Part 4 Flashcards
(102 cards)
When an antivirus program detects a virus an option may be given to an administrator to remove, clean or ____ a file.
Quarentine
There are occasions when a file or program may exhibit behavior or coding that triggers a signature or behavior alert from an antimalware system often called?
False Positive
An algorithm or hash that is unique to a specific attack method or virus?
Signature
What scans continuously inspect files and email data for viruses as they are read from or written to a computer?
Auto Protect
What does the effectiveness of VSE depend on?
Scanning engine and definition DAT files
What prevents unwanted changes to your computer by retricting access to specified ports, files, shares etc?
Access Protection
How often on COMPOSE do Anti Virus scans run?
Daily
What is real time monitoring for malicious activities?
Behavioral
What is a program that attaches itself to a file or another program?
Virus
What is a program that replicates and propogates itself without having to attach itself to a file or program.
Worm
What are three reasons privilage escalation can occur?
- Error by administrator
- weak password policy
- bad coding in software
What are additional security settings required?
- Account lockout duration
- minimum password length
- disabling unnecessary services
- “Allow administration by” option
What are 4 types of Trojans?
Remote Access Trojan (RAT) : full or partial access to victim’s system
Data Sending : sends key strokes, passwords, cookies via email or back door
Destructive : deleting files, corrupting the OS, crashing the system, disable AV on the firewall
Proxy : jumping point for an attacker on another system to mask identity
What is the purpose of Denial of Service attack?
Deny legitimate users from accessing infomation or resources
What are some signs of Denial of Service attack?
- Spam
- Unavailable website
“Flood”, slowing or stopping data transfer, consumption of disk space or processor time, disrupting routing info, disrupting physical network components
What involves exploiting the session between devices?
Session hijacking
How can you prevent session hijacking?
- Use encryption
- use secure protocol
- limit incoming connections
- minimize remote access
- strong authentication
- using switches over hubs
- user training
How many user accounts should an admin have at minimum?
2
User and administrator
What command line run script launches GPO editor?
gpedit.msc
What provides the configuration setting of RBAC settings for installed applications?
Authorization Manager
What analyizes system configuration and applies security templates?
Security Configuration and Analysis
On a windows system, GPO editor seperates the local computer policy into two sections?
- Computer configuration
- User configuration
What provides the options for setting system auditing, rights assigned to groups, and their users and security features such as device settings, log on requirements, account settings, network access etc?
Local Policies
What provides options for setting password complexity and length requirements as well as account lockout lengths and attempt frequencies?
Account Policies
