Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security+ > Módulo 07 - Vulnerability Management > Flashcards

Módulo 07 - Vulnerability Management Flashcards

(83 cards)

Start Studying
1
Q

Define: Vulnerability Management

A

A: The process of
1. identifying,
2. evaluating,
3. treating
4. reporting
vulnerabilities to prevent exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define: End-of-Life (EOL) Systems

A

A: Products or systems that are no longer supported by the manufacturer or vendor, receiving no updates or security patches, making them vulnerable to new threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define: Legacy Systems

A

A: Outdated computer systems or applications that are still in use despite their limitations, often due to the high cost or risk associated with replacing them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define: Firmware Vulnerabilities

A

A: Security flaws within the foundational software that controls hardware, which can be exploited to gain unauthorized access or persist on a system undetected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define: Meltdown and Spectre

A

A: Critical vulnerabilities discovered in 2018 affecting nearly all CPUs, allowing malicious programs to steal data being processed on the computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define: LoJax

A

A: A malware discovered in 2018 that infects the UEFI firmware, allowing attackers to maintain persistence even after hard drive replacements or OS reinstallations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define: Vulnerability Scanning

A

A: The use of specialized tools to automatically identify potential security weaknesses in an organization’s digital assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define: Shellshock

A

A: A significant vulnerability in the Bash shell affecting Unix-based systems, including macOS, allowing attackers to execute arbitrary commands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define: Heartbleed

A

A: A serious vulnerability in the OpenSSL cryptographic library that allowed attackers to read protected memory on affected servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Q: Acronym: UEFI

A

A: Unified Extensible Firmware Interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Q: Acronym: SMB

A

A: Server Message Block.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Q: Acronym: MMS

A

A: Multimedia Messaging Service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Q: Acronym: OpenSSL

A

A: Open Secure Sockets Layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

True or False:
The Stagefright vulnerability affected iOS devices.

A

A: False:

Stagefright affected Android devices by allowing code execution via specially crafted MMS messages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or False:
Heartbleed was a vulnerability in the OpenSSL library that compromised secret keys.

A

A: True:

Heartbleed allowed attackers to read sensitive memory contents, exposing secret keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False:
Firmware updates are unnecessary as firmware cannot be exploited.

A

A: False:

Firmware can contain vulnerabilities; updating it is crucial for security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False:
macOS is completely safe from vulnerabilities due to its Unix-based architecture.

A

A: False:

macOS can have vulnerabilities, such as those exploited by the Shellshock bug.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define: WannaCry Ransomware

A

A: A 2017 global ransomware attack that exploited the EternalBlue vulnerability to encrypt data and demand ransom payments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define: Stagefright Vulnerability

A

A: A critical flaw in the Android media playback engine that allowed remote code execution via MMS messages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define: Watering Hole Attack

A

A: A strategy where attackers compromise a website likely to be visited by their targets to distribute malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define: Conficker Worm

A

A: A worm exploiting the MS08-067 vulnerability in Windows, leading to one of the largest infections in history.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define: EternalBlue

A

A: An exploit developed by the NSA and leaked by the Shadow Brokers group, targeting vulnerabilities in Microsoft’s SMB protocol, notably used in the WannaCry attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Acronym:
Bash

A

A: Bourne Again Shell.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define: Vulnerability Scanning

A

A: The process of automatically identifying vulnerabilities systems, such as
1. open ports
2. insecure configurations
3. missing patches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Define: Threat Feed
A: A continuously updated source of information about potential cyber threats and vulnerabilities, providing actionable intelligence for vulnerability management.
26
Define: Penetration Testing
A: A proactive method where ethical hackers simulate real-world attacks to exploit vulnerabilities and evaluate an organization's security posture.
27
Define: Bug Bounty Programs
A: Initiatives that incentivize external security researchers to discover and responsibly report vulnerabilities in exchange for rewards.
28
Define: Responsible Disclosure Programs
A: Guidelines established by organizations to encourage individuals to report vulnerabilities responsibly, allowing for fixes before exploitation.
29
Define: Security Audits
A: Comprehensive reviews of an organization’s security controls and practices, often aligned with standards like ISO 27001 or NIST.
30
Define: Cyber Threat Intelligence (CTI)
A: Data about threats and attackers gathered from various sources, used to improve an organization’s cybersecurity posture.
31
Acronym: GDPR
A: General Data Protection Regulation.
32
Define: Deep Web
A: Parts of the internet not indexed by search engines, such as unlinked pages or those requiring registration.
33
Define: Dark Web
A: Hidden parts of the deep web accessible only through specific software like TOR, often associated with illicit activities but also used for privacy and research.
34
Bug Bounty vs. Penetration Testing
A: Bug bounty has external researchers testing for vulnerabilities, penetration is performed by internal or hired team.
35
Define: Behavioral Threat Research
A: Analysis of TTP tactics and procedures used by attackers, gathered through direct observation and research.
36
Acronym: TTP
A: Tactics, Techniques, and Procedures.
37
Acronym: SIEM
A: Security Information and Event Management.
38
List: Types of Vulnerability Identification Methods
1. Vulnerability scanning 2. Penetration testing 3. Bug bounty programs 4. Auditing
38
List: Threat Feed Type
1. Third-party threat feeds 2. Open-source intelligence (OSINT) 3. Closed/proprietary threat feeds 4. Information-sharing organizations
39
List: Common OSINT Tools
1. Shodan 2. Maltego 3. Recon-ng 4. theHarvester
40
List: Types of Cybersecurity Audits
1. Compliance audits 2. Risk-based audits 3. Technical audit
41
What's audited in a Security Audit?
1. Policies 2. Procedures 3. System configuration 4. Supply chain evaluation 5. Monitoring and support practices
42
Acronym: NVD
A: National Vulnerability Database
43
Define: Package Monitoring
The process of tracking and assessing the security of third-party software packages, libraries, and dependencies to ensure they are up-to-date and free from known vulnerabilities.
44
True or False: A credentialed vulnerability scan requires administrative access to hosts for deeper analysis.
A: True. Credentialed scans provide more in-depth analysis by accessing internal configurations and settings with user account privileges.
45
True or False: Non-credentialed scans can validate vulnerabilities by attempting exploitation.
A: False. Non-credentialed scans cannot exploit vulnerabilities; they only assess what is exposed to unprivileged users.
46
List: Types of vulnerability scan [Types to perform]
1. Intrusive [Tries to exploit] 2. Non-intrusive [List potential vulnerabilities] 3. Credentialed 4. Non-credentialed
47
List: Methods in application vulnerability scanning
1. Static analysis 2. Dynamic analysis
48
List: Components monitored in package monitoring.
1. Third-party software packages 2. Libraries 3. Dependencies
49
What type of vulnerability scan would you perform to simulate an external attacker without internal access to the system?
Non-credentialed scan.
50
What does automated software composition analysis (SCA) track in package monitoring?
It tracks software packages, libraries, and dependencies for outdated versions or known vulnerabilities.
51
Acronym: SCA
A: Software Composition Analysis
52
Define: Network Monitors
Tools that collect data about network infrastructure appliances. like CPU/memory usage, disk capacity, and link utilization.
53
Define: NetFlow
Reports metadata and statistics about network traffic, Analyzes traffic patterns and detection of anomalies.
54
Define: System Logs
Logs that provide audit trails of actions on a system, used to diagnose availability issues, monitor authorized and unauthorized access, and proactively identify threats and vulnerabilities.
55
Define: Cloud Monitors
Tools that monitor the performance and health of cloud services, assessing bandwidth, virtual machine status, application health, and error or alert conditions.
56
Define: Endpoint Protection Platforms (EPPs)
Modern antivirus solutions that detect malware using signatures and AI-based behavior analytics, often integrated with user and entity behavior analytics (UEBA).
57
True or False: NetFlow tracks every individual packet transmitted over the network.
False. NetFlow records metadata and statistics about network traffic, not individual packets.
58
Acronym: SNMP
Simple Network Management Protocol
59
Acronym: UEBA
User and Entity Behavior Analytics
60
Acronym: DLP
Data Loss Prevention
61
List: How do data loss prevention (DLP) tools do what they do?
1. Mediating data transfers 2. Restricting copying to authorized media 3. Monitoring DLP policy violations 4. Highlighting trends over time
62
List: Features of NetFlow analysis tools.
1. Based on traffic trends and patterns 2. Identifies rogue user behavior or malware in transit 3. Detects C&C traffic
63
List: Three main types of SIEM data collection methods.
1. Agent-based: Installed on hosts to process data locally. 2. Listener/collector: Hosts push logs directly to the SIEM server. 3. Sensor: Collects packet captures and traffic flow data from network sniffers.
64
Acronym: SOAR
Security Orchestration, Automation, and Reporting
65
Define: Log Aggregation
The process of normalizing data from various sources to ensure consistency and searchability within a SIEM system.
66
Define: Alert Fatigue
A condition where analysts become overwhelmed by low-priority alerts, potentially missing critical incidents due to high false-positive rates.
67
Define: Security Orchestration and Automation Reporting
Automation responses to incidents and integrating workflows across tools
68
What is a policy server [DLP]?
Configures: 1. Classification 2. Confidentiality 3. Privacy rules Also: 1. Logs incidents 2. Compiles reports
69
What is a tombstone mechanism in DLP?
A remediation mechanism that replaces the quarantined file with one explaining the policy violation and instructions on how to regain access.
70
Compare: Alert-only remediation vs. Block remediation in DLP.
Alert-only: Allows copying but logs the incident and may notify an administrator. Block: Prevents the user from copying the file, with or without notifying the user.
71
List: Components of a DLP solution.
1. Policy server: Configures rules and logs incidents 2. Endpoint agents: Enforces policies on client devices. 3. Network agents: Scans communications and enforces policies at network borders.
72
List: Common remediation mechanisms in DLP.
1. Alert only. 2. Block. 3. Quarantine. 4. Tombstone.
73
List: The five phases of the penetration testing life cycle.
1. Perform reconnaissance 2. Scan/enumerate 3. Gain access 4. Maintain access 5. Report
74
What does SOW stand for in penetration testing?
Scope of Work.
75
What does ROE stand for in penetration testing documentation?
Rules of Engagement.
76
What is a Rules of Engagement document?
A document detailing how the penetration test will be carried out, including data handling, test type, and notification processes.
77
Compare: Red team vs. Purple team in security operations
Red team: Focuses solely on offensive tactics (ethical hacking). Purple team: Combines offensive and defensive roles, bridging red and blue teams.
78
Black box vs. White box penetration testing
Black box: No prior knowledge of the network, simulating external attacks. White box: Full knowledge of the network, enabling comprehensive testing.
79
Define: Penetration test (pen test)
A method using authorized hacking techniques to discover vulnerabilities in an organization's security systems.
80
Define: Physical penetration testing
A test simulating real-world scenarios to evaluate physical security systems like access controls and surveillance.
81
What does CI/CD mean in continuous penetration testing?
Continuous Integration/Continuous Deployment.
82
List: The steps of a penetration test.
1. Verify a threat exists. 2. Bypass security controls. 3. Actively test security controls. 4. Exploit vulnerabilities.

Security+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions