Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

IST-292 Network Security II > Final 7-12 > Flashcards

Final 7-12 Flashcards

(87 cards)

Start Studying
1
Q

What is a United Threat Management device?

A

A piece of hardware that can do email spam filtering, malware protection, firewall capabilities, and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an MUA and MTA , what do they do?

A

Mail User Agent & Mail Transfer Agent. A MUA is what is used to read and send mail from an endpoint (gmail). MTAs are programs that accept email messages from senders and route them toward their recipients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an endpoint?

A

A network-connected hardware device (phone, computer, tablet)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What products can assist in monitoring endpoint hardware?

A

An Endpoint Protection Platform (EPP) has antimalware scanning.

Endpoint Detection and Response (EDR)
Detects & investigates security incidents, & the ability to intervene and even remediate endpoints back to a preinfection state.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

While identifying software for the presence of malware, how is that done with EPP and EDR?

A

Reverse engineering malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

known-good behavior

A

“Normal” processes and actions used as a standard.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

User and Entity Behavior Analytics?

A

Normal behaviors for users and entities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Layer 2 of the OSI model?

A

Data Link Layer, divides data into packets, handles error detection and correction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Packet and protocol analysis?

A

Analyzing packets and the protocols that are used on a network in search of malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a TAP?

A

Test Access Point, transmits send and receive data streams simultaneously. Passive device, cannot be attacked. “court approved”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What tools can be used for packet analysis?

A

Wireshark (gui tool), EtherApe (virtual interpretation), Tcpdump (command-line, UNIX and LINUX), Tcpreplay (editing and replaying packets)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the DGA technique?

A

A domain generation algorithm can be used to create multiple random potential URLs for malware to communicate with a command and control server over.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Nicholas wants to implement an additional feature for the employees at his organization to be able to verify who the sender of the message is and that the message hasn’t been tampered with in transit. What will be required to send the message?

A

The message hash needs to be encrypted using the sender’s private key. The receiver will decrypt the message hash using the sender’s public key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can be added to prevent SQL injection or cross-site scripting attacks?

A

web application firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Jonquil has been asked to implement a system that collects information for analysis about traffic flowing through the routers and switches on her company’s network. What protocol should she consider to implement this type of setup?

A

NetFlow is a protocol developed by Cisco that collects info about traffic flowing through devices on a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Data correlation?

A

Looking for reasons why shit happens in event sequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is syslog?

A

A means by which network devices can use a standard message format to communicate with a logging server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Suki wants to analyze all of the traffic being sent to and from a group of 10 computers that are all connected to the same networking device. He decides to install a sniffing device that will capture packets and then enable port mirroring on the networking device to send copies of the traffic to the sniffing device. What device is he using?

A

A switch, he is port mirroring to send copies of frames to a certain port for analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Sanvi is a cybersecurity analyst at her company and has been asked to review a new platform that will combine software programs and tools in order to orchestrate a range of security operations, threat intelligence sources, as well as incident response mechanisms all into one. Which has she been asked to review?

A

SOAR (Security orchestration, automation, and response) combines software programs and tools in order to orchestrate a range of security options, threat intelligence sources, and incident response mechanisms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is data enrichment?

A

The process of enhancing data for cybersecurity analysis. Combining data from multiple orgs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is SCAP?

A

Security Content Automation Protocol. Open standard that enables an automated vulnerability management, measurement, and policy compliance evaluation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the standards of SCAP?

A

Common Vulnerabilities and Exposures (CVE)
Common Configuration Enumeration (CCE)
Common Platform Enumeration (CPE)
Common Weakness Enumeration (CWE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define the standards of SCAP.

A

Common Vulnerabilities and Exposures (cve)
Vulnerabilities in operating systems and application software

Common Configuration Enumeration CCE
Configuration best-practice statements

Common Platform Enumeration CPE
Vulnerabilities in operating systems, applications, and hardware devices

Common Weakness Enumeration CWE
Software design flaws that could result in a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Clustering?

A

A form of statistical analysis that separates groups (clusters) of similar data points from a larger set based on specific characteristics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
stack counting?
the application of frequency analysis (how often something occurs) to large sets of data to identify outliers.
26
Integrated intelligence?
Combining different sources to be used in threat hunting.
27
Artyom wants to implement a new threat detection and analysis system which automates a lot of the process of finding new intrusions and breaches at his company. He wants the system to analyze user behavior and determine when there are anomalies and abnormalities. What feature should he look for when looking for a new system to implement?
Machine learning
28
Attack vector?
The methods by which threat actors will use to attack systems, networks, and devices of an enterprise.
29
executable process analysis
Tools that allow for an investigation of how malware functions.
30
What is DevSecOps?
The process of integrating secure development best practices and methodologies into application software development and deployment processes using the agile model.
31
What are the automated courses of action for DevSecOps?
Continuous Monitoring (examining processes in real-time Continuous Validation (ongoing approvals of code), Continuous Integration (ensuring security features are incorporated at each stage), Continuous Delivery (moving code to each stage as it is completed), Continuous Deployment (continual code implementation).
32
HIPAA?
Health Insurance Portability and Accountability Act
33
What are the critical data types?
Personally identifiable information (PII) Sensitive Personal Information (SPI) Personal health information (PHI) Financial information Intellectual property High value asset (HVA) information Corporate information
34
What do PII AND SPI consist of?
Personally identifiable information (full name,ssn, driver's license number) Sensitive Personal Information (biometric data,sex, political party affiliation)
35
What do (PHI) & Financial information consist of?
Personal health information (mental health history, healthcare services used) Financial information (name, card number, expiration date)
36
What are Intellectual property, corporate information & (HVA) information?
Intellectual property (trademarks, copyrights, patents) creation or invention of the mind Corporate information (replacement cost, price earnings ratio, discounted cash flow) High value asset information (assets, systems, instructions)
37
Compare downtime and recovery time.
Downtime is the time an incident interrupts normal business processes Recovery time is time needed for the IT systems to be disinfected and returned to normal
38
Data integrity?
The correctness and completeness of data.
39
system process criticality?
The degree to which the impacted systems affect the overall functionality of the entire system.
40
What is the Sarbanes-Oxley Act? SOX
Defines regulations for financial reporting and auditing in the United States.
41
General Data Protection Regulation?
Will inform the EU's Information Commissioner's Office (ICO) if they suffer a breach involving personal info of employees/customers.
42
Personal Information Protection and Electronic Documents Act?
Canadian, protects user data.
43
Lessons learned report?
Should be created at the end of projects to discuss what is being done correctly, what isn't being done correctly, and what needs to change.
44
What are the steps of the Cyber Incident Response Plan?
Preparation Identification Analysis Containment Eradication Recovery Follow-up
45
Alika has just finished eradicating a piece of malware from a computer system. What should she do next as part of the validation process?
Patching
46
What are the steps in the validation process?
Patching (All patches should be applied) Permissions (review compromised system) Scanning (scan and identify issues) Security Monitoring (check system is monitored correctly)
47
secure disposal?
The destruction of a hard drive.
48
California Consumer Privacy Act (CCPA)
Allows users to know what personal data is being collected about them, to know whether their personal data is sold or disclosed and to whom, to say no to the sale of personal data.
49
What symptom might indicate a potential DDoS attack?
A large, constant spike in bandwidth consumption
50
Bartolo sees a notification from a security device on the perimeter of the network that ICMP echo requests have been received for the entire range of IP addresses on the external subnet. Which of the following has been detected?
Ping sweep, ICMP echo requests are sent to a range of addresses to discover which hosts may be online and active.
51
nslookup?
name server lookup, used to obtain the IP address or domain name of a host.
52
Chain of custody?
To keep track of the people who have had access to certain items, such as pieces of evidence
53
Server Message Block, SMB?
Protocol for a network that uses Microsoft Windows. Uses named pipes or logical connections.
54
write blocker?
A device or special software on a digital forensics workstation that allows a hard drive to be examined without the possibility of accidentally writing to the drive.
55
Computers that communicate with a command and control server are referred to as _____?
bots or zombies. A collection of bots communicating with the same command and control server and under the control of the same person or group is known as a botnet.
56
Kevin is working the after-hours shift in the NOC and receives an alert that there has been a potential intrusion into one of the servers. He pulls out the incident response plan and sees that the first step is to notify the on-call manager. Where might he find that information?
The escalation list
57
The security administrator for a large organization wants to prevent customer service employees from being able to access control panels or command prompts. Which of the following could the security administrator implement in order to accomplish this goal?
Group policy
58
Nichole, a cybersecurity analyst, has received an alert about a potential ping flood on one of the company's Windows servers. She is able to connect to the server via an out-of-band management network. What native tool might help her verify what is occurring on the server at the moment?
Resource Monitor (audits and displays CPU and other endpoint resources)
59
Ines is reviewing the network traffic logs and sees what appears to be beaconing. Which of the following best describes the traffic she has noticed?
The traffic is most likely being sent to a command and control server.
60
data ownership policy
A policy that defines the duties of a data custodian and a data owner for the protection of data.
61
acceptable use policy (AUP)?
A policy that defines the actions users may perform while accessing devices and networks belonging to the organization.
62
data retention policy?
A policy that outlines how to maintain information in the user’s possession for a predetermined length of time.
63
continuous monitoring policy?
A policy that defines how the organization may monitor its employees.
64
What is an audit?
An audit is an evaluation by an external third party that examines the security of an organization.
65
Craig has been asked to implement the ISO standards for cybersecurity in his organization. With which of the following families of standards should he become familiar?
ISO 27000
66
An outside consultant has been hired to perform a risk analysis for a company. As part of the report, he details the likelihood of certain events occurring, as well as the impact they would have. What could he use to display this information in his report?
A risk matrix, displays the results of qualitative, quantitative, and semi-quantitative risk calculations.
67
What are the types of system controls?
Deterrent-discourage security violations Detective-identifies threats Corrective-mitigates damage caused Preventative-stop threats for coming in contact with vuln Physical-security in a defined location Compensating-provides an alt to normal controls
68
What institute in the U.S. government publishes cybersecurity guidelines?
NIST (National Institute of Standards and Technology)
69
Business Impact Analysis. (BIP)?
quantifies the impact a loss of functions may have on the business
70
Data Loss Prevention (dlp)?
Security tools used to recognize and identify data critical to the organization and ensure it is protected.
71
John the Ripper?
Brute force password cracker
72
In an in house pen testing exercise, what color is the team doing the penetrating?
Red team
73
In an in house pen testing exercise, what color is the team defending?
Blue Team
74
Josh wants to be able to prevent tablets and other devices from accessing certain systems unless the devices are physically on the company's multi-building HQ campus. What can he use as a solution?
Geofencing. Defines geographical boundaries for an app.
75
What are the 3 components of the CIA triad?
Confidentiality-Only you and people you want can view the data Integrity-Your data has not been altered Availability-You can freely access your data
76
What are the AAA of computer resources?
Authentication-Validation of credentials Authorization-Permission granted for admittance Accounting-Record of user actions
77
Who in an IT department is responsible for collecting the data?
Data controller
78
What is an NDA?
Non disclosure agreement. Any information learned by the consultant will be highly confidential and is not to be disclosed to anyone who is unauthorized to view the information.
79
Discretionary Access Control?
Discretionary access control is where every object has an owner who has total control over that object.
80
Payment Card Industry Data Security Standard (PCI DSS)?
Set of standards to which merchants must be compliant.
81
Digital Rights Management (DRM)?
Access control technologies, designed to restrict the use and duplication of digital content across a wide range of devices.
82
Aaron has been tasked with embedding unique information within albums that are going to be distributed by the record label that he works for before they are protected by DRM. Which of the following describes what he has been asked to do?
Watermarking
83
Mandatory Access Control (MAC)?
Users assigned controls by custodian's desires
84
What is an Access Control List (ACL)?
Contains rules that administer certain assets by granting or denying access to them.
85
What is data sovereignty?
Data collected from a nation’s citizens must be stored on servers in that country.
86
Gramm–Leach–Bliley Act (GLBA)?
Financial institutions must explain their information-sharing practices to their customers and to safeguard sensitive data.
87

IST-292 Network Security II (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions