Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security Analyst Interview Questions > Security Analyst Questions > Flashcards

Security Analyst Questions Flashcards

Interview

1
Q

Black Hat

A

hackers are criminals who break into computer networks with malicious intent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Also known as Ethical Hackers. They are certified hackers who learn hacking from courses. These are good hackers who try to secure our data, websites.

A

White Hat Hacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A mix of both Black-Hat and White-Hat hackers. These types of hackers find vulnerabilities in systems without the permission of owners. They don’t have any malicious intent. However, this type of hacking is still considered illegal.

A

Grey Hat Hacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A method of determining which ports on a network are open and could be receiving or sending data.

A

Port Scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A group that pretends to be an enemy, attempts a physical or digital intrusion against an organization at the direction of that organization, then reports back so that the organization can improve their defenses.

A

Red Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A group of individuals who perform an analysis of information systems to ensure security, identify security flaws, verify the effectiveness of each security measure, and make certain all security measures will continue to be effective after implementation.

A

Blue Team

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A device that allows or blocks the network traffic according to the rules.

A

Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A security vulnerability caused by incomplete or incorrect misconfiguration.

A

Security Misconfiguration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The level of impact on agency operations (including mission functions, image, or reputation), agency assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Following the set of standards authorized by an organization, independent part, or government.

A

Compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

A

MITRE ATTACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An extra layer of security used to make sure that people trying to gain access to an online account are who they say they are. First, a user will enter their username and password. Then, instead of immediately gaining access, they will be required to provide another piece of information.

A

2FA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Share some general endpoint security product categories

A

Antivirus
EDR (Endpoint Detection and Response)
XDR (Extended Detection and Response)
DLP (Data Loss Prevention)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is HIDS?

A

HIDS means Host Intrusion Detection System. HIDS is located on each host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is NIDS?

A

NIDS means Network Intrusion Detection System. NIDS is located in the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A common model that forms the basis for the development of security systems.

A

CIA Triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Involves the efforts of an organization to make sure data is kept secret or private.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Involves making sure your data is trustworthy and free from tampering.

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Systems, networks, and applications must be functioning as they should and when they should.

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is AAA?

A

Authentication
Authorization
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Involves a user providing information about who they are. Users present login credentials that affirm they are who they claim.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A user can be granted privileges to access certain areas of a network or system.

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Keeps track of user activity while users are logged in to a network by tracking information such as how long they were logged in, the data they sent or received, their Internet Protocol (IP) address, the Uniform Resource Identifier (URI) they used, and the different services they accessed.

A

Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Framework is part of the Intelligence Driven Defense® model for identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective.

A

Cyber Kill Chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

A security solution that provides the real time logging of events in an environment. The actual purpose for event logging is to detect security threats.

A

SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Serve as forensic evidence of potential intrusions on a host system or network. These artifacts enable Information Security (InfoSec) professionals and system administrators to detect intrusion attempts or other malicious activities.

A

Indicator of Compromise (IoC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Demonstrate the intentions behind a cyberattack and the techniques used by the threat actor to accomplish their objectives.

A

Indicator of Attack (IoA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

If the situation to be detected and the detected (triggered alert) situation are the same

A

True Positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In short, it is a false alarm. When an IDS or IPS flags non-malicious traffic as malicious.

A

False Positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

A conceptual model that describes the universal standard of communication functions of a telecommunication system or computing system.

A

OSI Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

A method used in a TCP/IP network to create a connection between a host and a client.

A

Three-Way Handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Explain the Three-Way Handshake

A
  1. The client sends a SYN(Synchronize) packet to the server check if the server is up or has open ports
  2. The server sends SYN-ACK packet to the client if it has open ports
  3. The client acknowledges this and sends an ACK(Acknowledgment) packet back to the server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Is the default method of data communication on the Internet. It was developed by the United States Department of Defense to enable the accurate and correct transmission of data between devices.

A

TCP/IP Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the difference between the TCP/IP Model and the OSI Model?

A

The TCP/IP model is a simpler, four-layer model that focuses on the actual workings of the internet, while the OSI model is a more detailed seven-layer model that provides a conceptual framework for understanding network communication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Is a communication protocol used for discovering the Data Link Layer address, such as a MAC address, associated with a given Network Layer address, typically an IPv4 address.

A

Address Resolution Protocol (ARP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.

A

Domain Host Configuration Protocol (DHCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Is like the internet’s phone book, translating domain names (like google.com) into IP addresses (like 172.217.1.46) so computers can communicate with each other.

A

Domain Name Server (DNS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Creates a secure, encrypted connection over a public network like the internet, allowing users to browse the web privately and securely. It masks their IP address and encrypts their data, enhancing privacy and security, particularly when accessing sensitive information or bypassing geographical restrictions.

A

Virtual Private Network (VPN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Is a network segmentation technique that allows administrators to logically divide a single physical network into multiple isolated virtual networks.

A

Virtual Land Area Network (VLAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Is a networking device that forwards data packets between computer networks. Responsible for directing traffic based on IP addresses, enabling communication between devices on different networks.

A

Router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Is a networking device that connects multiple devices within a local area network (LAN) and forwards data packets to their intended destination based on MAC addresses. It operates at the data link layer of the OSI model and helps manage network traffic efficiently by creating direct paths between devices.

A

Switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Is a connectionless protocol that provides a simple and lightweight method for sending data packets over a network. It is commonly used for applications that prioritize speed and efficiency over reliability, such as real-time streaming or online gaming.

A

User Datagram Protocol (UDP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Is a connection-oriented protocol that ensures reliable and ordered delivery of data packets over a network. It establishes a virtual connection between sender and receiver, handling error correction, flow control, and congestion control to guarantee data integrity and successful transmission.

A

Transmission Control Protocol (TCP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the difference between UDP and TCP?

A

UDP and TCP are transport layer protocols. TCP has error checking and guaranties that packets have been received while UDP does not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q
  1. Close all unnecessary ports
  2. Patch the server so that all software is up to date
  3. Tightly control user access
A

Steps to ensure a server is secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Is a tool used to trace the path of an IP packet as it traverses routers. It works by incrementing the TTL field until the packet reaches the destination IP.

A

Traceroute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Is a logical subdivision of an IP network. The practice of dividing a network into two or more networks

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Is a unique identifier assigned to a network interface controller for use as a network address in communications within a network segment.

A

MAC Address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

A

Network Address Translation (NAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Is a network protocol that builds a loop-free logical topology for Ethernet networks.

A

Spanning Tree Protocol (STP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

The process of distributing a set of tasks over a set of resources, with the aim of making their overall processing more efficient.

A

Load Balancer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Also known as a virtual machine monitor or virtualizer, is a type of computer software, firmware or hardware that creates and runs virtual machines.

A

Hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

A package of software and its dependencies — such as code, system tools, settings, and libraries — that can run reliably on any operating system and infrastructure.

A

Conatiner

56
Q

Allow devices to connect to a network even if they are not located within the same subnet or broadcast domain.

A

DHCP Relay

57
Q

Is a way of bundling two or more network interfaces together to act as one

A

Link Aggregation or Port Trunking

58
Q

A system or router that provides a gateway between users and the internet.

A

Proxy Server

59
Q

A method of detecting and assessing packet data sent over a network.

A

Packet Sniffing

60
Q

A physical or virtual architectural approach dividing a network into multiple segments.

A

Network Segmentation

61
Q

A security protocol that creates an encrypted link between a web server and a web browser.

A

SSL

62
Q

Encrypts data sent over the Internet to ensure that eavesdroppers and hackers are unable to see what you transmit.

A

TLS

63
Q

What port is HTTP?

A

Port 80

64
Q

What port is HTTPS?

A

Port 443

65
Q

What port is FTP?

A

Port 21

66
Q

What port is SSH?

A

Port 22

67
Q

What port is Telnet?

A

Port 23

68
Q

What port is SMTP (Simple Mail Transfer Protocol)?

A

Port 25

69
Q

What port is DNS?

A

Port 53

70
Q

What port is DHCP

A

Port 67

71
Q

What port is TFTP (Trivial File Transfer Protocol)

A

Port 69

72
Q

What port is NTP (Network Time Protocol)

A

Port 123

73
Q

What port is LDAP (Lightweight Directory Access Protocol)

A

Port 389

74
Q

What port is RDP

A

Port 3389

75
Q

What port is VNC (Virtual Network Computing)

A

Port 5900

76
Q

What port is POP3 (Post Office Protocol version 3)

A

Port 110

77
Q

What port is IMAP (Internet Message Access Protocol)

A

Port 143

78
Q

Is a secure network protocol used for remote access and control of devices over an unsecured network

A

SSH

79
Q

Is a standard network protocol used for transferring files between a client and a server on a computer network.

A

FTP

80
Q

Is an Internet-standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior.

A

SNMP

81
Q

is an open and cross-platform protocol used for accessing and maintaining distributed directory information services over a network.

A

LDAP

82
Q

Is a proprietary protocol developed by Microsoft that enables users to remotely access and control a computer desktop over a network connection.

A

RDP

83
Q

Is meant to protect Wi-Fi transmissions by encrypting the data so outsiders who are not inside the encrypted network will not be able to read the messages or data contained within.

A

Wired Equivalent Privacy (WEP)

84
Q

Is a security standard for computing devices with wireless internet connections.

A

Wi-Fi Protected Access (WPA)

85
Q

General network security product names

A

Firewall
IDS (Intrusion Detection System)
IPS (Intrusion Prevention System)
WAF (Web Application Firewall)

86
Q

What’s the difference between an IDS and IPS?

A

IDS only detects the traffic but IPS can prevent/block the traffic.

87
Q

How can you protect yourself from Man-in-the-middle (on-path) attacks?

A

Caution with connecting to public Wi-Fi
Use a VPN.

88
Q

What are the HTTP response codes?

A

1XX: Informational
2XX: Success
3XX: Redirection
4XX: Client-Side Error
5XX: Server-Side Error

89
Q

Is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.

A

OWASP Top 10

90
Q

Are critical attack methods where a web application directly includes unsanitized data provided by the user in queries.

A

SQL Injection

91
Q

Use parameterized queries or prepared statements.
Implement input validation to ensure data integrity.
Use proper access controls to limit database privileges.

A

Preventing SQL Injection

92
Q

A type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

A

Cross-Site Scripting (XSS)

93
Q

Is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.

A

Cross-Site Request Forgery (CSRF)

94
Q

Implement proper input validation and sanitization.
Use output encoding or escaping
Implement anti-CSRF tokens in web forms

A

Prevent XSS and CSRF

95
Q

Is a vulnerability caused by the lack of an authorization mechanism or because it is not used properly.

A

Insecure Direct Object Reference (IDOR

96
Q

Is the security vulnerability that occurs when a file on a different server is included without sanitizing the data obtained from a user.

A

Remote File Inclusion (RFI)

97
Q

Is the security vulnerability that occurs when a local file is included without sanitizing the data obtained from a user.

A

Local File Inclusion (LFI)

98
Q

Difference between LFI and RFI?

A

LFI differs from RFI because the file that is intended to be included is on the same web server that the web application is hosted on.

99
Q

Helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.

A

Web Application Firewall (WAF)

100
Q

Is the practice and study of techniques for secure communication in the presence of third parties, typically involving encryption and decryption of data.

A

Cryptography

101
Q

Converts the data in the desired format required for exchange between different systems.

A

Encoding

102
Q

Maintains the integrity of a message or data. Any change did any day could be noticed.

A

Hashing

103
Q

Ensures that the data is secure and one needs a digital verification code or image in order to open it or access it.

A

Encryption

104
Q

Difference between hashing and encryption

A

Hashing transforms data into a fixed-size string of characters, while encryption encodes data with a key that can be decoded to its original form.

105
Q

Added to the hashing process to force their uniqueness, increase their complexity without increasing user requirements, and to mitigate password attacks like hash tables.

A

Salted Hashes

106
Q

Name of the software that compiles written code?

A

Compiler

107
Q

Name of the software that translates machine codes into assembly language?

A

Disassembler

108
Q

It is the approach of analyzing malicious software by reverse engineering methods without running them.

A

Static Malware Analysis

109
Q

It is the approach that examines the behavior of malicious software on the system by running it. Applications that can examine registry, file, network and process events are installed in the system, and their behavior is examined by running malicious software.

A

Dynamic Malware Analysis

110
Q

How does malware achieve persistence on Windows?

A

Services
Registry Run Keys (Run, RunOnce)
Task Scheduler
Infecting to clean files

111
Q

Which event logs are available default on Windows?

A

Security
Application
System

112
Q

Is malicious software designed to disrupt, damage, or gain unauthorized access to computer systems or data.

A

Malware

113
Q

A type of malicious software that attaches itself to other programs or files and spreads by replicating when those files are executed, often causing harm to the host system.

A

Virus

114
Q

Virus is a specific type of malware that self-replicates by attaching to other programs or files, malware encompasses a broader range of malicious software designed to disrupt, damage, or gain unauthorized access to computer systems or data.

A

Difference between virus and malware

115
Q

Trojan Horse
Ransomware
Spyware
Adware
Rootkit

A

Examples of Malware

116
Q

Wannacry
Stuxnet
Code Red

A

Examples of Viruses

117
Q

Is a cyberattack that causes the servers to refuse to provide services to genuine clients.

A

Distributed Denial of Service (DDOS)

118
Q

Configure Firewalls and Routers
Use Load Balancing

A

Preventatives for DDOS

119
Q

Is a type of malicious software that encrypts files on a victim’s computer or network, rendering them inaccessible, and demands payment (usually in cryptocurrency) for the decryption key to restore access.

A

Ransomware

120
Q

Network Segmentation
Keep Anti-Virus Software up to date

A

Preventatives to Ransomware

121
Q

Is a cyberattack technique where attackers attempt to gain unauthorized access to multiple user accounts by using commonly used passwords or easily guessable credentials.

A

Password Spraying

122
Q

Is a type of cyberattack where an attacker systematically tries every word in a pre-compiled list (dictionary) of potential passwords to gain unauthorized access to user accounts or systems.

A

Dictionary Attack

123
Q

Is a cyberattack method where an attacker systematically tries every possible combination of characters until the correct password or encryption key is discovered

A

Brute Force Attack

124
Q

Is the process of identifying, quantifying, and prioritizing vulnerabilities in computer systems, networks, and applications to determine potential security risks and take appropriate remedial actions.

A

Vulnerability Assessment

125
Q

Is a unique name that identifies a wireless network

A

SSID

126
Q

Network type that allows each user to act as both client or server

A

Peer to Peer

127
Q

A computer system or software program that provides services or resources to other computers, known as clients, over a network, fulfilling requests and facilitating communication and data exchange between devices.

A

Server

128
Q

Is a hardware component used in networking equipment, such as routers and switches, to connect to wide area networks (WANs) and provide access to remote networks or the internet.

A

WIC (WAN Interface Card)

129
Q

Refers to information that is actively being transferred between two endpoints over a network.

A

Data in Transit

130
Q

Information that is stored or archived in a persistent state

A

Data at Rest

131
Q

Is the protection of critical systems and sensitive information from digital security threats.

A

What is Cybersecurity?

132
Q

Is an intentional or unintentional transmission of data from within the organization to an external unauthorized destination.

A

Data Leakage

133
Q

Accidental Breach
Intentional Breach
System Hack

A

3 Types of Data Leakage

134
Q

Malware
Phishing
Password Attacks
DDoS
Man in the Middle

A

Common Cyber Attacks

135
Q
  1. Ensure strong and unique password.
  2. Avoid sharing confidential information online, especially on social media.
  3. Shop from known and trusted websites
  4. Install advanced malware and spyware tools.
  5. Update anti-virus software
A

Prevent Identity Theft

136
Q

Is a networking protocol suite that allows applications and devices on a local area network (LAN) to communicate with each other

A

NetBIOS

137
Q

Restricting the users from accessing a set of services within the local area network

A

Port Blocking

Security Analyst Interview Questions (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions