lab 34 Flashcards
If you also wanted to add rules to iptables to drop outbound packets, which of the following lines could be added to the script?
iptables -A EGRESS -s $IP -j DROP
iptables -A OUTPUT-s $IP -j DROP
iptables -A FORWARD -s $IP -j DROP
iptables -A EXTERNAL -s $IP -j DROP
iptables -A OUTPUT-s $IP -j DROP
What hashing algorithm is being used by the script?
MD5
SHA-1
SHA256
SHA512
SHA256
What “malicious” files were found and removed by the script based on the malware threat feed? (Select all that apply)
/usr/share/sqlninja/apps/nc.exe
/usr/share/windows-resources/binaries/nc.exe
/usr/share/seclists/Web-Shells/FuzzDB.nc.exe
/usr/share/windows-resources/binaries/klogger.exe
/usr/share/windows-resources/binaries/vncviewer.exe
/usr/share/windows-resources/binaries/nc.exe
/usr/share/windows-resources/binaries/klogger.exe
What command is used to add a firewall rule to block inbound communications from an IP address range referenced by $IP?
iptables -A INBOUND -s $IP -j DROP
iptables -A INPUT -s $IP -j DROP
iptables -A INGRESS -s $IP -j DROP
iptables -A eth0 -s $IP -j DROP
iptables -A INPUT -s $IP -j DROP
Which of the following commands would configure the system to automatically execute a script weekly at 4:15 AM?
echo “15 4 * * * /bin/bash /root/ip_block.sh” | crontab -
echo “15 4 * 1 * /bin/bash /root/ip_block.sh” | crontab -
echo “15 4 * * 1 /bin/bash /root/ip_block.sh” | crontab -
echo “15 4 1 * * /bin/bash /root/ip_block.sh” | crontab -
echo “15 4 * * 1 /bin/bash /root/ip_block.sh” | crontab -
What does the command “chmod +x ip_block.sh” do?
sets the file to be executable for user, group, and other
sets the file to be executable for only the user
sets the file to be executable for only the group
sets the file to be executable for only other
sets the file to be executable for user, group, and other
Based on the malware removal script used in this lab, which of the following would result in a file being removed from the system?
only filename matches the value from the threat feed
only hash matches the value from the threat feed
filename and hash both matching the value from the threat feed
filename or hash matching the value from the threat feed
filename and hash both matching the value from the threat feed
What issue must be addressed when automatically adding IP block rules from a threat feed using iptables?
duplicate rules
only blocking known problematic IP addresses
defining allow rules for internal IP addresses
resolving FQDN to IP addresses
duplicate rules
