question 48

Worm

Answer 48

memory-resident viruses that replicate over network resources. The primary effect of a worm infestation is to rapidly consume network bandwidth as the worm replicates. A worm may also be able to perform a Denial of Service attack by crashing operating systems and servers.

Question 49

What is a RAT's (vulnerability)

Answer 49

Remote Access Trojan

Question 50

PUP

Answer 50

Potentially unwanted program

Question 51

Skimming

Answer 51

like credit card skimming RFID attack where an attacker uses a fraudulent RFID reader to read the signals from a contactless bank card.

Question 52

the intimidation tactic

Answer 52

Compared to using a familiarity/liking is riskier as there is a greater chance of arousing suspicion and the target reporting the attack attempt.

Question 53

the authority tactic? how Risky is to compared to other tactiques?

Answer 53

Compared to using a familiarity/liking approach is riskier as there is a greater chance of arousing suspicion and the target reporting the attack attempt.

Question 54

Describe Liking approach. How risky is it?

Answer 54

is low risk. If the victim refuses the request, it is unlikely to cause suspicion and the social engineer can move to a different target without being detected.

Question 55

Familiarity approach

Answer 55

Is low risk. If the victim refuses the request, it is unlikely to cause suspicion and the social engineer can move to a different target without being detected.

Question 56

Rogueware

Answer 56

is a fake antivirus web pop-up that claims to have detected viruses on the computer and prompts the user to initiate a full scan, which installs the attacker's Trojan.

Question 57

Phishing

Answer 57

is a combination of social engineering and spoofing, where the attacker sets up a spoof website to imitate a trusted one.

Question 58

Spyware

Answer 58

is a program that monitors user activity and sends the information to someone else. This can occur with or without the user's knowledge.

Question 59

In a hoax attack ...

Answer 59

an email alert or web pop-up will claim to have identified some sort of security problem, such as a virus infection, and offer a tool to fix the problem. The tool, of course, will be some sort of Trojan application.

Question 60

SPIM

Answer 60

Spam in Instant Messengers

Question 61

SoC

Answer 61

System on Chip

Question 62

What is Domain Name System (DNS) poisoning

Answer 62

is an attack that compromises the process by which clients query name servers to locate the IP address for a Fully Qualified Domain Name (FQDN).

Question 63

Domain hijacking

Answer 63

Is an attack where an adversary acquires a domain such as the full.com address for a company's trading name or trademark.

Question 64

A disassociation attack

Answer 64

uses disassociation packets to remove a known wireless access point (WAP) from a client’s list of available networks. This is a type of DoS on wireless networks.

Question 65

Describe a deauthentication attack? What kind of attack is it?

Answer 65

sends a stream of spoofed frames to cause a client to deauthenticate. This is a type of DoS attack on wireless networks.

Question 66

What does an amplification attack target?

Answer 66

targets vulnerabilities in the headers and payloads of specific application protocols. For example, one type of amplification attack targets DNS services with bogus queries.

Question 67

An operational technology attack i

Answer 67

s a network attack that involves connections between embedded system devices. The term is "operational" because these systems monitor and control physical electromechanical components.

Question 68

Media Access Control (MAC) cloning or address spoofing,

Answer 68

changes the hardware address configured on an adapter interface or asserts the use of an arbitrary MAC address.

Question 69

Domain hijacking

Answer 69

is a type of hijacking attack where the attacker steals a domain name by altering its registration information and then transferring the domain name to another entity. Brandjacking is another term for domain hijacking.

Question 70

Kiting

Answer 70

is the act of continually registering, deleting, and reregistering a name within the five-day grace period without having to pay for it.

Question 71

Describe Tasting (exploit)

Answer 71

is a Domain Name Server (DNS) exploit that involves registering a domain temporarily to see how many hits it generates within the five-day grace period.

Question 72

An On-path attack

Answer 72

Is a form of eavesdropping where the attacker makes an independent connection between two victims and steals information to use fraudulently.

Question 73

A replay attack

Answer 73

consists of intercepting a key or password hash, then reusing it to gain access to a resource, such as the pass-the-hash attack.

Question 74

Bluesnarfing

Answer 74

refers to using an exploit in Bluetooth to steal information from someone else's phone. The exploit (now patched) allows attackers to circumvent the authentication mechanism.

Question 75

What is Bluejacking?

Answer 75

Bluetooth-discoverable device is vulnerable, similar to spam, where someone sends an unsolicited text (or picture/video) message or vCard (contact details). This can be a vector for Trojan malware.

Question 76

An evil twin (or sometimes called WiPhishing) is

Answer 76

a rogue Access Point (AP) masquerading as a legitimate one.

Question 77

A Man-in-the-Browser (MitB) attack

Answer 77

occurs when the attacker compromises the web browser by installing malicious plug-ins, scripts, or intercepting API calls. Attackers can install vulnerability exploit kits on a website and will actively try to exploit vulnerabilities in clients browsing the site.

Question 78

When does HTTP Response Splitting happen?

Answer 78

Occurs when the attacker would craft a malicious URL and convince the victim to submit it to the web server.

Question 79

What are LSOs, or Flash cookies? What can be done with them?

Answer 79

are data stored on a user's computer by websites that use Adobe Flash Player. A site may be able to track a user's browsing behavior through LSOs.

Question 80

Personal Area Network (PAN)

Answer 80

Is a network that connects two to three devices with cables.

Question 81

jamming attack

Answer 81

Interference can disrupt a wireless network from other radio sources. One way to defeat a jamming attack is to locate the offending radio source and disable it. Another way to defeat a jamming attack is to boost the signal of the legitimate equipment.

Question 82

What does Using a spectrum analyzer do?

Answer 82

Will only detect the source of interference but does not defeat or prevent it.

Question 83

What are weaknesses of NFC (Near Field Communications)?

Answer 83

Does not provide encryption, so eavesdropping and Man-in-the-Middle attacks are possible if the attacker can find some way of intercepting the communication and other software services are not encrypting the data.

Question 84

What is DNS Server Cache poisoning?

Answer 84

is a redirection attack, that aims to corrupt the records held by the DNS server itself. The intention is to redirect traffic for a legitimate domain to a malicious IP address.

Question 85

With a SPAN port ...

Answer 85

The sensor attaches to a specially configured port on the switch that receives copies of frames addressed to nominated access ports (or all the other ports).

Question 86

DNS harvesting

Answer 86

Uses Open Source Intelligence (OSINT) to gather information about a domain (subdomains, hosting provider, administrative contacts, and so on).

Question 87

What does an attacker do when performing host discovery?

Answer 87

on an internetwork (a network of routed IP subnets), the attacker will want to discover how the routers connect the subnets, and whether any misconfigured gateways between subnets exist.

Question 88

Ping sweep

Answer 88

The ping command can detect the presence of a host on a particular IP address or one that responds to a particular host name. Users can apply a simple script to perform a ping sweep.

Question 89

What is SIEM

Answer 89

Security Information and Event Management (SIEM)

Question 90

What is DLP System?

Answer 90

Data Loss Protection System - They can log policy violations, like the use of a USB thumb drive from a client computer. The DLP system can forward that data to a SIEM for further analysis and reporting. I can also examine mail gateways and determine if email content can be sent.

Question 91

What is SCAP ?

Answer 91

Security content automation protocol (SCAP) determines whether a computer meets a configuration baseline. Perform configuration reviews to ensure the system is secure and ready for production

Question 92

What is Nikto

Answer 92

A web application scanner, searches for known web exploits, such as SQL injection and cross-site scripting (XSS).

Question 93

What does Tenable Nessus do?

Answer 93

It's a network vulnerability scanner, tests network hosts, including client computers, and compares them with known vulnerabilities.

Question 94

The chief information officer (CIO) should be concerned with reviewing in regards to a SIEM?

Answer 94

The overall analysis report which may showcase a number of incidents in the past week, or how many systems are currently on an old version of Windows.

Question 95

What are the security engineers concerned with in regards to a SIEM?

Answer 95

Configuring appropriate data inputs, so they analyze and report an accurate account of the security of the network.

Question 96

What is Sentiment analysis?

Answer 96

Is a machine learning technique of log analysis to identity intent. This can be used, for example, to monitor social media for brand "incidents," such as a customer complaining on Twitter about poor service.

Question 97

What is Security orchestration, automation, response (SOAR)

Answer 97

Is a solution to the volume of alerts overwhelming an analyst's ability to respond. It analyzes an organization's store of security intelligence and uses deep learning techniques to: • automate and provide data enrichment to • improve incident response. • improve threat hunting workflows.

Question 98

What is Syslog

Answer 98

is a collector tool that allows for a centralized collection of events from multiple sources. It is an open format for event logging messages.

Question 99

What is Security content automation protocol (SCAP)?

Answer 99

Determines whether a computer meets a configuration baseline. Perform configuration reviews to ensure the system is secure and ready for production.

Question 100

What is The common vulnerability scoring system (CVSS) ?

Answer 100

Is a metric score between 0 to 10 based on the characteristic of the vulnerability, such as whether it can be triggered remotely or if it requires user intervention.

Question 101

What is intelligence fusion?

Answer 101

Techniques applied with security information, event management (SIEM), and threat analytics platforms. Analysts can develop queries and filters to correlate threat data from these systems.

Question 102

What is Maneuvering military droctine? Describe a defensive maneuver.

Answer 102

Is a military doctrine term relating to obtaining positional advantage. In a defensive maneuver, an analyst can perform passive discovery techniques so that threat actors have no hint that the analyst has discovered an intrusion.

Question 103

What could Threat feeds or notifications of current and new threats initiate?

Answer 103

may initiate updates to security policies and even signatures, to ensure security administrators can monitor those threats.

Question 104

What is Footprinting?

Answer 104

Using the network mapper (Nmap) tool to obtain information about a host or network topology - Non-intrusive footprinting is limited to packet sniffing.

Question 105

Describe a white box pen test

Answer 105

the consultant has complete access to information about the network. Sometimes the consultant will conduct this type of test, as a follow-up to a black box test, to fully evaluate flaws discovered during the black box test. - No Recon Needed!!!

Question 106

What does the White Team do?

Answer 106

The white team is responsible for setting the rules of engagement and monitors the penetration testing exercise.

Question 107

What does the purple team do?

Answer 107

The purple team members act as facilitators during a purple team exercise. This type of exercise involves collaboration between red and blue teams during breaks throughout the exercise.

Question 108

What is War flying

Answer 108

War flying is war driving, but in the air with a drone or unmanned aerial vehicle (UAV). This maps the location and type of wireless networks operated by the target.

Question 109

Which of the following penetration steps should a tester perform before internal reconnaissance?

Answer 109

Persistence followed by further reconnaissance, occurs when the pen tester attempts to map out the internal network and discover the services running on it and accounts configured to access it.

Question 110

What is Black Box Pen Testing?

Answer 110

During a black box pen test, the consultant has no privileged information about the network, its security systems, and its configuration. Black box tests are useful for simulating the behavior of an external threat.

Question 111

What step is "Action on objectives" on a penetration test? How can you describe it?

Answer 111

Action on objectives is the very last step of a penetration test after establishing a pivot point and escalating privileges. This step is basically data exfiltration.

Question 112

What does Log Aggregation refers to?

Answer 112

Log aggregation refers to normalizing data from different sources so that it is consistent and searchable. This makes it easier to integrate with dynamic reporting engines.

Question 113

What are Logic Statements used for in Program developing?

Answer 113

If the pointer is set to a null value by a malicious process, this creates a null pointer exception, and the process will crash. Programmers can use logic statements to test that a pointer is not null before trying to use it.