Módulo 08 - Network and Endpoint Security Flashcards
(239 cards)
1
Q
Define: OS Hardening
A
Enhancing an operating system’s security by removing unnecessary components, limiting access, and applying best practices.
2
Q
Define: Access Control Lists (ACLs)
A
Rules defining user permissions to resources, such as files or networks, based on identifiers and associated privileges.
3
Q
Define: Full Disk Encryption (FDE)
A
Encryption that protects all data on a hard drive, including system files and user data, even when the OS is off.
4
Q
Acronym:
PoLP
A
Principle of Least Privilege.
5
Q
Acronym:
S/MIME
A
Secure/Multipurpose Internet Mail Extensions.
6
Q
Compare:
Endpoint Protection vs. Patch Management
A
Endpoint Protection: Focuses on safeguarding devices against malware and threats.
Patch Management: Addresses vulnerabilities by applying updates and patches.
7
Q
List:
Key elements of endpoint hardening.
A
- Remove unnecessary software.
- Change default passwords.
- Apply configuration enforcement.
- Implement encryption techniques.
- Use access control policies.
- Monitor for changes and compliance.
8
Q
List:
Types of encryption techniques.
A
- Full Disk Encryption (FDE).
- Removable Media Encryption.
- Virtual Private Networks (VPNs).
- Email Encryption.
9
Q
Define:
Implicit Deny ACLs
A
A rule that denies access unless explicitly allowed, ensuring tighter security by default.
10
Q
Define:
Authorization Creep
A
Gradual accumulation of unnecessary privileges by a user due to improper privilege management.
11
Q
Define:
Deprovisioning
A
The process of removing access rights and permissions when an employee or contractor leaves or a project ends.
12
Q
Acronym:
FSRM
A
File Server Resource Manager.
13
Q
Acronym:
FTPS
A
FTP Secure
which adds SSL/TLS to FTP for secure logon and data transfer.
14
Q
Acronym:
SFTP
A
Secure Shell File Transfer Protocol.
15
Q
Define:
FSRM Quotas
A
Storage limits on a directory.
Hard (Block further storage) or Soft (Only alerts)
16
Q
Define:
File Screens on FSRM
A
Rules tha restrict file types that might be saved on a directory
17
Q
Define:
NetBIOS
A
Network protocol for file and printer sharing, quite unsecure.
18
Q
Define:
Tombstone File
A
File replaced that informs about a violation, keeping the original unaccessible
19
Q
Acronym:
IPSec
A
Internet Protocol Security
20
Q
Acronym:
SCP
A
Secure Copy Protocol
21
Q
Define:
Administrative Share
A
Hidden directory that only admins have access
22
Q
Compare:
SFTP vs. FTPS
A
SFTP: Secure Shell-based, not related to FTP, uses SSH2 for secure data transfer.
FTPS: FTP with SSL/TLS, requires server certificates for encrypted communication.
23
Q
Compare:
Hard Limit vs. Soft Limit in Quotas
A
Hard Limit: Prevents users from exceeding the data quota.
Soft Limit: Allows exceeding the quota but sends a warning message.
24
Q
List:
DLP Remediation methods
A
- Alert only: Registra o incidente sem bloquear o acesso.
- Block: Impede a cópia, mas mantém o arquivo acessível.
- Quarantine: Restringe o acesso ao arquivo original.
- Tombstone: Substitui o arquivo por uma mensagem de violação de política.
25
Acronym:
NTFS
New Technology File System.
26
Define:
NTFS Permissions
Permissions that control access to files and folders on drives formatted with NTFS, applying both locally and over a network.
27
Define:
Share Permissions
Permissions that control access to shared folders over a network but do not apply to local access.
28
Define:
Inheritance
A feature where folders pass down their permissions to subfolders and files, unless explicitly overridden.
29
Define:
Octal Notation in Permissions
A numeric representation of file permissions where read = 4, write = 2, and execute = 1.
30
Define:
Chmod Command
A Linux command used to change file permissions in symbolic or absolute (octal) mode.
31
Acronym:
DACL
Discretionary Access Control List.
32
True or False:
NTFS permissions apply only to files accessed over the network.
False.
NTFS permissions apply to both local and network access.
33
True or False:
Share permissions can be assigned to individual files.
False
34
True or False:
In Linux, a file with permissions 755 means the owner has read, write, and execute permissions.
A: True.
35
Compare:
Share Permissions vs. NTFS Permissions
Share Permissions: Apply only to network access; control at the folder level; limited to Reader, Contributor, and Co-owner.
NTFS Permissions: Apply to both local and network access; can control at the file level; highly granular.
36
Compare:
Symbolic vs. Absolute Mode in chmod
Symbolic Mode: Uses letters (e.g., u=rwx) to specify permissions.
Absolute Mode: Uses octal numbers (e.g., 755) to represent permissions.
37
Example:
Interpret this permission string: drwxr-xr-x.
d: Directory.
Owner: Read, write, execute.
Group: Read, execute.
Others: Read, execute.
38
Define:
Physical Port Hardening
The process of disabling unused physical interfaces, such as USB or HDMI, to reduce physical attack vectors.
39
Define:
Logical Ports
Software-based communication endpoints used for data exchange between applications or services.
40
Define:
Host-Based Firewalls
Firewalls installed on individual devices to control incoming and outgoing network traffic.
41
Define:
Intrusion Prevention System (IPS)
A system that monitors network traffic to detect and prevent potential intrusions.
42
Define:
Service Hardening
Configuring services to minimize vulnerabilities by disabling unnecessary features and applying security updates.
43
Define:
Default-Deny Policy
A security policy that blocks all traffic unless explicitly permitted.
44
Acronym:
UEFI
Unified Extensible Firmware Interface.
45
Acronym:
BIOS
Basic Input/Output System.
46
Acronym:
nmap
Network Mapper
47
Acronym:
ss (Linux Command)
Socket Statistics.
48
Compare:
Host-Based Firewalls vs. Network Firewalls
Host-Based Firewalls: Protect individual devices and filter traffic specific to that host.
Network Firewalls: Protect an entire network and filter traffic entering or leaving the network.
49
Compare:
nmap vs. netstat
nmap: Scans for open TCP/UDP ports on a network.
netstat: Displays active network connections and listening sockets on a system.
50
Example:
What command scans for open TCP ports using nmap?
nmap -sT ipaddress.
51
Example:
How to disable a service in Linux?
Use systemctl disable servicename to prevent the service from starting on boot.
52
Define:
Wireless Access Point (WAP)
A device that broadcasts wireless signals, connects wireless clients to a network, and may link to a wired network.
53
Define:
Thin Access Point
A WAP that relies on a wireless controller for management and client handling.
54
Define:
Wireless LAN Controller (WLC)
A device used to manage multiple access points in an enterprise environment.
55
Define:
Service Set Identifier (SSID)
The name of a wireless network that allows users to identify and connect to it.
56
Define:
WPA2-PSK
A Wi-Fi security protocol using a pre-shared key for group authentication.
57
Define:
Simultaneous Authentication of Equals (SAE)
A WPA3 protocol for secure password exchange, resistant to offline brute force attacks.
58
Define:
Heat Map
A visual representation showing wireless signal strength across an area.
59
Acronym:
WAP
Wireless Access Point.
60
Acronym:
WLC
Wireless LAN Controller.
61
Acronym:
WDS
Wireless Distribution System.
62
Acronym:
WPS
Wi-Fi Protected Setup.
63
Acronym:
DPP
Device Provisioning Protocol.
64
Acronym:
RADIUS
Remote Authentication Dial-In User Service.
65
Acronym:
EAP
Extensible Authentication Protocol.
66
True or False:
A thin access point can manage clients independently without a WLC.
False.
Thin access points rely on a WLC for client management.
67
True or False:
WPA3-Enterprise requires the use of 192-bit AES encryption.
True.
WPA3-Enterprise mandates 192-bit AES encryption.
68
True or False:
WPA2-PSK uses a group-shared passphrase for authentication.
True.
WPA2-PSK uses a pre-shared key for group authentication.
69
True or False:
Site surveys are unnecessary for optimizing WAP placement.
False.
Site surveys are essential for ensuring optimal WAP placement and coverage.
70
Compare:
Fat vs. Thin Access Points
Fat Access Points: Standalone devices that manage clients and broadcast the network independently.
Thin Access Points: Require a wireless LAN controller for client and network management.
71
Compare:
WPA2 vs. WPA3
WPA2: Uses AES with CCMP for encryption and is vulnerable to handshake attacks.
WPA3: Introduces SAE for secure password exchange and enhanced encryption protocols.
72
Compare:
PSK vs. SAE Authentication
PSK: Uses a shared passphrase, vulnerable to brute force attacks.
SAE: Uses a secure handshake resistant to offline attacks.
73
List:
Key features of WPA3.
1. Simultaneous Authentication of Equals (SAE).
2. Enhanced Open for encryption on open networks.
3. Updated cryptographic protocols using AES-GCMP.
4. Support for Wi-Fi Easy Connect for simplified configuration.
74
List:
Wi-Fi authentication methods.
1. Personal (PSK or SAE).
2. Open (unencrypted or Enhanced Open).
3. Enterprise (RADIUS with unique credentials).
75
Example:
What does WPA3-SAE improve over WPA2-PSK?
WPA3-SAE uses a secure handshake to prevent offline attacks, unlike WPA2-PSK, which is vulnerable to brute force.
76
Example:
How is a wireless bridge implemented?
By connecting two wireless networks through a wired or wireless distribution system (WDS).
77
Example:
What is a heat map used for in wireless networks?
To visualize signal strength and channel overlap for optimizing WAP placement.
78
Define:
KRACK Attack
A replay attack targeting the WPA and WPA2 4-way handshake, allowing offline brute-force attempts to recover keys.
79
Define:
Evil Twin Attack
An attack where a rogue access point mimics a legitimate network to intercept user data.
80
Define:
Initialization Vector (IV) Attack
A cryptographic attack exploiting the reuse of initialization vectors in WEP encryption to decrypt keys.
81
Define:
Bluejacking
Sending unsolicited messages to nearby Bluetooth devices in discovery mode.
82
Define:
Bluesnarfing
Exploiting vulnerabilities in Bluetooth to access sensitive data on a paired device.
83
Define:
RFID Eavesdropping
Using an RFID reader to intercept communication between a tag and a legitimate scanner.
84
Define:
Relay Attack
Capturing NFC data in transit to impersonate the original device.
85
Acronym:
WEP
Wired Equivalent Privacy.
86
Acronym:
NFC
Near Field Communication.
87
Acronym:
RFID
Radio Frequency Identification.
88
True or False:
WPA3 is vulnerable to KRACK attacks.
False. WPA3 addresses the vulnerabilities exploited in KRACK attacks.
89
True or False:
A jamming attack can be non-malicious.
True. Non-malicious interference can come from devices like microwave ovens or cordless phones.
90
True or False:
Disassociation attacks exploit encrypted management frames.
False. Disassociation attacks exploit unencrypted management frames.
91
True or False:
Passive RFID tags require external power to operate.
True. Passive RFID tags rely on energy from the scanner.
92
Compare:
Rogue Access Point vs. Evil Twin
Rogue Access Point: Any unauthorized access point on a network.
Evil Twin: A rogue access point designed to mimic a legitimate one.
93
Compare:
RFID vs. NFC
RFID: One-way communication; longer range.
NFC: Two-way communication; very short range.
94
List:
Common wireless attacks.
1. Wireless denial-of-service (DoS).
2. Evil twin attack.
3. Initialization vector (IV) attack.
4. Jamming attack.
5. Disassociation/deauthentication attack.
6. Replay and key recovery attacks.
95
Define:
What is a rogue access point?
An unauthorized device providing wireless access, potentially used for malicious purposes.
96
Define:
What is a KRACK attack?
A replay attack exploiting weaknesses in WPA2's 4-way handshake.
97
Define:
How does an evil twin attack work?
By creating a rogue access point with the same SSID as a legitimate one to capture user data.
98
Define:
SSID Suppression
Disabling the broadcast of the network's SSID to make it less visible to nearby devices, though determined hackers can still detect it.
99
Define:
MAC Address Filtering
Restricting network access to specific MAC addresses, which can be bypassed by spoofing a valid MAC address.
100
Define:
Wi-Fi Signal Strength Adjustment
Reducing a WAP's broadcast strength to limit signal emanation outside the intended area, enhancing security.
101
Define:
WPA2
A wireless security protocol using AES-CCMP for encryption and a 4-way handshake for authentication.
102
Define:
WPA3
A wireless security protocol that replaces WPA2's 4-way handshake with Simultaneous Authentication of Equals (SAE), providing Perfect Forward Secrecy.
103
Acronym:
SSID
Service Set Identifier.
104
Acronym:
MAC
Media Access Control
105
Acronym:
SAE
Simultaneous Authentication of Equals.
106
Compare:
WPA2-Personal vs. WPA2-Enterprise
WPA2-Personal: Uses a pre-shared key for authentication.
WPA2-Enterprise: Uses a RADIUS server to authenticate individual users.
107
Compare:
WPA2 vs. WPA3
WPA2: Uses a 4-way handshake, vulnerable to offline attacks.
WPA3: Uses SAE for secure authentication and Perfect Forward Secrecy.
108
Compare:
SSID Broadcast vs. SSID Suppression
SSID Broadcast: Makes the network easily discoverable.
SSID Suppression: Hides the network's SSID but does not make it entirely undetectable.
109
Define Pre-shared Key (PSK).
A passphrase used for wireless network access; the most commonly used access method.
110
What is Wi-Fi Protected Setup (WPS)?
A method to connect devices securely to a network using PSK and WPA2 by pushing buttons or entering a unique PIN.
111
Define Open Network.
A wireless network with no authentication, allowing unrestricted access; suitable for public spaces.
112
What is a Captive Portal?
A mechanism forcing users to interact with a web page before granting network access, often for agreement or payment.
113
What is Extensible Authentication Protocol (EAP)?
A framework supporting multiple authentication methods, enabling secure communication between client and server.
114
What is EAP-PEAP?
EAP with SSL/TLS tunnel for secure authentication using a server-side certificate.
115
Define EAP-FAST.
EAP with a Protected Access Credential (PAC) to authenticate users in a TLS tunnel; mitigates PAC compromise risks.
116
What is EAP-TLS?
An EAP standard requiring client- and server-side certificates, known for its robust security.
117
Define EAP-TTLS.
An updated version of EAP-TLS that simplifies deployment by only requiring a server-side certificate.
118
Define MAC Filtering.
Restricting network access to specific MAC addresses; prone to spoofing but adds an extra layer of control.
119
What is 802.1X Port-based Network Access Control?
A standard requiring authentication when a device connects to a switch port, using EAP and RADIUS for validation.
120
Define Supplicant in 802.1X.
The device requesting access, such as a PC or laptop.
121
What is the role of the Authenticator in 802.1X?
A network device like a switch that forwards authentication requests between the supplicant and the authentication server.
122
What is a RADIUS Server?
The server validating authentication requests and managing authorization decisions in 802.1X.
123
Define Air-Gapped Host.
A host physically isolated from any network to prevent unauthorized access, often used in high-security environments.
124
What is an Air-Gapped Network?
A network isolated from others, allowing communication only within itself; used in military or industrial facilities.
125
Example:
How does WPS connect devices?
By pushing buttons on the access point and device or entering a PIN.
126
Example:
How does a Captive Portal secure public networks?
It redirects users to a page for terms agreement or payment before granting internet access.
127
Example:
What happens in 802.1X authentication?
The supplicant's credentials are sent to the authentication server via the authenticator for validation.
128
Compare:
PSK vs. WPS
PSK: Requires manual entry of a passphrase.
WPS: Automates connection using buttons or PIN.
129
Compare:
Air-Gapped Host vs. Air-Gapped Network
Air-Gapped Host: A single device isolated from any network.
Air-Gapped Network: A group of devices communicating only within their isolated network.
130
What is a remote access VPN?
A secure tunnel over a public network connecting a user's PC or smartphone to a private network.
131
Acronym:
(RDP)
Remote Desktop Protocol
132
What is Microsoft's Remote Desktop Protocol (RDP) used for?
Accessing a physical machine on a one-to-one basis by transferring screen, audio, and input data.
133
Define HTML5 VPN.
A clientless remote desktop gateway using a web browser and WebSocket protocol for bidirectional communication.
134
What is SSH?
A secure protocol for remote administration and file transfer, widely implemented via OpenSSH.
135
What is an SSH Host Key?
A public/private key pair identifying an SSH server for secure client-server communication.
136
What is public key authentication in SSH?
A method where a remote user’s public key is authorized on the server for secure access.
137
Which SSH command connects to a server?
ssh username@host
138
How do you generate an SSH key pair?
ssh-keygen -t rsa
139
How do you copy an SSH key to a server?
ssh-copy-id username@host
140
What is HTTP?
A protocol for exchanging web content; uses plaintext and is unsecured.
141
Define HTTPS.
HyperText Transfer Protocol Secure; uses SSL/TLS to encrypt data and operates on TCP port 443.
142
How is HTTPS identified in a browser?
By the "https://" URL prefix or a lock icon in the address bar.
143
What is S-HTTP?
Secure HyperText Transfer Protocol; provides message security but is not widely used or as secure as HTTPS.
144
Compare
HTTPS and S-HTTP.
HTTPS: Encrypts the entire session, uses port 443, and is stateful.
S-HTTP: Secures only messages, does not use port 443, and is connectionless.
145
List:
What are the SSH client authentication methods?
Username/Password – Standard credentials.
Public Key Authentication – Using a public key authorized on the server.
Kerberos – Authentication via Ticket Granting Tickets.
146
List:
What are the three main VPN topologies?
Client-to-Site VPN: Allows individual users to connect securely to a corporate network.
Site-to-Site VPN: Connects two private networks automatically via secure gateways.
Host-to-Host Tunnel: Secures traffic between two specific computers.
147
Why are legacy VPN protocols like PPTP deprecated?
They do not provide adequate security compared to modern protocols like TLS and IPsec.
148
How does a TLS VPN authenticate users?
Using digital certificates, with server certificates identifying the VPN gateway and optionally client certificates for mutual authentication.
149
What is Datagram TLS (DTLS)?
A version of TLS over UDP, offering improved performance for latency-sensitive traffic like voice and video.
150
Acronym:
DTLS
Datagram TLS
151
What are the supported TLS versions?
TLS 1.3 and TLS 1.2. Versions earlier than TLS 1.2 are deprecated.
152
What layer of the OSI model does IPsec operate at?
Layer 3
153
What are the two core IPsec protocols, and what do they do?
Authentication Header (AH): Provides packet integrity but not confidentiality.
Encapsulating Security Payload (ESP): Encrypts packet data and provides confidentiality and integrity.
154
What are the two IPsec modes?
Transport Mode: Encrypts only the payload, leaving the IP header intact.
Tunnel Mode: Encrypts the entire packet, including the IP header.
155
What is the role of the Internet Key Exchange (IKE) protocol in IPsec?
It establishes mutual authentication, negotiates cryptographic settings, and creates a secure channel for key exchange.
156
What are the two phases of IKE negotiations?
Phase I: Establishes identity, performs key agreement, and creates a secure channel.
Phase II: Negotiates ciphers and key sizes for the IPsec session.
157
What is the difference between IKEv1 and IKEv2?
IKEv2 supports EAP authentication, NAT traversal, and MOBIKE multihoming, making it more suited for remote access VPNs.
158
How do TLS and IPsec differ in terms of application?
TLS: Operates at the application layer, suitable for specific applications like HTTPS.
IPsec: Operates at the network layer, providing broader support for all traffic types.
159
What authentication mechanisms are supported by IKE?
Digital Certificates and Pre-Shared Key (PSK)
160
What is Perfect Forward Secrecy (PFS), and why is it important?
A cryptography method that generates unique keys for each session, ensuring that past communications remain secure even if a key is compromised.
161
Define:
EAP Authentication
A framework supporting multiple methods
Used in:
- WPA2/WPA3-Enterprise
- 802.1X.
162
Define:
NAT Traversal
Method of establishing direct communication between two network endpoints over a network utilizing NAT
UDP punching hole
163
Define:
MOBIKE Multihoming
An IKEv2 feature that maintains VPN connections during network changes (e.g., Wi-Fi to cellular) and supports multiple active interfaces.
164
Define:
Packet Overhead
Extra data (e.g., headers, encryption) added to packets for transmission, affecting payload size and bandwidth usage.
165
What is a web browser's primary function?
A web browser retrieves and displays internet information, but it can also pose security risks to a network.
166
What are common indicators of an unsecured browser connection or attack?
- Unexpected domain names in URLs
- Altered menu bars
- Unlocked status line when SSL should be in use.
167
What types of private data can be cleared from a browser?
1. Browsing and download histories,
2. Cookies
3. Cached files
4. Passwords
5. Auto-fill data
6. Site permissions
7. Hosted app data.
168
What are cookies, and why can they pose a privacy risk?
Cookies store preferences and identify you to websites but can be misused to collect personal data or track activities.
169
What is the difference between first-party and third-party cookies?
First-party cookies come from the visited site; third-party cookies come from linked sites like ads.
170
What is a browser cache, and why should it be cleared?
A cache stores reusable data like images and passwords. It should be cleared on public computers to protect personal information.
171
How can browser security be increased?
1. Enable warnings for site add-ons
2. Web filtering,
3. No storing passwords.
4. Block pop-ups
5. No third-party cookies
6. Ask where to save files.
172
What are add-ons, and how should they be managed?
Add-ons add browser functionality but can be malicious. Review and uninstall unnecessary or inappropriate ones.
173
What are the two types of privilege escalation?
Horizontal: Accessing another user's data with the same privilege level.
Vertical: Gaining elevated privileges, such as administrative access.
174
What is pointer dereferencing?
Retrieving a value stored in memory via a pointer.
175
What can happen if a pointer has a NULL value?
It can lead to a denial-of-service (DoS) attack or kernel exploitation. (NullPointer)
176
What is a buffer overflow?
An overflow occurs when more data is stored than a buffer can handle, potentially allowing arbitrary code execution or DoS.
177
What is resource exhaustion?
Depleting system resources, like memory or CPU, to cause a denial-of-service.
178
How can memory leaks cause problems?
They lead to resource exhaustion and can enable exploitation under low-memory conditions.
179
What is a race condition?
A vulnerability where multiple processes are exploited to perform unauthorized actions.
Such as multiple process accessing the same data simultaneously
180
How do you mitigate race conditions?
Lock files, use file handles instead of names, and prevent changes between system calls.
181
What is improper error handling?
Displaying detailed error messages that reveal sensitive information attackers can exploit.
182
What is improper input handling?
Failing to validate or sanitize input data, leading to vulnerabilities like SQL injection or buffer overflows.
183
What is a replay attack?
Intercepting and replaying network traffic to impersonate the sender.
184
How can replay attacks be mitigated?
Use strong digital signatures, timestamps, and sequence numbers.
185
What is a "pass the hash" attack?
Using stored password hashes from a compromised machine to access other systems.
186
How do you mitigate pass the hash attacks?
1. Limit domain admin access
2. Disable remote desktop
3. Use separate accounts for admin tasks.
187
What are API attacks?
Exploiting vulnerabilities in APIs to gain unauthorized access or data.
188
How can API attacks be mitigated?
Implement rate limiting, monitor logs, and validate input data.
189
What is SSL stripping?
Downgrading an HTTPS connection to HTTP to intercept user data.
190
How can SSL stripping be mitigated?
Use HSTS, encrypt all site elements, and add the domain to the HSTS preload list.
191
What is driver manipulation?
Altering or adding malicious functionality to device drivers.
192
What is "refactoring" in driver manipulation?
Modifying driver code internally without changing its external behavior to hide malicious actions.
193
What is "shimming" in driver manipulation?
Using or modifying intermediary code between older APIs and updated systems to inject malicious functionality.
194
What is the role of client-side and server-side validation?
Client-side: Prevent errors locally.
Server-side: Validate data after submission to prevent bypassing safeguards.
195
What are DNSSEC and HTTPS used for?
DNSSEC: Ensures secure connections with digital certificates.
HTTPS: Encrypts HTTP traffic for secure communication.
196
What is the Waterfall Development Life Cycle?
A linear model where each step (Requirements, Design, Implementation, Testing, Deployment, Maintenance) must be completed before moving to the next.
197
What are key characteristics of the Waterfall model?
Sequential steps, slow progress, limited flexibility, and fixed requirements.
198
What is the Agile Development Life Cycle?
A model that breaks development into smaller, iterative cycles called Sprints, focusing on continuous updates and testing.
199
How do Agile Sprints work?
Each Sprint lasts 2–3 weeks, focuses on a specific feature, and includes regular testing and iterative improvement.
200
What are compile-time errors?
Errors during the code-building phase, preventing the program from running.
201
What are runtime errors?
Errors that occur when a program is running, often called bugs.
202
What is error handling?
Programming techniques to manage unexpected issues without crashing or exposing vulnerabilities.
203
Why is custom error handling better than default handlers?
It limits the information disclosed to attackers, avoiding exposure of sensitive details.
204
What is static code analysis?
Reviewing source code for vulnerabilities and errors before deployment.
205
What are the benefits of static code analysis?
Early bug detection, improved security, enforced coding standards, and developer education.
206
What is dynamic application security testing (DAST)?
Black-box testing of applications after deployment to find vulnerabilities externally.
207
What is static application security testing (SAST)?
White-box testing that analyzes source code early in development to find vulnerabilities like SQL injection.
208
What is interactive application security testing (IAST)?
A hybrid testing method combining runtime and static analysis to identify vulnerabilities during runtime.
209
What is software sandboxing?
Isolating processes to restrict their access to the system, preventing widespread damage from malicious or faulty software.
210
How do browsers implement sandboxing?
Each tab and extension runs in an isolated process, preventing one from affecting others.
211
How do operating systems use sandboxing?
Apps are confined to their own data and resources, limiting access to other apps or system resources.
212
What role do VMs and containers play in sandboxing?
They isolate environments, ensuring a breach in one does not affect others or the host.
213
What is normalization in databases?
A process that reorganizes data to eliminate redundancy, improve performance, and reduce exploitation risks.
214
What are stored procedures?
Predefined database statements that centralize logic, prevent code duplication, and mitigate injection attacks.
215
What is code obfuscation?
Deliberate creation of hard-to-understand code to prevent reverse engineering and tampering.
216
What are the risks of code reuse?
Vulnerabilities in reused code can propagate if not tested thoroughly before sharing or adapting.
217
What is dead code?
Unused or non-executable code that should be removed to eliminate security risks.
218
What is memory management?
Allocating and releasing memory efficiently to prevent vulnerabilities like buffer overflows or memory leaks.
219
What are common memory vulnerabilities?
Incorrect buffer size calculation, unchecked input size, and uncontrolled format strings.
220
What are third-party libraries and SDKs?
Prewritten code or tools from external sources, which must be tested for flaws and unnecessary code.
221
How can sensitive data exposure be mitigated?
Encrypt data in transit and at rest, disable form caching, and use salted, hashed passwords.
222
What is fuzz testing?
A technique providing random or unexpected input to applications to identify vulnerabilities.
223
What is code signing?
Digital signatures verify a software’s integrity and origin but don’t guarantee its security.
224
What are secure cookies?
Cookies configured with attributes like Secure, HttpOnly, and SameSite to prevent attacks like session hijacking and CSRF.
225
What is the 'Secure' attribute for cookies?
Ensures cookies are sent only over HTTPS connections, protecting them from interception.
226
What is the 'HttpOnly' attribute for cookies?
Prevents client-side scripts from accessing cookies, mitigating XSS attacks.
227
What is the 'SameSite' attribute for cookies?
Restricts cookies to same-site requests, mitigating CSRF attacks.
228
Why should cookies have expiration limits?
To restrict their usable life and reduce the risk of long-term exploitation.
229
What is the primary assumption for application hardening?
Assume all installed applications are flawed.
230
What should be done with unused applications?
Remove all unused applications from the system.
231
Why should administrative privileges be limited?
To reduce the potential attack surface and prevent unauthorized access.
232
What is process spawning, and why block it?
Process spawning creates a new child process; blocking it prevents process-spawning attacks.
233
Why control access to executable files?
To protect them from modification by removing Write permissions for applications.
234
What is Data Execution Prevention (DEP)?
A feature that prevents applications from executing code in memory designated for data storage.
235
What do exception rules in application hardening allow?
Administrators can bypass specific hardening rules for legitimate application needs.
236
What is the purpose of application hardening tools like AppArmor?
To apply specific hardening rules to applications, libraries, and SDKs.
237
What is the role of logging in application security?
Captures important events for audits, incident response, and system troubleshooting.
238
Why integrate real-time alerting in applications?
To detect potential threats, such as repeated failed login attempts or unusual data transfers.
239
How does error handling improve security?
Masks sensitive debugging information to minimize risks of exploitation.
