Intervju - Fre Flashcards
(104 cards)
HTTP response code?
100 - Informational - Initial part has been request has been received
200 - successful - received, understood and accepted
300 - redirection - further action needs to be taken to complete request
400 - client error - request contains bad syntax or cannot be fulfilled
500 - server error - failed to fulfill apparently valid req
What is a firewall?
A device that allows or blocks the network traffic
Black Hats, White Hats & Grey Hat Hackers
Black: enter system without taking owners permission
White: Ethical hackers
Grey: mix of both, but never share information with black hats. but find vulnerabilities without permission of owners.
Port scanning is? Example?
Method of finding out which ports on a network are open & could be receiving or sending data.
Could also be adversary sending packets to specific ports on a host, anylyzing responses to identify vulnerabilities.
Port scan on company’s server to check if ports like 22 or 3389 (RDP are open)
Firewalls?
Block or deny network traffic based on security rules. Incoming and outgoing.
Vulnerabilities, risk & threat?
V: weakness in an information system, sec procedures, internal controls.
R: likelihood of a threat occurring & level of impact on assets
T: any circumstance or event with the potential to adversely impact operations
MITRE Attack - what is?
MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. (MITRE ATT&C
Could you share some general endpoint security product categories?
✔ EDR (Endpoint Detection and Response) – monitoring, threat detection, and response for endpoint devices.
✔ XDR (Extended Detection and Response) – Correlates security data across endpoints, networks, and cloud environments for advanced threat detection.
✔ DLP (Data Loss Prevention) – Prevents unauthorized access, transfer, or leakage of sensitive data through policies and controls.
✔ Antivirus – Detects and removes known malware using signature-based and heuristic scanning.
What are HIDS and NIDS?
HIDS: HIDS means Host Intrusion Detection System. HIDS is located on each host.
NIDS: NIDS means Network Intrusion Detection System. NIDS is located in the network.
What is CIA triad?
Confidentiality: Keep data and information confidential and protected. Preventing from unauthorized access.
integrity: Making sure the data doesn’t get tampered. Maintain it reliable and accurate, authentic.
Availability: People as well as systems need access to other systems, network etc. to functioning.
AAA
AAA is a security framework.
Authentication involves a user providing information about who they are. Users present login credentials that affirm they are who they claim.
Authorization follows authentication, means that a user can be granted privileges to access certain areas of a network or system.
Accounting keeps track of user activity while users are logged in to a network by tracking information such as how long they were logged in, the data they sent or received, their Internet Protocol (IP) address..
What is Cyber Kill chain?
Framework for identifying and preventing intrusions.
Understanding tactics, techniques and procedures from adversary side and what they want to achieve.
Vad ingår i Cyber Kill Chain?
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Action on objects
What is a SIEM?
Security Information and Event Management (SIEM) is a security solution designed to log events in real-time within an IT environment.
Primary goal of event logging is to identify potential security threats.
Explain True Positive
When you for example get an alert, in the SIEM, indicators trigger an alert for a suspicious sign in, and it turns out the account has been compromised.
False positive?
If an alert occurs for something, turned out being no reason for suspect any threat.
The rule can be correct though, but after
Looking into it, there’s no threat.
We also have Benign positive.
Port 9001?
Tor Network
Layers of nodes, routa den via flera servrar innan den når sin destination
Good to Know: Helps anonymize internet traffic.
What is Three-Way Handshake?
TCP uses a three-way handshake to establish a reliable connection. The connection is full duplex, and both sides synchronize (SYN) and acknowledge (ACK) each other.
The client chooses an initial sequence number, set in the first SYN packet. The server also chooses its own initial sequence number, set in the SYN/ACK packet.
Each side acknowledges each other’s sequence number by incrementing it; this is the acknowledgement number. The use of sequence and acknowledgment numbers allows both sides to detect missing or out-of-order segments.
Once a connection is established, ACKs typically follow for each segment. The connection will eventually end with a RST (reset or tear down the connection) or FIN (gracefully end the connection). (ScienceDirect)
What is ARP?
(ARP) is a communication protocol
is a layer 2 protocol used to map MAC addresses to IP addresses.
Alt expl:
discovering the MAC address, associated with a given Network Layer address, IP. This mapping is a critical function in the Internet protocol suite.
What is DHCP?
Protocol used on IP networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
The Dynamic Host Configuration Protocol (DHCP)
Could you share some general network security product names?
Firewall
IDS (Intrusion Detection System)
IPS (Intrusion Prevention System)
WAF (Web Application Firewall)
What is the key difference between IDS and IPS?
IDS only detects the traffic but IPS can prevent/block the traffic.
How can you protect yourself from Man-in-the-middle (on-path) attacks?
2 exempel räcker
Public Wi-Fi Network (Prevent Eavesdropping on Data)
Scenario: You’re using a public Wi-Fi network at a coffee shop, and an attacker is intercepting traffic between your device and the internet.
Protection: Always use a VPN (Virtual Private Network), which encrypts all your internet traffic, making it unreadable to attackers. Also, ensure websites use HTTPS (TLS encryption) to secure data in transit.
Phishing & Spoofed Websites (Prevent Fake Certificate Attacks)
Scenario: An attacker tricks you into visiting a fake banking website with a fraudulent SSL certificate, intercepting your credentials.
Protection: Always check the SSL certificate and verify the website’s URL before entering sensitive data. Enable HSTS (HTTP Strict Transport Security) and use DNS over HTTPS (DoH) to prevent DNS hijacking.
Public Wi-Fi Network (Prevent Eavesdropping on Data)
Scenario: You’re using a public Wi-Fi network at a coffee shop, and an attacker is intercepting traffic between your device and the internet.
Explain OWASP Top 10
The OWASP Top 10 is a standard awareness document for web application security.
It represents a broad consensus about the most critical security risks to web applications.
