Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Operations > Midterm > Flashcards

Midterm Flashcards

(90 cards)

Start Studying
1
Q

Hacking

A

producing an outcome that the system’s designers never intended or anticipated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Penetration Tester

A

Simulates cyber attacks for the purpose of improving organizational security. Focus on comprehensiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Red/Purple Team

A

Simulates cyber attacks like a pen tester,
however, the focus is more on emulating an adversary and testing an organization’s response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cyber Operator

A

Works with or for the military to hunt threats,
protect assets, and provide access to sensitive and secure
environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Vulnerability Researcher

A

Searches for yet unknown vulnerabilities
in software or hardware products

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Vulnerability Analyst

A

Analyzes computer networks and/or systems
for the presence of known vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CSIRT (Computer Security Incident Response Team) Analyst or Responder

A

Respond to and eradicate active threats within an
organization’s computer systems or networks. “Blue” team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cyber Crime Investigator or Forensic Analyst

A

Collect and analyze data from computer systems and networks to uncover certain actions or behaviors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Intelligence Analyst

A

Mitigate risk by collecting and disseminating
information about threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Software Engineer

A

Develop and maintain software systems to be resistent to misuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Ethical Hacking

A

Combining technical skills and understanding of an
attacker’s mindset to simulate a hostile attacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IT security audit

A

Determine whether an organization’s deployed
controls align with the security policy. Focused more on compliance with policy and best practice than assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Vulnerability assessment

A

Survey of a system to identify as many
vulnerabilities as possible. Focused on identifying the vulnerabilities, not necessarily proving that they can be exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Penetration test

A

Assess the security posture of a scoped network
or resource by actively trying to exploit it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Red team

A

Assess an organization’s response to an emulated adversary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Cyber Operation

A

Military operation that is an ethical cyber attack or defense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the difference between an ethical test and an unethical cyber attack?

A

Consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CIA Triad

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why would a penetration test start from “assumed breach”?

A
  1. To provide a test to the customer in the most cost-effective manner
  2. To accurately simulate insider threats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the steps of the Cyber Kill Chain?

A

Reconnaissance
Scanning
Infiltration and Escalation
Exfiltration
Access Extension
Assault
Obfuscation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CVE

A

Common Vulnerabilities and Exposures
They represent specific vulnerabilities and exposures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CWE

A

Common Weakness Enumeration
They are not specific vulnerabilities, but weaknesses that can lead to vulnerabilities.
Ex. CWE-242: Use of Inherently Dangerous Function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

CAPEC

A

Common Attack Pattern Enumeration and Classification
It is a catalog of types of attacks
Ex. CAPEC-148: Content Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NVD

A

National Vulnerability Database
Takes CVEs and pairs them with CVSS severity scores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Open Source Intelligence (OSINT)
derived from data and information that is available to the general public
26
Footprinting
An adversary engages in probing and exploration activities to identify constituents and properties of the target
27
Fingerprinting
An adversary compares output from a target system to known indicators that uniquely identify specific details about the target
28
What is the order of Recon?
OSINT Footprinting Fingerprinting
29
Pagodo
A python module which automates performing Google dorks.
30
WHOIS
allows us to figure out information about a domain and provides contact information for that domain
31
RIR
Regional Internet Registry
32
Nslookup and Dig
query nameservers for DNS records from a particular domain
33
Hunter.io
used to find emails and contact info from people at a company
34
DNSDumpster
Online tool that compiles information from multiple sources to get a better picture of domain information leakage. Uses multiple sources to find subdomains that you might not know about
35
Attack Surface
number of all possible points, or attack vectors, where an unauthorized user can access a system and extract data
36
Vulnerability
A weakness that can be exploited to gain unauthorized access to a computer system
37
Order of Scanning
Host Discovery Port Scanning OS Identification Service Identification Vulnerability Scanning
38
ICMP Host Discovery Techniques
ICMP Echo Request Ping - Expect ICMP Type 0 Echo Reply if up ICMP Address Mask Request - Expect ICMP Type 18 Address Mask Reply if up ICMP Timestamp Request - Expect ICMP Type 14 Timestamp Reply if up
39
TCP Host Discovery Techniques
TCP SYN Ping - Expect SYN/ACK if up TCP ACK Ping - Expect RST if up
40
Other Host Discovery Techniques
UDP Ping - Expects an 'ICMP port unreachable' message if up ARP Ping - Expect to receive ARP reply if up
41
System Ports
Ports 0-1023 Assigned to specific service by IANA Usable only by privileged programs
42
User Ports
Ports 1024-49151 Assigned to specific service by IANA Usable by unprivileged programs
43
Dynamic Ports
Ports 9152-65535 used by client programs for source ports
44
What are the 3 port states?
Open Closed Filtered
45
TCP Port Scanning Techniques
TCP Connect Scan - Open: Connection, Closed: RST TCP SYN Scan - Open: SYN/ACK, Closed: RST TCP ACK Scan - Unfiltered: RST, Filtered: No Response
46
Less Common TCP Port Scanning Techniques
TCP NULL Scan TCP FIN Scan TCP Xmas Scan Open: No response Closed: RST
47
UDP Port Scan
Open: Response from service (unlikely) or No response (could also mean filtered) Closed: ICMP Type 3 Port unreachable error message
48
Banner Grabbing
Connecting to a service as if we are going to use it, but instead we’re interested in what the service tells us about itself
49
Masscan
tool for host discovery on large subnets blasts SYNs without waiting for a reply. When it gets a reply, it
50
EyeWitness
tool that allows you to collect screenshots from a list of hosts or from other scan results
51
Dirbuster
tool that allows you to brute-force enumeration of web addresses based on a wordlist
52
FFUF
Guesses web addresses based on a wordlist
53
Vulnerability Management
Vulnerability management is the ongoing, regular process of identifying, assessing, reporting on, managing and remediating cyber vulnerabilities across endpoints, workloads, and systems
54
What is Nessus used for?
Vulnerability Scanning
55
Intrusion Detection Systems (IDS)
monitor for threats by looking at network traffic; near real-time
56
Intrusion Prevention Systems (IPS)
prevents threats found through looking at network traffic; real-time
57
TAPs
Test Access Points mirror all packets using an inline device, detection is run on copies Slow but don't drop packets Prefered
58
SPAN ports
Switch or router copies packets and sends them out another port to the security tool Fast but drop lots of packets
59
Vulnerability
A weakness in a system or network which can be exploited to cause the system to act in an unintended way
60
Exploit (verb)
Using a vulnerability to cause a system to act in an unintended way
61
Exploit (noun)
Code that uses a vulnerability to cause a system to act in an unintended way
62
Payload
Code which is run on the target system as a result of an exploit
63
Server-side Exploitation
A server is running and there is some misconfiguration or software bug which allows us to cause the server to act in an unintended way. Ex: MS17-010, aka Eternal Blue
64
Client-side
exploit misconfigurations or bugs in software, and exploits the trust relationship between the client and server Ex: Cross-site Scripting (XSS)
65
Social Engineering
Here we attacking the “vulnerability” of trust relationships in and by humans. Ex: Phishing
66
Post-Exploitation
anything we do after running a payload on the target system Ex. Credential theft
67
Access Extension
Making it easier to come back next time
68
Pivoting
Gaining access to previously unreachable systems
69
Obfuscation
Covering our tracks
70
Why do we use reverse shells?
Does not create a new vulnerability on the system for other attackers to use More likely to bypass firewall restrictions Connections can be made out of NAT’d environments but not necessarily in
71
Staged Payload
The original payload fetches another payload and runs it
72
Pros and Cons of a Staged Payload
Pro: The original payload is small, which allows it to be easier to use in an exploit with size requirements. Con: More complicated May be easier to detect on the network Requires additional network connectivity to run the second stage
73
Stageless Payload
The “real” payload is the original payload
74
Pros and Cons of a Stageless Payload
Pro: Simpler. No additional network connectivity required Con: The payload itself is larger
75
Mfsvenom
command line tool that allows you to generate custom payloads which interact with Metasploit
76
What Metasploit module is used to catch a reverse shell from an msfvenom payload?
exploit/multi/handler
77
DNS Domain Hierarchy
Root (.) Top Level Domains (TLD) (ev. .com, .edu) Second Level Domain (ex. google, example)
78
DNS Query Order
Root TLD Second Level Domain
79
How does the Kaminsky attack work?
1. Query: Whats the ip address of qwrqqwe.example.com 2. Local cache sends request to example.com's DNS server 3. Flood the local cache with spoofed replies with your own NS as the authoritative NS for the domain
80
How big is the TID in a DNS request or reply?
2 bytes
81
Username Enumeration
enum4linux - uses NULL sessions RID Cycling 1. Assume that some common names exist. Using the NULL session, request the SID for that username. 2. Get a SID 3. The last part is the RID It’s used to identify different users in a domain 4. Remove the RID and add a new one, checking for existence. So, start with 500 (administrator), 501 (guest/nobody), and work your way up
82
Password Spraying
guess a single (or a few) password(s) across many usernames. Looking for at this point is *any* valid credential
83
Password Cracking
guessing a bunch of passwords, hashed them all, and compared each one to the hash we have
84
Dumps the SAM database
post/windows/gather/hashdump
85
A meterpreter command in the 'kiwi' extension used to inject into LSASS
creds_all
86
Active directory database that cannot be copied with normal file operations
ntds.dit
87
Has hashes that correspond to the users in /etc/passwd
/etc/shadow
88
Salting hashes makes it harder to do what type of password cracking?
Rainbow table attack
89
When cracking a WPA/WPA2 key, why does the attacker perform a deauthentication?
To force an authentication challenge/response
90
What activity is most likely to cause account lockout
Password guessing

Cyber Operations (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions