Practice Test 1 Flashcards

Question

Which Windows event channel provides logs on privilege escalation? Setup System Security Application

Answer 1

**Version 5** of VPC Flow Logs includes additional fields to help understand the direction of the traffc. These fields include flow direction and traffc direction options. NSG Flow Logs can be sent to Azure Log Analytics, whereas VPC Flow Logs can be sent to either a S3 bucket or CloudWatch. Writing a KQL query for the field FlowDirection_s would allow for searching NSG Flow Lows for flow direction. Flow states help with NSG logs to show if the now is beginning, continuing, or ending.

Answer 2

Network Watcher

Answer 3

After enabling diagnostic logging in Azure App Services, categories of logs include **HTTP and Console**. Metrics and Web Access logs are collected by AWS Amplify.

Answer 4

Math expression alarms combine more than one metric

Answer 5

Injection attack

Answer 6

ATT&CK, which stands for Adversary Tactics, Techniques, and Common Knowledge, attempts to bring order to the chaos of cataloging and describing how attackers operate in infrastructure. Framework Tactics are the **"goals" of the attacker**. For example, an attacker wants to gain "Initial Access" to an organization or seeks "Exfiltration" of an organization's data.

Answer 7

The correct answer is that IP address "169.254.169.254" is a loopback **metadata service that runs on cloud computing instances**. Both AWS and Azure use this IP address to provide metadata access to the hypervisor. The other choices are not relevant to this IP address.

Answer 8

AWS provides the CloudWatch Logs Insights tool as part of CloudWatch, a user interface that makes it easier to query across logs. A handful of log types are pre-parsed and the specific fields in the message can be used. Or if the log entry is JSON, Logs Insights can automatically discover the field/value pairs. However, the vast majority of third-party logs will have some file format that will be impossible for Logs Insights to discover and parse. Therefore, the **parse command** must be used. For example: - Glob: parse @message "[*] *The error was: *" as level, config, exception - Regex: parse @message The error was: (? The CloudWatch Logs Insight Query syntax is a stripped-down query language to craft the queries.

Answer 9

The name of the Azure VM is missing

Answer 10

Recognizing "destination_port" and "dst_port" from different event sources are the same field

Answer 11

To programmatically access this data outside of the graphical user interface that is the Compliance admin center, a PowerShell cmdlet is available to retrieve and query the audit log called Search-UnifiedAuditLog. This cmdlet requires the use of another cmdlet called **Connect-ExchangeOnline (part of the ExchangeOnlineManagement module)** in order to query Microsoft 365 services.

Answer 12

The GuardDuty finding's details show all the information about this finding that GuardDuty knows. The target, or potential actor, details anything known about the perpetrator or victim of the attack. It will usually be an "actor" and may include the IP address perpetrating the SSH Brute Force. However, in the above event, GuardDuty detects one of our EC2s attempting to do a brute-force attack, and uses the instance identifier. So in this case, it is showing who our **EC2 instance** is brute force attacking.

Answer 13

Data enrichment

Answer 14

Similar to AWSs actions, Azure provides users with resource provider operations. These **resource permissions** are used to determine which requests can be allowed or denied on a particular resource by a requestor. There are numerous available in Azure and can be retrieved a few different ways: * Microsoft documentation: This outlines all possible operations and what they perform in Azure. * Azure Portal: When attempting to create a custom role, there is an option to "Download all permissions". This download contains a CSV file with every available permission. * Azure CLI: Run the az provider operation list command.

Answer 15

**Each command through the CLI creates a set of REST API calls to the AWS service endpoints.** The AWS CLI is a Python tool that makes it easier to interact with the AWS API without having to deal with REST interfaces. Each command roughly translates to an AWS call. The results are translated and displayed in JSON, text, YAML or in a table format. The AWS CLI version 2 is now considered the standard version, but version 1 of the CLI is still available and is being updated at the moment. The AWS CLI commands follow a similar pattern. $ aws ec2 create-key-pair -key-name "test"

Answer 16

The Python SDK is probably the most used in AWS. **Botocore** is a low-level SDK that interacts directly with the AWS service nodes. Boto3 is another Python library that is built on Botocore and provides a higher-level abstraction. Boto3 makes it very simple to interact with AWS services without having to worry about the REST connections. Boto3 is typically what Python developers use.

Answer 17

Azure Storage has several options to collect activity depending on which storage types are in use. For File Shares data can be accessed over Server Message Block (SMB) or Network File System (NFS) connections

Answer 18

Since the logfile field has an empty string, the agent logs will **go to stderr**. Region field is left out so it will default to the region the EC2 is in. The metrics_collection_interval is set to 15, so metrics will be collected every 15 seconds.

Answer 19

AWS has a large number of standard rules already defined and available to be applied. The customer can also **create their own custom rules using AWS Config and Lambda**. A Lambda function performs the evaluation and returns the results in a standard format that AWS Config recognizes.

Answer 20

**abcdefghi.exe** At a high-level, C:\\Windows\\System32\\[0-9a-zA-Z{9}\.exe is explained as: * The literal directory path to be searched (notice the escaped \ characters). * [0-9a-zA-Z]: Square brackets indicate an OR operator for the characters or character ranges inside of it. In this case, it is specifying any number or mixed-case letters. * {9}: Curly braces with a number indicate how many of the proceeding arguments to consider a match. In this case, exactly 9 letters or numbers in a row. * .exe: The literal extension (notice the escaped . character).

Answer 21

A log stream

Answer 22

Create snapshots of any system

Answer 23

Malware Protection findings will take a **snapshot** of VMs and EKS containers to analyze the files. Any files deemed "suspicious" will create a "SuspiciousFile" finding type. Kicked off by some GuardDutyfindings, a scan is made of the container or virtual machine, looking for a known malware file. If one is found, a Malware Protection finding is generated with information about the file and the finding itself. The Malware Protection process has the benefit of operating without the need for an agent. The detection process can be run anytime because AWS API supports snapshots and systems analysis.

Answer 24

Azure has its own metadata service the requires a custom header: -H Metadata:true This creates a custom header and sends it as part of the HTTP GET request. The value of the header must be Metadata:true to signify in the request that )æs, we know this is for metadata and nothing else. Without the header, the Azure metadata service will drop the query. When the cloud resource is in need of credentials, it can ask Azure, via the local metadata service, for a bearer token which has a default lifetime of twenty-four hours. An attacker could acquire this token which will give them the same rights as a managed identity-ranging from very low-level to Owner permissions.

Answer 25

Azure's command line tool allows you to create an "extension". These extensions, written in Python, are called from a command line.

Answer 26

An event ID of 4624 indicates a successful logon. The logon type of 5 shows that it was a service logon along with the process of services.exe.

Answer 27

AWS Inspector can perform host assessments when an SSM (Systems Manager) agent is installed and activated.

Answer 28

Azure customers must navigate to the Diagnostics Settings of the Azure Storage account and enable the necessary logs and metrics they want to collect and also send that data to a location of their choosing. The options are another Azure Storage account, Azure Log Analytics workspace, Azure Event Hub, or a partner solution. If sending the data to Azure Log Analytics, each of the four offerings from Azure Storage have their own associated table.

Answer 29

The various components of Microsoft 365 can be configured using a multitude of admin centers. The Compliance Admin Center is used primarily for meeting compliance needs, which includes maintaining a running list of all Microsoft 365 activity in a Unified Audit Log and providing capabilities to search for data of interest within documents stored in Sharepoint, email received or sent by users, or Teams/Skype messages. The **Exchange** Admin Center provides tools for monitoring and controlling mail flow, but does not have capabilities to review content unless an email is quarantined by the spam filters. Intune offers services to control managed endpoints. Entra is the cloud hosted identity service provided by Microsoft. While some of these Admin Centers may contain links to the Content Search service, the feature resides in the Compliance Admin Center.

Answer 30

Broken access control

Answer 31

The MITRE ATT&CK Azure AD Matrix is focused on how Azure's main directory service is targeted by real world adversaries. **Valid Accounts** is sub-technique included under Initial Access, Persistence, Privilege Escalation, and Defense Evasion.

Answer 32

Ubuntu is a Debian-based system, therefore, security related logs including SSH logins are kept in the /var/log/authlog log. RHEL-based systems use the log /var/log/secure. Information on scheduled tasks are kept in /var/log/cron while kernel events are kept in the /var/log/vern.log.

Answer 33

Incorrect region

Answer 34

Even if CloudFront is inline between an attacker and a web server, the web server's access logs may only contain data related to CloudFront and not the "real" attacker's system. CloudFront logging can fill in these gaps. These logs can contain a lot of information including: * [sc-bytes]: Number of bytes retumed to the requesting client (for example: 443) which follows after the time and date * [sc-status]: HTTP response code from CloudFront follows after the requested file path (for example: 401) * [cs-bytes]: Number of bytes (ie. 301) sent by the requestor which follows after the layer 7 protocol such as HTTP or HTTPS

Answer 35

In November 2019, AWS announced the Instance Metadata Service Version 2 (IMDSv2), which adds a layer of security to metadata service calls. A request must use an HTTP PUT command to /latest/api/token to retum a TOKEN value. Applications that are vulnerable to SSRF usually perform a GET, the requirement for a PUT addresses this issue.

Answer 36

Creating an attack hypothesis

Answer 37

The directory structure of the insights-logs-networksecuritygroupflowevent Azure Storage container is quite unusuaL The structure begins with the folder resourceid= and has many subfolders until you arrive at the actual flow data: The SUBSCRIPTIONS, subscription ID of the Azure account, RESOURCEGROUPS, resource group name which contains the NSG, PROVIDERS, MICROSOFT.NETWORK, NETWORKSECURITYGROUPS, the name of the NSG, a breakdown of the time of the flow record (year, month, day, hour, and minute), and then the MAC address of the cloud resource creating the flow data.

Answer 38

Azure's Network Watcher service provides the option to capture Network Security Group (NSG) now data. This data can be output to two different locations: an Azure Storage container and/or an Azure Log Analytics workspace. The flow data stored in an Azure Storage container is saved in a container called insights- logsnetworksecuritygroupflowevent. The directory structure of the insights-logs- networksecuritygroupflowevent Azure Storage container is quite unusual. The flow data is aggregated and stored in a JSON-formatted file containing one or more flow records for the given time. The data should be moved to a system or application which can be used to parse the data more adequately.

Answer 39

SOAR platform

Answer 40

Cloudwatch log groups are a collection of log streams. Actions that can be applied to log groups include: Create metric filter: CloudWatch metrics will monitor events across CloudWatch logs. A metric filter is really a way to count activities in logs.

Practice Test 1 Flashcards

(75 cards)