Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Certified Ethical Hacker > Introduction To Ethical Hacking > Flashcards

Introduction To Ethical Hacking Flashcards

(63 cards)

Start Studying
1
Q

What is hack value ?

A

An items worth or interest to hacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a zero-day attack ?

A

Threats and vulnerabilities that can be exploited before a fix is ready

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a vulnerability ?

A

It refers to a weakpoint in any system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an exploit ?

A

A breach of a systems security through vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is doxing ?

A

Publishing information about an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is meant by the term payload ?

A

Actual section of the information or data in a frame as opposed to metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a bot ?

A

Software designed to control the target remotely and to execute predefined tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the three elements of Information Security ?

A

Confidentiality, Integrity and Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is confidentiality ?

A

Only authorized personnel can see or work with digital assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is integrity ?

A

Ensuring assets have not been altered in an unauthorised manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is availability ?

A

Ensuring timely and reliable access to systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the security controls for Confidentiality ?

A

Encryption, Authentication and Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the security controls for Integrity

A

Audit Logs, Quality Assurance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the security controls for Availability

A

Business Continuity Plans, Backup storage, sufficient capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is non repudiation ?

A

The assurance of communication and its authenticity so that the sender is unable to deny the sent message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What controls enforce Non Repudiation

A

Digital signatures, digital contracts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What three aspects of a system measure its level of security

A

Security, Usability and Functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three attack vectors

A

Motive, Method, Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some of the common motives for an attack

A

financial gain, religious or political, disruption, manipulation of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is an advance persistent threat ?

A

The process of stealing information through a continuous procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Whats the difference between viruses and worms

A

Worms have the ability to replicate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is insider threat ?

A

A threat originating from a user within the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a botnet ?

A

Groups of bots connected together through the internet to perform a distributed attack continuously

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the main threat categories ?

A

Network, Host, Application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Give some examples of Network level threats ?
Scanning, DOS, Spoofing, MiM, DNS poisoning, Password based
26
Give some example of Host based attacks ?
Malware, Privelege Escalation, Backdoors, Logon Bypass
27
Give some examples of Application threats
Improper Data/Validation, Information Disclosure, Buffer Overflow, Sql Injection, Improper error handling
28
What is a buffer overflow ?
When more data is attributed to a fixed block of memory prevented by code auditing, use of safe functions, patches, compiler tools, bounds checking
29
Give an example of a misconfiguration attack ?
Leaving password or other settings at the default
30
What is information warfare ?
The use of information and communication technology to get a competitive advantage over a rival.
31
What are some typical examples of defensive information warfare ?
Prevention, Deterrence, Detection and Response
32
What are some examples of Offensive information warfare ?
Various implementations of threat
33
What are the seven steps in the Cyber Kill chain ?
Reconaissence, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on objectives
34
What are the seven steps of the cyber kill chain ?
Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives
35
What takes place in the Reconaissence phase of the Cyber Kill Chain ?
Collection of information on the target using DNS lookups, Social Engineering, Network Scanning etc. Security team should monitor port scanning on web servers, website logs and vulnerability scanning on public servers.
36
What takes place in the Weaponisation phase of the Cyber Kill Chain ?
Preparing to exploit the vulnerability such as developing the payload. Security teams should monitor malware analysis sites, building detection rules
37
What takes place in the Delivery phase of the Cyber Kill Chain ?
Launching of the attack via phising emails, malware on usb, direct server exploitations.
38
What takes place in the Exploitation phase of the Cyber Kill Chain ?
Gaining access to the victim and can be combatted by phising training, user awareness training, endpoint hardening, penetration testing
39
What takes place in the Installation phase of the Cyber Kill Chain ?
Establishes persistency by establishing a backdoor or opening a connection combatted by endpoint auditing, suspicious file creations, registry changes applications using administrator priveleges.
40
What takes place in the Command and Control phase of the Cyber Kill Chain ?
The communication is opened between victim and C2 server. This is the last chance in the kill chain to prevent damage. Require proxies for all traffic and monitoring sessions.
41
What takes place in the Actions on Objectives phase of the Cyber Kill Chain ?
This is where the C2 server carries out its objectives such as data modification, data exfiltration or privelege escalation. Countered by incident playbooks, incident readiness, response and escalation.
42
What takes place in the Actions on Objectives phase of the Cyber Kill Chain ?What
This is where the C2 server carries out its objectives such as data modification, data exfiltration or privelege escalation. Countered by incident playbooks, incident readiness, response and escalation.
43
What are the five essential hacking phases?
Reconnaissence, Scanning, Gaining Access, Maintaining Access, Clearing Tracks
44
What is the difference between passive and active reconaissence
Passive - No direct contact with target | Active - Interaction with target
45
What happens in the gaining access hacking phase ?
Hacker gains control of the operating system
46
Which hacking phase sees the escalation of priveleges ?
Maintaining Access - This is also where backdoors and trojans are implanted
47
What happens in the clearing tracks phase of hacking?
Overwriting of logs
48
What are information security controls ?
Safeguards and controls to minimize cyber risk
49
What is information assurance ?
Use of CIA - made up of Policies and Procedures
50
What are the steps to enforce security policies ?
``` 1 Risk Assessment - Identify Risk 2 Guidelines - Learn Standards 3 Management - Include senior management 4 Penalties - Set Penalties 5 Finalization - Ready Final Version 6 Agreement 7 Enforcement - Deploy the policy 8 Training - Train Employees 9 Review and Update ```
51
What are the four categories of Security Policy ?
Promiscuous - no restriction Permissive - restricts only widely known dangerous attacks Prudent - Max and strongest allow known and necessary risks Paranoid - Denys everything
52
What is covered by an Enterprise Information Security Architecture ?
Identifying assets Monitoring and detection of Network behaviour Paying attention to various threats Detection and Recovery of security breaches Risk Assesment Cost-effectiveness
53
What is threat modelling ?
The process of identifying, diagnosing and assessing the threats and vulnerabilities of a application or system
54
What are the five key stages of threat modelling ?
``` Identification of Objectives Application Overview Decompose Application Identify Threats Identify vulnerabilities ```
55
What is incident management ?
The procedure and method of handling any incident that occurs
56
What are the 8 steps in incident response ?
``` Preparation Detection and Analysis Classification Notification Containment Forensic Investigation Eradication and Recovery Post Incident activities ```
57
What are the typical members of an incident response team ?
IT personnell, HR, Public Relations Officers, Chief Security Officer, Local Law
58
What are the responsibilities of the incident response team?
``` Examine and Evaluate the event Document If required get support of expert Collection of Facts Report ```
59
What is vulnerability assessment ?
The process of examining an application or system to withstand any threat
60
What are the five phases of vulnerability assessment ?
Aquisition - reviews applicable previous vulnerabilites Identification - gathering of technical information Analysis - Risk assessment and analysis Evaluation - Inspection of identified vulnerabilities Reporting - Tasks covered, Recommendations, Methods and tools used
61
What are the types of penetration testing ?
Black, Gray and White box
62
What are the three main phases of penetration testing ?
Pre - Attack Information gathering Attack - Penetration, Acquiring the target Post - Attack Securing cleaning and reporting
63
Name some security testing methodologies ?
OWASP, Open Source Security Testing Methodology Manual, EC-Council licensed penetration tester

Certified Ethical Hacker (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions