Módulo 06 - Resiliency and Site Security Flashcards
(102 cards)
1
Q
Define:
Environmental Design (Physical Security)
A
Security approach that uses the built environment to enhance security
2
Q
List:
Environmental Design options
A
- Barricades and Entry/Exit point
- Fencing
- Lights
- Bollards (Coisa de ferro ou cimento controlado remotamente que impede a passagem de veículos)
3
Q
List:
Lock types
A
- Physical
- Electronic
- Biometric
4
Q
Define:
PACS - Physical Access Control System
A
Designed to control who can access specific locations within a building, essential to protect access badges (NFC cards)
5
Q
List:
The use of AI and camera systems
A
- Motion Recognition
- Object Detection
- Drones/UAV
6
Q
List:
Type of alarms
A
- Circuit
- Motion Detection
- Noise Detection
- Proximity
- Duress
7
Q
List:
Types of sensors
A
- Infrared
- Pressure
- Microwave
- Ultrasonic
8
Q
Acronym:
RFID
A
Radio Frequency ID
9
Q
List:
Common Physical Attacks
A
- Brute Force
- Environmental
- RFID Cloning
10
Q
What’s the fundamental concept in network monitoring?
A
Know which computer are the big receivers and senders of information in the network.
11
Q
List
Network Monitoring Tools
A
ping
tracert/traceroute
pathping
netstat
route
arp
nslookup/dig
ipconfig/ifconfig
hping
netcat
IP scanners
nmap
12
Q
Define:
Passive reconnaissance
A
Gathering information on the target with no direct interaction
13
Q
List:
Passive reconnaissance methods
A
- Packet sniffing
- Eavesdropping
- OSINT - Open Source Intelligence
- Network Traffic analysis
14
Q
Acronym:
OSINT
A
Open Source Intelligence
15
Q
Define:
OSINT - Open Source Intelligence
A
Collecting data from public sources
16
Q
Define:
Active reconnaissance
A
Gathering information on a target by probing and interacting
17
Q
List:
Active reconnaissance techniques
A
- Port scanning
- Service enumeration
- OS fingerprinting
- DNS enumeration
- Web Application Crawling
18
Q
List:
Type of reconnaissance
A
- Passive
- Active
19
Q
List:
Target information to extract
A
- Security posture (Physical and network)
- Narrow the focus for attack
- Potential vulnerabilities
- Create a network map
20
Q
List:
Reconnaissance tools
A
- OSINT framework
- theHarvester
- Shodan
- DNSenum
- curl and wget
- Scanless
- Nessus
21
Q
Acronym:
IPS
A
Intrusion Prevention System
22
Q
Acronym:
IDS
A
Intrusion Detective System
23
Q
Define:
Intrusion Prevention System
A
Detects attacks and suspicious activity and automates responses to the malicious actitivity
24
Q
Define:
Intrusion Detection System
A
Detect attacks and suspicious activity
25
List:
Threat traffic label
1. Positive
2. False positive
3. Negative
4. False negative
26
List:
Detection methods
1. Signature-based
2. Heuristic-based
27
List:
IDS/IPS implementation types
1. Host-based H(IDS)
2. Network-based (NIDS)
28
Acronym:
HIDS
Host-based IDS
29
Acronym:
NIDS
Network-based IDS
30
Define:
Trend Analysis
Consists on understanding an environment over time, identifying patterns.
Easily identifying false positives or unnecessary alerts.
31
Define:
Q: Protocol analyzer
A tool (hardware or software) used to monitor and analyze network traffic, also known as packet sniffer or network analyzer.
32
List:
Q: Common protocol analyzer tools
1. Wireshark.
2. Tcpdump.
3. Ettercap.
4. Dsniff.
5. Cain and Abel.
6. Windump.
33
Define:
Q: SecOps protocol analyzer usage
Identifies network vulnerabilities, such as malformed packets, open ports, or sensitive data sent in cleartext.
34
Define:
Q: System fingerprinting
Identifying a system's operating system by analyzing how it responds to different types of network traffic.
35
Define:
Q: TCP handshake flags
Indicators within TCP packets that help identify the state of a connection during the handshake process.
36
Define:
Q: Packet sniffing
Using a protocol analyzer to capture and analyze network packets.
37
Acronym:
NIC
Network Interface Card
38
True or false:
A protocol analyzer is always capable of listening to every packet on the collision domain
False.
Except when the NIC is on p-mode (Promiscous mode)
39
Define:
Q: Network attack
A: A strategy or technique used by threat actors to disrupt or gain unauthorized access to systems via a network.
40
List:
Q: Stages of the cyberattack lifecycle
1. Reconnaissance.
2. Credential harvesting.
3. Denial-of-service (DoS).
4. Weaponization, delivery, and breach.
5. Command and control (C2).
6. Lateral movement and privilege escalation.
7. Data exfiltration.
41
Define:
Q: Reconnaissance
A: The stage where threat actors gather information about the network, including host discovery, service discovery, and fingerprinting.
42
Define:
Q: Credential harvesting
A: Reconnaissance activity where attackers attempt to learn passwords or cryptographic secrets for authenticated access.
43
Define:
Q: Denial-of-service (DoS)
A: An attack that reduces the availability of a resource by overwhelming it with excessive requests or exploiting vulnerabilities.
44
Define:
Q: Distributed Denial-of-Service (DDoS)
A: A type of DoS attack launched from multiple hosts, often using a botnet to overwhelm the target.
45
Define:
Q: Command and control (C2)
A: Techniques and malicious code enabling attackers to remotely operate and maintain access to compromised systems.
46
Define:
Q: Lateral movement
A: The process where attackers move from host to host or network segment to escalate privileges and expand access.
47
Define:
Q: Data exfiltration
A: The unauthorized transfer of sensitive data from a system to an attacker's remote machine.
48
Define:
Q: SYN flood attack
A: A DoS attack exploiting the TCP handshake by withholding the ACK packet, causing resource exhaustion on the victim
49
Define:
Distributed reflected DoS (DRDoS)
A DDoS attack where the attacker spoofs the victim's IP, causing third-party servers to overwhelm the victim with responses.
50
Define:
Amplification attack
A reflected attack exploiting application protocols to force targets to respond with large amounts of data, consuming bandwidth.
51
List:
Protocols commonly targeted in amplification attacks
1. DNS (Domain Name System).
2. NTP (Network Time Protocol).
3. CLDAP (Connectionless Lightweight Directory Access Protocol).
4. Memcached.
52
Define:
Asymmetric threat
A situation where attackers achieve effective attacks despite having fewer resources than the victim.
53
Define:
Botnet
A network of compromised devices used by attackers to launch DDoS attacks or other malicious activities.
54
Define:
DDoS indicators
Traffic spikes without legitimate explanation, often mitigated with high-availability services like load balancing or cluster services.
55
Define:
On-path attack
A threat actor intercepts, monitors, relays, and potentially modifies communication between two hosts.
MITM - Man In The Middle
56
Define:
ARP poisoning
An attack using unsolicited ARP replies to associate the attacker’s MAC address with a target IP, redirecting network traffic.
57
Define:
DNS poisoning
A technique to compromise DNS name resolution by inserting false domain-to-IP mappings.
58
Define:
DNS client cache poisoning
Modifying a client’s HOSTS file to redirect traffic by placing false name-to-IP address mappings.
59
Define:
DNS server cache poisoning
Corrupting records held by a DNS server, often via spoofed responses to recursive queries or DoS attacks.
60
Define:
DNS-based on-path attack
A combination of ARP poisoning and spoofed DNS responses to redirect victim traffic to malicious servers.
61
Define:
Typosquatting
A technique where attackers create malicious sites mimicking legitimate ones to exploit users’ typographical errors.
62
Define:
Amplification attack (DNS)
An attack exploiting DNS protocol weaknesses to force a target to respond with a large amount of data, consuming bandwidth.
63
Define:
DNS attack indicators
Anomalies in DNS logs, such as spikes in lookup failures or communication with suspicious domains.
64
List:
Examples of DNS attack indicators
1. Unusual DNS queries.
2. Suspicious IPs or domains.
3. DNS lookup failure anomalies.
65
Define:
Recursive DNS query
A query where a DNS server retrieves an answer from an authoritative server on behalf of a client.
66
Define:
Memcached attack in amplification
Exploiting the Memcached database caching system to perform large-scale DDoS attacks.
67
List:
Common DNS attack methods
1. DNS poisoning (client and server).
2. DNS-based on-path attacks.
3. DRDoS attacks using DNS.
4. Typosquatting.
68
Define:
Shellcode
A minimal program designed to exploit OS vulnerabilities to gain privileges or drop backdoors.
69
Define:
Credential dumping
Malware extracting credentials from files like SAM or processes like lsass.exe, or using DCSync to replicate domain credentials
70
Define: Persistence
A: A technique ensuring malware restarts after a reboot or logoff, often using registry keys, scheduled tasks, or WMI events
71
Define: Bash
A: A command shell and scripting language used in Linux and pre-Catalina macOS
72
Define: Macros
A: Scripts used in applications like Microsoft Office, often written in VBA, potentially opening shells for malicious attacks.
73
Acronym: VBA
A: Visual Basic for Applications.
74
Acronym: RAT
Remote Access Trojan.
75
True or False:
Python is unsuitable for developing malware because it cannot run on non-Windows systems.
False
Python can run on multiple operating systems, including Linux, macOS, and Android.
76
True or False:
PowerShell scripts require an executable to run, making them easy to detect.
False
PowerShell scripts can run directly in system memory, making them fileless and harder to detect.
77
True or False:
Macros are always disabled by default in all Microsoft Office versions.
False
Macros are disabled by default only in newer versions; users must manually enable them.
78
Define: Shellshock
A malware exploiting a flaw in Bash to inject malicious commands on Linux and macOS systems.
79
Define: Cmdlets
Tiny PowerShell scripts performing specific functions, often used to automate tasks in Windows.
80
Define: Python's use in malware
A: Python is used to develop malware like RATs, allowing functions such as screenshots, remote webcam access, and web requests.
81
Q: Acronym: SAM
A: Security Account Manager.
82
Q: Acronym: WMI
A: Windows Management Instrumentation.
83
Define: Rainbow table
A: A precomputed table of passwords and their hashes used to quickly crack hashed passwords without brute-forcing.
84
Define: Salting
A: Adding random characters to the beginning or end of a password before hashing to create unique hashes and defend against rainbow attacks.
85
Define: Password spraying
A: A brute-force method where the attacker tries the same password across multiple accounts to avoid lockout policies.
86
Define: Dictionary attack
A: A password attack using a predefined list of common words and phrases to guess passwords.
87
Define: Social engineering
A: A manipulation technique where attackers exploit human behavior to obtain sensitive information, such as passwords
88
Define: Shoulder surfing
A: An attack where an attacker observes a user typing passwords or other sensitive information.
89
Q: Acronym: NTDS.DIT
A: Active Directory credential store.
90
True or False: Password spraying targets one account with many passwords to avoid lockout policies.
A: False: Password spraying uses the same password across many accounts to bypass lockout policies.
91
True or False: Salting hashes prevents rainbow table attacks.
A: True: Salting adds unique characters to hashes, making them immune to precomputed rainbow tables.
92
True or False: Dictionary attacks are ineffective against strong, complex passwords.
A: True: Dictionary attacks are only effective against weak, common passwords.
93
True or False: Online brute-force attacks are faster than offline brute-force attacks.
A: False: Offline attacks are faster since they do not interact with authentication systems or lockout policies.
94
True or False: A rainbow table must be generated for each specific hashing algorithm.
A: True: Different hash algorithms require distinct rainbow tables due to variations in hashing processes.
95
Define: Dumpster diving
A: A social engineering technique where attackers search through discarded items for sensitive information.
96
Q: Define: Offline password attack
A: An attack where password hashes are obtained and cracked without interacting with the authentication system.
97
Define: rcrack
A: A tool used to crack password hashes using rainbow tables
98
True or False:
Strong passwords are the best defense against brute-force and dictionary attacks.
A: True:
Complex, long passwords with mixed character types reduce the effectiveness of these attacks.
99
True or False:
Salting ensures two identical passwords produce different hashes.
A: True:
Salting adds unique values, making hashes distinct even for identical passwords.
100
True or False:
Lockout policies prevent all brute-force attacks.
A: False:
Password spraying and offline attacks can bypass lockout policies.
101
Acronym: Rtgen
Rainbow table generator
102
Acronym:
Rtsort
A program that sorts rainbow tables for binary search.
