Domain 2.4 Given a scenario, analyze and interpret output from security technologies.

Question 1

HIDS/HIPS

Answer 1

installed on one host and only protects that single host

Question 2

File integrity Verifier

Answer 2

file integrity products are configured to check to see if certain files have been changed and to record such activity. (ie. Tripwire)

Question 3

Application Whitelist

Answer 3

A list of applications explicitly allowed to be installed or used on a computer.

Question 4

Application Blacklist

Answer 4

Software specifically not allowed to be used.

Question 5

Removable media control

Answer 5

a Group Policy that now removable media (CD, USB, Floppy) can be used.

Question 6

Patch Management Tool for microsoft

Answer 6

WSUS, Windows Server Update Service. pushes patches to your network hosts.

Question 7

Single point of failure (SPOF)

Answer 7

if a single item fails your entire network goes down.

Question 8

Data Loss Prevention (DLP)

Answer 8

Software attempts to detect exfiltration of data.

Question 9

Microsofts version of Data execution prevention (DEP)

Answer 9

For Microsoft, this is called UAC (User Account Control.) requires admin credentials in order to run a program. for instance if something is not on the whitelist it may need excalated priviledges to install.

Question 10

Web Application Firewall (WAF)

Answer 10

A WAF is the best mitigation for an SQL injection or a XSS Attack.

Question 11

Look at the following output from a file integrity application and determine when the system was compromised?

/etc/password

1. 1/1/2018-14:30-e0d123e5f316bef78bfdf5a008837577
2. 1/1/2018-14:45-e0d123e5f316bef78bfdf5a00883757
3. 1/1/2018-15:00-d86c4246f3c0eb516628bf324d6b9a3 4. 1/1/2018-15:15-66bd00e43ff8b932c14140472c4b8cc6

/boot/initrd.img

5. 1/1/2018-14:00-ff6626c69507a6f511cc398998905670
6. 1/1/2018-14:30-ff6626c69507a6f511cc398998905670
7. 1/1/2018-15:00-cc273fe9d442850fa18c31c88c823e07
8. 1/1/2018-15:30-cc273fe9d442850fa18c31c88c823e07

Answer 11

4. 1/1/2018-15:15-66bd00e43ff8b932c14140472c4b8cc6

The HASH has changed so that means the file was changed here.

Question 12

You are analyzing a packet capture file and notice that a host made a connection with another host using a nonstandard port. Which line would make a connection with the other host?

1. Mkdir/local/user/bin/tempdirectory
2. Ping -c 15 8.8.4.4 - 1500
3. Traceroute 8.8.4.4
4. nc -1 192.168.27.41 -p 1337
5. pskill pid 4723
6. dig 8.8.8.8

Answer 12

4. nc -1 192.168.27.41 -p 1337