Flashcards before the exam
(44 cards)
What are Zigbee and Z-wave used for in IoT?
Zigbee and Z-wave are protocols used in the Internet of Things (IoT) to network various devices. These include:
- Hub/control systems
- Smart devices
- Wearables
- Sensors
Para sa mga low-power wireless machine-to-machine (M2M) and internet of things (IoT)
What is the purpose of distributed consensus in a decentralized system?
Distributed consensus is used in a distributed or decentralized system to solve a specific computation. Its main purpose is to maintain the overall integrity of the distributed system or blockchain.
What is the best way to address an intrusion prevention system (IPS) failing to block a known exploit?
Regularly update IPS rule sets to include the latest threat signatures and attack patterns.
What are the risks of increasing IPS sensitivity indiscriminately or blocking all traffic by default?
Increasing sensitivity indiscriminately may result in false positives, and blocking all traffic by default would disrupt legitimate operations.
What is data minimization and its purpose?
Data minimization involves limiting data collection to only what is required to fulfill a specific purpose. Reducing the amount of information collected minimizes the amount and type of information that must be protected.
What should you attempt to exploit to gain access to all websites hosted on the same physical underlying server in application containers?
Exploit the common libraries shared by application containers.
Since application containers share the same host kernel and use common libraries, exploiting these libraries will grant access to every website on that server.
Explanation: Application containers are virtualized environments designed to package and run a single computing application or service. They share the same host kernel and common libraries. By exploiting these common libraries, you can gain access to all websites on the server, even if they are in separate application containers.
Detecting Malware Beaconing
Which of the following is NOT a typical means of identifying a malware beacon’s behavior on the network?
- The beacon’s protocol
- The removal of known traffic
- The beacon’s persistence
- The beaconing interval
The beacon’s protocol is not typically a means of identifying a malware beacon. A beacon can be sent over numerous protocols, including ICMP, DNS, HTTP, and numerous others. Filtering out beacons by protocol alone could lead to prematurely eliminating malicious behavior.
Explanation: Other factors like the beacon’s persistence (if it remains after a reboot of the system) and the beacon’s interval (the time elapsed between beaconing) are much better indicators for identifying a malicious beacon. Removing known traffic can minimize the amount of data to analyze, making it easier to detect malicious beacons without wasting time on non-malicious traffic.
Selecting a Symmetric Stream Encryption Cipher
Which symmetric stream encryption cipher should be selected for a video streaming service to ensure strong digital encryption on both desktop and mobile devices?
AES
RC4
ChaCha
3DES
ChaCha
Explanation: ChaCha is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. It is widely used in combination with the Poly1305 hashing algorithm in the TLS implementation of the Google Chrome browser and the Android operating system. ChaCha is also used by OpenSSH and the random number generator in BSD operating systems as a replacement for the older RC4 algorithm.
RC4: A stream cipher previously used in WEP and many SSL/TLS implementations. It is considered extremely vulnerable to attack and should not be used in modern applications.
AES: The current standard for the U.S. federal government’s symmetric block encryption cipher. It can use key sizes of 128-bits, 192-bits, or 256-bits with a 128-bit block size.
3DES: Triple Digital Encryption Standard (3DES) was built as a temporary replacement for the older DES algorithm.
What is the purpose of secure zones, and how do they align with Zero Trust principles?
Secure zones are designed to isolate critical assets and systems, allowing organizations to apply strict access controls that limit potential exposure to unauthorized users. This approach aligns with Zero Trust principles by ensuring sensitive areas of the network are protected.
Which support resource should you request to provide a specially crafted XML file for a known-environment web application assessment?
* SOAP project file
* Architectural diagrams
* Authorization to use a fuzzer
* An XSD file
Request an** XSD file**.
Explanation: Since the scenario states you will create a specially crafted XML file for the assessment, knowing the XML file structure the web application expects is crucial. An XML Schema Definition (XSD) enables developers to define the structure and data types for XML documents. By obtaining the XSD file, you will know the exact format expected by the application, saving time and reducing expenses during the assessment.
- SOAP project file: Not relevant for crafting the XML file.
* Architectural diagrams: Useful but not essential for XML file structure.
- Authorization to use a fuzzer: Important for other tests but not necessary for crafting the XML file.
Which term best defines the willingness of a company to accept a specific level of risk, such as $1,000,000 in Annual Loss Expectancy (ALE)?
Risk tolerance refers to the specific amount or level of risk that an organization is willing to accept or bear.
Explanation: In the context of the Development Group’s strategic planning for their SaaS application launch, risk tolerance is the term that describes the maximum acceptable loss they are willing to bear, which is pegged at $1,000,000 in Annual Loss Expectancy (ALE).
What is the difference between risk appetite and risk tolerance?
Risk appetite is the overall amount of risk an organization is willing to pursue or retain to achieve its objectives. It is broader in nature and less specific than risk tolerance. Risk tolerance refers to the specific amount or level of risk that an organization is willing to accept or bear for a particular system or product. In this scenario, risk appetite is incorrect because it describes the general willingness to take risks, not the precise amount of risk acceptable for a particular system or product.
Guest Wireless Device Authentication
Which of the following should be added to the Acceptable User Policy (AUP) to support the new requirement for sponsoring guest wireless devices before authentication?
A. Network authentication of all guest users should occur using the 802.1x protocol as authenticated by a RADIUS server
B. All guests must provide valid identification when registering their wireless devices for use on the network
C. Sponsored guest passwords must be at least 14 alphanumeric characters containing a mixture of uppercase, lowercase, and special characters
B. All guests must provide valid identification when registering their wireless devices for use on the network.
Explanation: Sponsored authentication of guest wireless devices requires a guest user to provide valid identification when registering their wireless device for use on the network. This requires that an employee validates the guest’s need for access, known as sponsoring the guest. While setting a strong password or using 802.1x are good security practices, these alone do not meet the sponsorship requirement. An open authentication standard only requires that the guest know the Service-Set Identifier (SSID) to gain access to the network. Therefore, this does not meet the sponsorship requirement.
What is an overlay network, and how does it function?
Overlay networks use software to create and manage new virtual networks leveraging existing hardware. All network management and configuration are performed using software, and new virtual networking devices are defined within that software. This virtualized overlay moves the data across existing physical network devices, but that hardware is no longer directly configured or managed by administrators.
What is an overlay network?
An overlay network uses software to create and manage virtual networks on top of existing physical infrastructure.
How does an overlay network function?
It allows network management and configuration to be performed using software, moving data across existing physical network devices without directly configuring or managing the hardware.
What are the benefits of using an overlay network?
Greater flexibility, easier management, and the ability to define and control virtual devices and paths without altering the physical infrastructure
What is reverse engineering?
Reverse engineering is the process of analyzing a system’s or application’s structure to understand how it functions, especially when the source code is not available.
Why might a company use reverse engineering for industrial espionage?
Reverse engineering allows a company to figure out how a competitor’s application works and potentially develop its own version.
How can attackers/pentesters use reverse engineering?
Attackers/Pentesters might use reverse engineering to identify flaws or vulnerabilities in an application and exploit them as part of their attack.
What is a BEC attack?
Business Email Compromise (BEC)
- A Business Email Compromise (BEC) is a form of cyberattack where the attacker targets a business by impersonating a high-level executive or taking over a high-level executive email account.
- e.g you take over a CEO email account and used that email to elicit action from employees
- The goal is to elicit action from employees, often involving financial transactions, by exploiting the trust and authority associated with the executive’s position.
What is the key difference between HOTP and TOTP?
Explanation: The main difference is that TOTP tokens include expiration while HOTP tokens do not.
Practical Example: With TOTP, a one-time password is only valid for a certain period, like 30 seconds, enhancing security by limiting the time window for potential attacks.
Does the HOTP token have an expiration?
Explanation: No, the HOTP token does not have an expiration.
The token could be a fob-type device or implemented as a smartphone app. The token does not have an expiration under HOTP, but an improved version known as TOTP does include token expirations
Practical Example: An employee’s physical token fob remains valid indefinitely until it’s manually deactivated.
Which type of device attack allows complete control of a device without
the target device being paired with the attacker?
BlueBorne
