Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IST-267 Network Vulnerabilitiy Assess > Chapter 1 > Flashcards

Chapter 1 Flashcards

1
Q

What is the CIA triad?

A

Confidentiality (prevent unauthroized access to information or systems)

Integrity (prevent unauthroized modification of information or systems)

Availability (ensure use of information and systems is possible)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the DAD triad?

Disalde

A

Disclosure (gain unauthorized access)

Alteration (make unauthorized changes)

Denial (prevent legit use of systems and info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the four stages of the CompTIA Penetration
Test?

A

Planning and
Scoping
(

Information
Gathering and
Vulnerability
Scanning

Attacking and
Exploiting

Reporting and
Communicating
Results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the steps in The Cyber Kill Chain?

A

Reconnaissance.
(
Weaponization.
(
Delivery.
(
Exploitation.
(
Installation.
(
Command and control.
(
Actions on Objectives.
(

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Reconnaissance in the cyber kill chain?

A

(Attackers gather open source intelligence and conduct initial scans of target environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Weaponization in the cyber kill chain?

A

Attackers develop a specific
attack tool designed to exploit the vulnerabilities identified during reconnaissance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Delivery in the cyber kill chain?

A

Attackers next must deliver that malware to the target. (Network vuln, social enginnering, infected USB, sending as email attachment,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Exploitation in the cyber kill chain?

A

The malware gains access to the targeted system. Victim opens a malicious file or when the attacker exploits a vulnerability over the network or otherwise gains a foothold on the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Installation in the cyber kill chain?

A

The attacker uses the
initial access provided by the malware to establish permanent, or persistent, access to the
target system. (Making a backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Command and Control in the cyber kill chain?

A

After getting permanent access the attacker may use a remote shell or other means to control the system.

They can control it manually or may connect an automated command-and-control (C2C) network that provides it with instructions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Actions on Objectives in the cyber kill chain?

A

Attacker uses the system to advance the original objectives of their attack. (theft, use of resources, mine crypto, modification or deletion of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Tom is running a penetration test in a web application and discovers a flaw that allows
him to shut down the web server remotely.

What goal of penetration testing has Tom most
directly achieved?
A. Disclosure
B. Integrity
C. Alteration
D. Denial

A

D. Denial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Brian ran a penetration test against a school’s grading system and discovered a flaw that
would allow students to alter their grades by exploiting a SQL injection vulnerability.

What
type of control should he recommend to the school’s cybersecurity team to prevent students
from engaging in this type of activity?

A. Confidentiality
B. Integrity
C. Alteration
D. Availability

A

B. Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Edward Snowden gathered a massive quantity of sensitive information from the National
Security Agency and released it to the media without permission.

What type of attack
did he wage?
A. Disclosure
B. Denial
C. Alteration
D. Availability

A

A. Disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Assuming no significant changes in an organization’s cardholder data environment, how
often does PCI DSS require that a merchant accepting credit cards conduct penetration testing?
A. Monthly
B. Semiannually
C. Annually
D. Biannually

A

C. Annually
(or after any significant change in the cardholder data environment)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which one of the following is not a benefit of using an internal penetration testing team?
A. Contextual knowledge
B. Cost
C. Subject matter expertise
D. Independence

A

D. Independence

17
Q

Which one of the following is not a reason to conduct periodic penetration tests of systems
and applications?
A. Changes in the environment
B. Cost
C. Evolving threats
D. New team members

A

B. Cost

18
Q

Rich recently got into trouble with a client for using an attack tool during a penetration
test that caused a system outage. During what stage of the penetration testing process
should Rich and his clients have agreed on the tools and techniques that he would use during the test?
A. Planning and Scoping
B. Information Gathering and Vulnerability Scanning
C. Attacking and Exploiting
D. Reporting and Communication Results

A

A. Planning and Scoping

19
Q

Which one of the following steps of the Cyber Kill Chain does not map to the Attacking and
Exploiting stage of the penetration testing process?
A. Weaponization
B. Reconnaissance
C. Installation
D. Actions on Objectives

A

B. Reconnaissance

20
Q

Beth recently conducted a phishing attack against a penetration testing target in an attempt
to gather credentials that she might use in later attacks. What stage of the penetration testing
process is Beth in?

A

B. Attacking and Exploiting (she is conducting an
active social engineering attack.

21
Q

Which one of the following security assessment tools is not commonly used during the
Information Gathering and Vulnerability Scanning phase of a penetration test?
A. Nmap
B. Nessus
C. Metasploit
D. Nslookup

A

C. Metasploit
(exploitation framework , suited for Attacking and Exploiting phase

22
Q

During what phase of the Cyber Kill Chain does an attacker steal information, use computing resources, or alter information without permission?

A

C. Actions on Objectives

23
Q

Grace is investigating a security incident where the attackers left USB drives containing
infected files in the parking lot of an office building. What stage in the Cyber Kill Chain
describes this action?

A

C. Delivery

24
Q

Which one of the following is not an open source intelligence gathering tool?
A. WHOIS
B. Nslookup
C. Nessus
D. FOCA

A

C. Nessus (commercial vulnerability scanner)

FOCA (harvests information from files)

25
Q

Which one of the following tools is an exploitation framework commonly used by penetration testers?
A. Metasploit
B. Wireshark
C. Aircrack-ng
D. SET

A

A. Metasploit

26
Q

Which one of the following debugging tools does not support Windows systems?

A. GDB
B. OllyDbg
C. WinDbg
D. IDA

A

A. GDB (for Linux systems)

27
Q

Which one of the following tools is not a password-cracking utility?
A. OWASP ZAP
B. Cain and Abel
C. Hashcat
D. Jack the Ripper

A

A. OWASP ZAP (web proxy tool)

28
Q

What is the final stage of the Cyber Kill Chain?

A

C. Actions on Objectives

29
Q

Which of the following activities assumes that an organization has already been
compromised?

A. Penetration testing
B. Threat hunting
C. Vulnerability scanning
D. Software testing

A

B. Threat hunting

30
Q

Alan is creating a list of recommendations that his organization can follow to remediate
issues identified during a penetration test.

In what phase of the testing process is Alan participating?

A

B. Reporting and Communication

31
Q

Which one of the following vulnerability scanners is specifically designed to test the security
of web applications against a wide variety of attacks?

A. OpenVAS
B. Nessus
C. SQLmap
D. Nikto

A

D. Nikto

IST-267 Network Vulnerabilitiy Assess (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions