Module 1 - Cybersecurity threats, vulnerabilities and attacks. Flashcards
(178 cards)
1
Q
What is An area of control, authority, or protection that attackers can exploit to gain access to a system?
A
A threat domain
2
Q
Which type of threat domain includes events like denial-of-service attacks and computer viruses?
A
Software attacks.
2
Q
Which threat domain covers issues such as software bugs and applications going offline?
A
Software errors.
2
Q
Which example falls under the software errors threat domain: a cross-site script or equipment theft?
A
Cross site script (XSS) falls under software error.
2
Q
What threat domain includes a legitimate user compromising an organization’s database?
A
Sabotage
2
Q
Defacement of an organization’s website belongs to which threat domain?
A
Sabotage
2
Q
A firewall misconfiguration or incorrect data entry would be categorized under which threat domain?
A
Human error
3
Q
Which user behavior can lead to serious financial, legal, and reputational consequences by compromising sensitive organizational data?
A
Data theft by users.
3
Q
Theft of laptops or equipment from an unlocked room belongs to which threat domain?
A
Theft.
3
Q
Which type of threat originates from employees, former staff, or partners who misuse access to data or infrastructure?
A
An Internal Threat.
3
Q
Earthquakes, floods, and fires fall under which threat domain?
A
Natural disasters.
3
Q
What threat domain includes events like hard drive crashes?
A
Hardware failures.
3
Q
Which threat domain includes power outages and water damage from sprinkler failure?
A
Utility interruption.
4
Q
What makes internal threats potentially more damaging than external ones?
A
Internal threats are more damaging than external threat because they involve people who have direct access to systems, data and existing security countermeasures.
4
Q
Who might conduct external threats using trickery or manipulation to gain internal access?
A
Skilled attackers or amateurs using social engineering techniques.
4
Q
Which issue occurs when users are not fully informed of or held accountable for organizational security policies and their violations?
A
Poorly enforced security policies.
4
Q
Which group includes employees, customers, and contract partners who have access to an organization’s information systems and can potentially compromise security?
A
The User Domain, often considered the weakest link in information security due to user behaviors and vulnerabilities.
4
Q
Which threat arises when users are unaware of the security technologies, policies, and countermeasures designed to protect systems and information?
A
Lack of security awareness
5
Q
Which common user action leads to infections by introducing malicious files via media like photos, music, or USB drives?
A
Unauthorized downloads and use of unapproved media.
6
Q
Which form of sabotage can be carried out by insiders or rivals and aims to delete or misconfigure critical systems or data?
A
Destruction of systems, data or applications.
6
Q
Which unauthorized tool can mask data theft by encrypting traffic and blocking visibility from network administrators?
A
An unauthorized VPN
6
Q
Which user threat involves visiting harmful online resources that may prompt script downloads or take control of devices?
A
Access to unauthorized websites.
7
Q
Which user-related domain is considered the most vulnerable in terms of maintaining the confidentiality, integrity, and availability of data?
A
The user domain
8
Q
Which network domain includes geographically localized devices connected via cables or wireless signals?
A
The Local Area Network.
8
Which principle reminds us that no technical measure can surpass the importance of user behavior and secure processes in protecting systems?
The principle that system security is only as strong as the behaviors and processes of the users operating it.
8
Which risk arises when devices are left powered on and unattended in a workplace or public setting?
Unauthorized physical access to network resources through unattended devices.
9
Which kind of technical misstep can expose private cloud systems to unintended risks through faulty system settings?
Configuration errors in Firewalls, routers or other networking devices.
9
Which model within the public cloud offers users access to centrally hosted applications via web browsers or apps?
Software as a service (SaaS).
10
Which malicious activity involves scanning a network to identify open ports and potential vulnerabilities?
Unauthorized probing
11
Which cloud domain provides computing services hosted by a provider and shared publicly across multiple organizations?
The public cloud domain.
11
Which cloud model provides IT infrastructure and private servers accessible only to members of a single organization via the Internet?
The private cloud domain
12
Which malicious activity in the private cloud involves scanning services and open ports for weaknesses?
Unauthorized network probing and port scanning.
13
Which public cloud model enables organizations to run, develop, and manage their apps using tools on the provider’s platform?
Platform as a service (Paas).
14
Which cloud model is ideal for developers needing tools to build and run custom applications in the cloud?
Platform as a service (Paas)
14
Which public cloud service model offers virtualized resources like storage, servers, and infrastructure components?
Infrastructure as a service (Iaas)
15
Which cloud service model reduces an organization’s need to maintain physical hardware but introduces reliance on third-party infrastructure?
Infrastructure as a service (Iaas)
16
Which entity is ultimately responsible for protecting resources within a public cloud environment?
The organization using the public cloud is responsible for protecting the resources within it.
17
Which type of cloud-based attack involves unauthorized disclosure of sensitive data stored by an organization?
Data breaches.
18
Which manipulation tactic is commonly used in cloud environments to trick users into disclosing confidential data?
Social engineering
19
Which domain includes the applications and systems essential to daily organizational operations?
The application domain.
20
Which domain includes employees, customers, and contract partners with access to an organization’s information systems?
The User Domain.
21
Which domain covers any computers or connected devices within a network?
The device domain.
21
Which domain includes an organization's premises and the physical safeguards used to protect those spaces?
The physical facilities domain
22
Which domain consists of locally connected devices using cables or wireless signals within the same geographic area?
The LAN (Local Area Network) domain.
23
Which threat involves ongoing surveillance and intrusion, often by well-funded attackers using espionage tactics and malware?
APTs (Advanced Persistent Threats) which infiltrate networks steadily and remain undetected for long periods.
24
Which form of attack manipulates legitimate software’s decision-making mechanisms to create unintended or harmful behaviors?
Algorithm attacks
25
Which type of threat may use tactics like triggering false system alerts or forcing devices to consume all memory or CPU power?
Algorithm attacks.
26
Which threat tactic often goes unnoticed for long periods and is commonly directed at government or high-value organizational targets?
APTs (Advanced persistent threats)
27
Which type of information is collected, shared, and analyzed to help organizations assess risk and improve cybersecurity posture?
Threat intelligence data.
27
Which type of threat data is available from public information sources like websites or community reports?
OSINT (Open Source Intelligence)
28
Which category of malware allows attackers to bypass normal authentication and access systems remotely, often through tools like Netbus or Back Orifice?
Backdoors, which help attackers avoid standard login procedures to gain unauthorized system access.
29
Which tool is commonly disguised and run by a user to secretly give an attacker remote control over their system and install a backdoor?
A RAT (Remote administrative tool)
30
Which malware exploits software flaws to gain higher-level system permissions than normally allowed?
Rootkits
31
Which category of malware commonly requires a full system wipe and software reinstallation due to the depth of its compromise?
Rootkits
31
Which term describes the act of increasing one’s system privileges to access resources normally unavailable to regular users?
Privilege escalation
31
Which organization sponsors a public dictionary of common vulnerabilities and exposures (CVE) alongside the U.S. Department of Homeland Security?
The United States Computer Emergency Readiness Team (US- CERT).
32
Which system assigns a unique identifier to each vulnerability, along with a summary and relevant references?
The Common Vulnerabilities and Exposures system.
33
Which part of the web requires specialized tools or permissions to access and is monitored for emerging cyber threats?
The dark web
34
Which intelligence-gathering method involves tracking malware hashes, domain names, and other signs of system compromise?
Indicators of Compromise (IOCs)
35
Which CISA-supported system allows real-time sharing of cyber threat indicators across organizations?
Automated indicator sharing (AIS)
36
Which capability uses a standardized language to represent and share cyber threat information across sectors?
The structured Threat intelligence Expression (STIX)
37
Which transport mechanism is used in combination with STIX to automate the exchange of cyber threat intelligence?
Trusted Automated Exchange of cyber threat intelligence (TAXII)
38
Which category of attack relies on manipulating people rather than exploiting software or hardware flaws?
Social Engineering
38
Which method involves a fabricated scenario to persuade someone to hand over sensitive data, such as pretending to need it to verify identity?
Pretexting
39
Which tactic promises something in return for sensitive information, like asking for your details in exchange for a prize or reward?
Quid pro quo
40
Which form of deception uses a victim’s stolen credentials to fraudulently acquire goods, services, or money?
Identity fraud.
41
Which social engineering tactic relies on pretending to be someone in power to influence a victim’s behavior?
Authority
41
Which manipulation strategy involves threats, pressure, or bullying to force a user into unsafe actions?
Intimidation
42
Which tactic relies on the influence of group behavior, leading victims to believe something is safe because many others are doing it?
Consensus
42
Which psychological trigger is exploited when a scam email claims a product is nearly sold out?
Scarcity
43
Which tactic works by creating a deadline or time constraint to rush victims into decisions without caution?
Urgency
44
Which tactic relies on rapport-building or impersonating someone the victim trusts to increase influence?
Familiarity
45
Which social engineering tactic involves slowly building rapport over time to gain the victim’s confidence and access to secure systems?
Trust
45
Which attack involves physically observing someone entering sensitive information like a PIN or password?
Shoulder Surfing.
46
Which real-world safeguard helps reduce shoulder surfing at ATMs by limiting screen visibility?
Angled Screens or Privacy Filters
47
Which attack involves searching through discarded physical items to retrieve sensitive data?
Dumpster Diving.
47
Which tactic involves pretending to be someone else to trick victims into taking actions they normally wouldn’t?
Impersonation
47
Which attack is demonstrated when a cybercriminal poses as an IRS agent demanding immediate wire transfer payment?
Impersonation.
48
Which tactic spreads false information that may not involve direct theft but still causes disruption or panic?
A hoax
49
Which physical intrusion method involves a criminal entering a secure area by closely following an authorized individual?
Piggybacking or tailgating
49
Which access control mechanism uses two interlocking doors to prevent unauthorized entry through tailgating?
The use of a mantrap
50
Which intrusion tactic involves pretending to be escorted or blending into a large crowd to gain unauthorized access?
Piggybacking or tailgating.
50
Which scam sends fake billing documents that prompt users to enter credentials on a spoofed login page?
An invoice scam.
50
Which cyberattack infects frequently visited websites to compromise users from a specific organization?
A watering hole attack.
51
Which method involves registering misspelled versions of legitimate website URLs to capture data from typing errors?
Typosqautting
52
Which attack manipulates an organization’s email warning system to make external emails appear internal?
Prepending
53
Which form of cyber deception aims to alter public perception using fake news and coordinated online activity?
Influence campaigns
54
Which basic rule should employees follow when handling credentials or confidential data with unfamiliar contacts?
To never share any confidential information or credentials to unknown parties through any mediums
54
Which type of malware requires user interaction to activate, often spreading via email attachments or downloads?
A virus.
55
Which type of malware replicates by exploiting network vulnerabilities without needing a host program or user input?
A worm.
55
Which type of malware pretends to be a legitimate file or program but performs malicious actions when executed?
A trojan horse
55
Which malware type can infect other files by inserting its code and typically mutates to avoid detection?
A virus
56
Which malware can propagate through a network independently and often degrades network performance as it spreads?
A worm
57
What was the name of the 1999 virus that spread via email and caused an estimated $1.2 billion in damages?
Melissa virus
58
Which infamous malware infected over 300,000 servers within 19 hours in 2001?
Code Red Worm
58
What distinguishes a Trojan horse from a virus in terms of replication?
A trojan horse does not self replicate while a virus does
58
Which type of malware is most likely to bind itself to a photo or audio file to trick the user into executing it?
A trojan horse
59
Which type of malware typically initiates infection after a user opens a file or runs a program?
A virus
60
What common feature do all worms share that allows them to cause harm without user action?
Worms contain payload (malicious code) and spread independently
61
Which type of malware remains inactive until a specific condition, like a date or database change, triggers it?
A logic bomb
61
Which type of malicious code can damage systems by waiting for a particular event, such as a system update or time trigger, before launching an attack?
A logic bomb
61
Which type of malware encrypts your data and demands payment for its release?
Ransomware
61
Which attack is capable of affecting operational technology like building controls, factories, or utility systems, potentially causing a full shutdown?
A Denial of service (DoS) attack
62
Which type of DoS attack involves overwhelming a network or system with massive amounts of data it cannot process?
Overwhelming quantity of traffic
63
What kind of DoS attack involves sending improperly structured or corrupted data that a system cannot interpret?
Maliciously formatted packets
64
Which type of attack involves multiple coordinated sources targeting a victim simultaneously?
Distributed denial of service attack (DDos)
65
What is the term for the infected systems used to carry out a DDoS attack?
Zombies
66
What is the network of infected computers controlled by an attacker in a DDoS attack called?
A botnet
67
What are handler systems in the context of a DDoS attack?
Systems that control zombies and coordinate the attack
68
What system do DNS servers use to resolve domain names by querying other servers if they don’t have the answer?
Recursive DNS querying
69
Which practice involves tracking the trustworthiness of an organization's domain and IP address to protect against malicious links?
Domain reputation monitoring
70
Which attack introduces false information into a DNS resolver's cache to redirect traffic to a malicious IP address?
DNS spoofing , also known as DNS cache poisoning.
70
Which attack occurs when a cybercriminal gains unauthorized control over a domain’s DNS settings?
Domain hijacking
70
Which type of attack occurs when an attacker links their MAC address to the IP address of a legitimate device to intercept data?
ARP spoofing or ARP cache poisoning
71
Which type of spoofing attack sends data packets with a fake source IP address to disguise the sender's identity?
IP spoofing
71
Which OSI (Open Systems Interconnection) layer is responsible for moving data across physically connected devices on a network?
Layer 2 (data link layer)
71
Which function, often used legitimately to return users to a login page, can be exploited to send users to a fake website?
URL Redirection
71
Which address uniquely identifies a device at Layer 2 of the OSI model?
A MAC (Media access control) address
72
Which spoofing technique allows a malicious device to impersonate a legitimate device by using its MAC address?
MAC address spoofing.
72
Which Layer 2 attack overflows the switch’s MAC table so that it behaves like a hub, sending data to all ports and exposing traffic?
MAC flooding
73
Which attack overwhelms a network switch with bogus MAC addresses to compromise its forwarding table?
MAC flooding
73
What network device uses packet switching to receive and forward data to the correct MAC address?
A network switch
74
Which type of attack allows a cybercriminal to intercept and modify communication between two parties without their knowledge?
Man in the middle (MiTM) attack
75
Which variation of MitM attacks targets smartphones to exfiltrate sensitive user data?
A Man in the middle mobile (MiTMo) attack.
76
Which malware package is known for its Man-in-the-Mobile (MitMo) capabilities and can intercept two-step verification SMS messages?
ZeuS
76
Which type of attack exploits software vulnerabilities before the vendor has discovered or patched them?
A zero day attack
77
Which type of attack involves retransmitting a previously captured communication to deceive the recipient into performing an action?
A replay attack
77
Which method involves recording all keys typed on a keyboard to steal credentials or other sensitive information?
Keylogging
78
What is one legitimate use case for keylogging software mentioned in the content?
Parents monitoring their children's internet behavior
78
Which strategy helps maintain service availability by spreading demand across multiple systems?
Distributing the workload across server systems.
79
Which phishing method uses text messages to lure victims into visiting malicious sites or calling fraudulent numbers?
SMishing (Short message service phising)
80
Which type of unwanted software behaves annoyingly or undesirably but is not classified as malware?
Grayware
80
5.
Which wireless device is installed on a network without permission and can be exploited by attackers?
A rogue access point.
80
What type of attack can a rogue access point be used for once it's installed on a network?
MiTM attacks to capture login details.
80
Which attack mimics a legitimate wireless access point to trick users into connecting and steal their data?
An evil twin attack
81
Which method involves deliberately interfering with wireless signals to prevent them from reaching their destination?
Radio frequency jamming.
82
Which form of Bluetooth attack sends unsolicited messages or shocking content to nearby devices?
Bluejacking
82
Which Bluetooth attack involves stealing data like contact lists or emails from a device without the user's knowledge?
Bluesnarfing
82
What is a key limitation that affects all Bluetooth-based attacks?
The attacker must be within the bluetooth range of the target
83
Which outdated wireless security protocol aimed to make wireless networks as secure as wired ones by encrypting data?
WEP (Wired equivalent Privacy)
83
Which protocol replaced WEP to provide improved wireless security and protect against key recovery from traffic analysis?
WPA and WPA2 (Wifi protected Access 2)
83
What technique can attackers still use against WPA2-protected networks, despite stronger encryption?
Packet sniffing
84
Which type of injection attack interferes with the way XML data or queries are processed by an application?
An XML injection attack
84
Which tool can be used to detect unauthorized wireless devices or rogue access points on a WLAN?
Netstumbler
84
Which web vulnerability is exploited by injecting malicious scripts into a web page that are unknowingly executed by a user's browser?
Cross site scripting (XSS)
85
What is the primary goal of an XML injection attack against a website?
To corrupt XML database data and compromise website security.
85
Which Windows file type contains code and data that applications use to perform tasks not built into the application itself?
A DLL (Dynamic Link library) file
85
Which database attack uses a malicious SQL statement entered into a form or input field to gain unauthorized access?
A SQL injection attack
85
Which type of attack tricks a Windows application into calling a malicious DLL file that executes within the target process?
A DLL (Dynamic Link library) injection attack
86
Which protocol is used to authenticate user access to directory services and is commonly targeted by injection attacks?
The LDAP (Lightweight Directory Access Protocol).
87
Which injection attack exploits vulnerabilities in input validation to craft and execute queries against LDAP servers?
A LDAP injection attack
87
Which type of vulnerability allows a cybercriminal to run arbitrary commands with the privileges of a legitimate user on a target system?
Remote code execution
87
Which memory issue occurs when data is written beyond the boundaries of a designated memory area, potentially crashing a system or compromising data?
Buffer overflow
88
Which Metasploit payload allows users to extend functionality, upload files to memory, and control a compromised system?
A meterpreter
88
Which open-source computer security project provides tools and frameworks for penetration testing and developing exploits?
The metasploit project
88
Why is Meterpreter difficult for antivirus tools to detect?
The Meterpreter runs entirely to memory without writing files to the hard drive.
88
According to research by Carnegie Mellon University, what percentage of program exploits involve some form of buffer overflow?
Nearly 50%
89
Which type of attack exploits a flaw when two or more threads try to access and modify shared data simultaneously?
A Race condition attack aka TOC (Time of check) or (Time of use attack).
89
Which attack tricks a user's browser into sending unauthorized commands to a trusted web application without their knowledge?
CSRF ( Cross site request forgery)
90
What is the name for an attack that manipulates the sequence of events in a system that was designed to operate in a specific order?
A race condition attack
90
Which vulnerability occurs when a program fails to validate user input, potentially leading to buffer overflows or SQL injection?
Improper input handling
90
What type of attack occurs when a cybercriminal manipulates a system’s API to exploit exposed endpoints?
An API attack
90
Which attack uses unfiltered error messages to uncover hostnames, file paths, or database schema details?
An error handling attack
91
Which attack involves intercepting a legitimate data transmission and fraudulently repeating or delaying it to manipulate the recipient's behavior?
A replay attack
91
Which type of attack overwhelms a server's hardware resources rather than its network bandwidth to cause crashes or service disruption?
A resource exhaustion attack
92
Which practice is considered the first line of defense against application attacks?
Writing solid code
93
Which attack allows access to sensitive files on a server outside the web root directory by manipulating the file path?
A directory traversal attack
94
Which type of attack tricks a user into clicking a malicious link or sharing personal information by impersonating a legitimate person or organization?
Phishing
94
Which common form of unsolicited email often contains malware, malicious links, or deceptive content aimed at stealing sensitive information?
Spam
94
Which phishing technique uses customized, targeted emails based on personal information about the victim?
Spear phishing
95
Which type of attack involves intentionally damaging or gaining unauthorized access to an organization's physical infrastructure or hardware?
Physical attacks
95
Which type of phishing targets high-profile individuals such as executives, politicians, or celebrities?
Whaling
95
Which social engineering method uses voice calls or VoIP technology to trick users into revealing sensitive information like credit card numbers?
Vishing (voice phishing)
96
Which type of phishing attack misdirects users to a fraudulent version of a legitimate website to collect their credentials?
Pharming
97
Which attack might involve changing a software’s end-of-life (EOL) date to deny support or maintenance to an organization?
A supply chain attack
97
Which type of attack targets the systems or components provided by third parties, such as vendors or foreign sources?
Supply chain attacks
97
Which type of attack manipulates the data used by machine learning models to produce false outcomes, such as tricking an autonomous car?
Adversarial Artificial Intelligence Attacks
98
Which type of attack targets infrastructure, platforms, applications, or data hosted in a third-party environment rather than on-premises?
Cloud based attacks
