Cyber Security Fundamentals Flashcards

Question

Exploitation (Attack)

Answer 1

After a weaponized payload is delivered to a target endpoint, it must be triggered. An end user may unwittingly trigger an exploit by clicking a malicious link or opening an infected attachment in an email. An attacker also may remotely trigger an exploit against a known server vulnerability on the target network.

Answer 2

an attacker will escalate privileges on the compromised endpoint, for example, by establishing remote shell access and installing rootkits or other malware.

Answer 3

Attackers establish encrypted communication channels back to command-and-control (C2) servers across the internet so that they can modify their attack objectives and methods as additional targets of opportunity are identified within the victim network, or to evade any new security countermeasures that the organization may attempt to deploy if attack artifacts are discovered.

Answer 4

Attackers often have multiple, different attack objectives, including data theft; destruction or modification of critical systems, networks, and data; and denial-of-service (DoS).

Answer 5

a method for enumerating a vulnerability's key characteristics and generating a numerical score that reflects the vulnerability's severity.

Answer 6

A logic bomb is malware that is triggered by a specified condition, such as a given date or a particular user account being disabled.

Answer 7

Spyware and adware are types of malware that collect information, such as internet surfing behavior, login credentials, and financial account information, on an infected endpoint.

Answer 8

A rootkit is malware that provides privileged (root-level) access to a computer.

Answer 9

A backdoor is malware that allows an attacker to bypass authentication to gain access to a compromised system.

Answer 10

Ransomware is malware that locks a computer or device (Locker ransomware) or encrypts data (Crypto ransomware) on an infected endpoint with an encryption key that only the attacker knows, thereby making the data unusable until the victim pays a ransom (usually with cryptocurrency, such as Bitcoin). Reveton and LockeR are two examples of Locker ransomware.

Answer 11

A virus is malware that is self-replicating but must first infect a host program and be executed by a user or process.

Answer 12

A worm is malware that typically targets a computer network by replicating itself to spread rapidly.

Answer 13

Advanced malware often uses common obfuscation techniques to hide certain binary strings that are characteristically used in malware and therefore easily detected by anti-malware signatures. Advanced malware might also use these techniques to hide an entire malware program.

Answer 14

Some advanced malware has entire sections of code that serve no purpose other than to change the signature of the malware, thus producing an infinite number of unique signature hashes. Techniques such as polymorphism and metamorphism are used to avoid detection by traditional signature-based anti-malware tools and software. For example, a change of just a single character or bit of the file or source code completely changes the hash signature of the malware.

Answer 15

Advanced malware takes full advantage of the resiliency built into the internet itself. Advanced malware can have multiple control servers distributed all over the world with multiple fallback options.

Answer 16

Updates from C2 servers can also completely change the functionality of advanced malware.

Answer 17

Step 1: Compromise and Control a System or Device Step 2: Prevent Access to the System Step 3: Notify Victim Step 4: Accept Ransom Payment Step 5: Return Full Access

Answer 18

Vulnerabilities are routinely discovered in software at an alarming rate. Vulnerabilities may exist in software when the software is initially developed and released, or vulnerabilities may be inadvertently created, or even reintroduced, when subsequent version updates or security patches are installed.

Answer 19

An exploit is a type of malware that takes advantage of a vulnerability in an installed endpoint or server software such as a web browser, Adobe Flash, Java, or Microsoft Office.

Answer 20

1. Creation 2. Action 3. Techniques 4. Heap Spary

Answer 21

1. Software Deployed 2. Vulnerability Discovered 3. Exploits Begin 4. Public Announcement of Vulnerability 5. Patch Released 6. Patch Deployed 7. Protected by Vendor Patch

Answer 22

Spam - Email Spim - instant message Vish - voicemail / robocalling

Answer 23

Spear phishing is a targeted phishing campaign that appears more credible to its victims by gathering specific information about the target, giving it a higher probability of success.

Answer 24

Whaling is a type of spear phishing attack that is specifically directed at senior executives or other high-profile targets within an organization. A whaling email typically purports to be a legal subpoena, customer complaint, or other serious matter.

Answer 25

Watering hole attacks compromise websites that are likely to be visited by a targeted victim-for example, an insurance company website that may be frequently visited by healthcare providers.

Answer 26

A pharming attack redirects a legitimate website’s traffic to a fake site, typically by modifying an endpoint’s local hosts file or by compromising a DNS server (DNS poisoning).

Answer 27

are individual endpoints that are infected with advanced malware that enables an attacker to take control of the compromised endpoint.

Answer 28

A botnet is a network of bots (often tens of thousands or more) working together under the control of attackers using numerous servers.

Answer 29

In a botnet, advanced malware works together toward a common objective, with each bot growing the power and destructiveness of the overall botnet.

Answer 30

Disabling Internet Access Monitor Local Network Activity Remove Infected Devices and Botnet Software Install Current Patches

Answer 31

A DDoS attack is a type of cyberattack in which extremely high volumes of network traffic such as packets, data, or transactions are sent to the target victim’s network to make their network and systems (such as an e-commerce website or other web application) unavailable or unusable.

Answer 32

Advanced Persistent Threats are a class of threats that are far more deliberate and potentially devastating than other types of cyberattacks.

Answer 33

The WEP encryption standard is no longer secure enough for Wi-Fi networks.

Answer 34

WPA2-PSK supports 256-bit keys, which require 64 hexadecimal characters.

Answer 35

WPA3 was published in 2018. Its security enhancements include more robust bruteforce attack protection, improved hotspot and guest access security, simpler integration with devices that have limited or no user interface (such as IoT devices), and a 192-bit security suite. Newer Wi-Fi routers and client devices will likely support both WPA2 and WPA3 to ensure backward compatibility in mixed environments.

Answer 36

way for an attacker to find a victim to exploit is to set up a wireless access point that serves as a bridge to a real network.

Answer 37

To understand a more targeted approach than the Evil Twin attack, think about what happens when you bring your wireless device back to a location that you’ve previously visited.

Answer 38

After a user connects to a Wi-Fi network that’s been compromised–or to an attacker’s Wi-Fi network masquerading as a legitimate network–the attacker can control the content that the victim sees. The attacker simply intercepts the victim’s web traffic, redirects the victim’s browser to a web server that it controls, and serves up whatever content the attacker desires.

Answer 39

Wi-Fi Attacks Doppelganger is an insider attack that targets WPA3-Personal protected Wi-Fi networks.

Answer 40

Wi-Fi Attacks Muted Peer and Hasty Peer are variants of the cookie guzzler attack which exploit the Anti-Clogging Mechanism (ACM) of the Simultaneous Authentication of Equals (SAE) key exchange in WPA3-Personal.

Answer 41

The Zero Trust security model addresses some of the limitations of perimeter-based network security strategies by removing the assumption of trust from the equation.

Answer 42

Ensure Resource Access Enforce Access Control Inspect and Log All Traffic

Answer 43

PAN‑OS® software runs Palo Alto Networks® next-generation firewalls. PAN-OS natively uses key technologies (App‑ID, Content‑ID, Device-ID, and User‑ID) to provide complete visibility and control of applications in use across all users, devices, and locations all the time. Inline ML and application and threat signatures automatically reprogram the firewall with the latest intelligence so allowed traffic is free of known and unknown threats.

Answer 44

Panorama network security management enables centralized control, log collection, and policy workflow automation across all next-generation firewalls (scalable to tens of thousands of firewalls) from a single pane of glass.

Answer 45

Cloud-based subscription services, including DNS Security, URL Filtering, Threat Prevention, and WildFire® malware prevention, deliver real-time advanced predictive analytics, AI and machine learning, exploit/malware/C2 threat protection, and global threat intelligence to the Palo Alto Networks Security Operating Platform.

Answer 46

Prisma Cloud is the industry’s most comprehensive threat protection, governance, and compliance offering. It dynamically discovers cloud resources and sensitive data across AWS, GCP, and Azure to detect risky configurations and identify network threats, suspicious user behavior, malware, data leakage, and host vulnerabilities.

Answer 47

Prisma Access is a Secure Access Service Edge (SASE) platform that helps organizations deliver consistent security to their remote networks and mobile users. It’s a generational step forward in cloud security, using a cloud-delivered architecture to connect all users to all applications.

Answer 48

Prisma SaaS functions as a multimode cloud access security broker (CASB), offering inline and API-based protection working together to minimize the range of cloud risks that can lead to breaches.

Answer 49

is designed to simplify security operations and considerably improve outcomes. Cortex is enabled by the Cortex Data Lake, where customers can securely and privately store and analyze large amounts of data that is normalized for advanced AI and machine learning to find threats and orchestrate responses quickly.

Answer 50

breaks the silos of traditional detection and response by natively integrating network, endpoint, and cloud data to stop sophisticated attacks. Taking advantage of machine learning and AI models across all data sources, it identifies unknown and highly evasive threats from managed and unmanaged devices.

Answer 51

is the only security orchestration, automation, and response (SOAR) platform that combines security orchestration, incident management, and interactive investigation to serve security teams across the incident lifecycle.

Answer 52

enables AI-based innovations for cybersecurity with the industry’s only approach to normalizing an enterprise’s data. It automatically collects, integrates, and normalizes data across an organization's security infrastructure. The cloud-based service is ready to scale from the start, eliminating the need for local compute or storage, providing assurance in the security and privacy of data.

Answer 53

contextual threat intelligence service speeds an organization's ability to analyze threats and respond to cyberattacks. Instant access to community-based threat data from WildFire, enhanced with deep context and attribution from the Palo Alto Networks Unit 42 threat research team, saves time. Security teams get detailed insight into attacks with prebuilt Unit 42 tags that identify malware families, adversaries, campaigns, malicious behaviors, and exploits without the need for a dedicated research team.

Answer 54

Enterprise Cloud Future

Answer 55

To execute massively scalable and increasingly effective attacks

Answer 56

Inadequate focus on detection and remediation

Answer 57

By leveraging automation and big data analytics

Cyber Security Fundamentals Flashcards

(87 cards)