Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SOC Leaning > SOC - technical q > Flashcards

SOC - technical q Flashcards

1
Q

What does OSI stand for and what’s it used for?

A

Open System Interconnection, a framework that divides and details the steps on network communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 7 layers of the OSI model?

A

Application Layer – human-computer interaction layer

Presentation Layer – Ensures that data is in a usable formation and is where data encryption occurs

Session Layer – Maintain connections and is responsible for controlling ports and sessions

Transport Layer – Transmit data using transmission protocols (tcp/udp)

Network Layer – decides the physical path the data will take

Data Link – defines the format of the data on the network

Physical – transmit raw bot stream over the physical medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the “Pyramid of Pain” model?

A

Ranks the IOCs from the least valuable to the most valuable. Bottom being trivial to the top being most difficult

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the layers of the Pyramid of Pain?

A

TTP - Tactics, techniques and procedures

Tools

Network/ Host Artifact

Domain name

IP Addresses

Hash Values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is NIST and its purpose?

A

National Institute of Standards and Technology
Designed to help businesses understand, manage and reduce cyber security risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the steps of NIST?

A

Identity

Protect

Detect

Respond

Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Punycode?

A

Used by attackers to redirect to a malicious domain that looks legitimate. Punycode is a way of converting words that cannot be written in ASCII, into unicode ASCII coding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Any.Run?

A

Is a sandboxing service that executes samples, that we can review any connections such as http requests, DNS requests or processes communicating with an IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Fuzzy hashing?

A

Allows you to perform similarity analysis to match two files with minor differences based on fuzzy hash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Pass-the-Hash?

A

Exploits Single Sign-On (SS0) through NT Lan Manager (NTLM), Kerberos, and other authentication protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Mitre Attack?

A

Is a globally accessible knowledge base of adversary tactics and techniques used based on real world observations. The mitre attack knowledge base is now a foundation used to develop models and methodologies in the private sector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a vulnerability?

A

a flaw or a weakness in some parts of a system security procedure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a threat?

A

A threat is a potential negative occurrence that can have consequences for a business operation/function/reputation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a risk?

A

the probability that a particular threat will occur, either intentionally or accidently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the difference between asymmetric and symmetric encryption?

A

Symmetric encryption uses the same key to encrypt and decrypt, while asymmetric encryption requires a pair of keys using a public key to encrypt and a private key to decrypt the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the difference between UDP and TCP?

A

UDP (user datagram protocol) is a connectionless protocol.

TCP, on the other hand, is connection-oriented, best described as requiring a three-way handshake

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is an IPS, and how does it differ from IDS?

A

IPS (Intrusion Prevention System) can prevent traffic, while IDS (Intrusion Detection System) can only detect traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is encoding?

A

Encoding ensures that different systems or programs can correctly interpret data in its proper format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is encryption?

A

Encryption ensures the data is secure and that only those with an encryption key have access to the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is hashing?

A

hashing maintains the integrity of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the CIA triad?

A

Model of security orders with 3 principles :

Confidentiality 
Integrity 
Availability 

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How do you keep updated with information security news?

A

Twitter and websites like bleepingcomputer.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Ports to know : FTP

A

20/21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Ports to know : SMTP

A

25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Ports to know : HTTP
80
26
Ports to know : HTTPS
443
27
Ports to know : POP3
110
28
Ports to know : Telnet
23
29
Ports to know : SSH
22
30
What does a SOC perform?
Monitor and analyse the organisations computer and network, to identify and mitigate threats. A typical role would be to respond to security alerts and incidents, conduction investigations and implement security controls.
31
Talk through a TCP handshake?
Syn – the client picks a sequence of numbers, which is sent in the first syn packet Syn-ack – server responds with a syn-ack flag set Ack – final step, where the client acknowledges the response of the server and a connection is established
32
How would you approach a problem you have not seen before?
Google, chatGPT, experienced colleagues and peers. Next step once resolved would be to document the process and add to KB
33
Potential malicious binary – what do you do?
Use VirusTotal to see virus hash, so see if someone else has loaded anything similar. Load it up onto the database to see if it’s a known malicious signature. Can also load it into a contained environment to see if it exhibits malicious activity Tools like Process explorer could help monitor its activity.
34
What is EDR tool and give examples?
Fireeye, crowdstrike and eset
35
What is a true positive?
A true positive is a correct identification of a positive event.
36
What is a false positive?
A false positive is an identification of a positive event that is not actually happening
37
What is a false negative?
A false negative is when the system doesn’t identify an issue when there isnt one
38
Scenario – a colleague has set up a customer facing webserver, how would you secure it?
Ensure its fully patched Configure FW for only allowed traffic Implement strong password policies for accounts ACL's for users who need access only Logging and monitoring tools on the server Perform pentest and regular VA's WAF – place a WAF infront of the application
39
What is data leakage?
This is when data is leaked by unauthorised means due to internal errors
40
What are the common means of user authentication?
Username and password, PIN, biometrics Something you know Something you have Something you are
41
What's the importance of Domain Name System monitoring?
Helps prevent domain based cyberattacks – DNS is a popular target for attackers DDOS – where multiple requests are sent to crash a server DNS poisoning - hackers insert false information into your DNS cache and spoof a version of your site
42
Name the tools you can use to secure a standard network?
FW, IDS, SIEM solution, VPN's, EDR, WAF's, VA, PT, policies and procedures, adopting frameworks
43
Describe the salting process and its application?
Password salting is a techniques to protect passwords by adding a string of 32 characters and then hashing it. Salting prevents hackers from reverse-engineering passwords.
44
What's the difference between penetrative testing and software testing?
Sofware testing revolves arounds code review and secure coding practices Pentesting simulates a full exploitation attack on a system/network
45
What is a man-in-the-middle attack?
This is a common attack where the attacker 'listens' to a two way conversation.
46
Give examples of MITM attacks?
Rogue access points who can trick nearby devices to join its domain, the traffic can then be manipulated by the attacker. ARP spoofing is when an attacker poses as another host and tries and respond with its own MAC address, where the attacker can sniff the private traffic between two hosts. MDNS – multicast is done on a local network using a broadcast like ARP DNS spoofing – where the attacker attempts to corrupt DNS cache in an attempt to make other hosts access their site Sniffing – packet capture tools so try and intercept packages Session hijacking - sniff sensitive traffic to identify session token for a user
47
What is payload attack?
malicious code that is designed to execute a specific action
48
How do you prevent a MITM attack?
Strong encryption on AP's Strong router login credentials Using VPN's Force HTTPS
49
How would you secure a wireless access point?
Strong password and encryption Up to date FW Don’t broadcast VPN
50
Difference between vlan and subnet
VLAN is software based and Subnets are hardware based. VLAN's create logical networks that are independent of the physical network topology. VLAN's are based on layer 2 and subnets are done at layer 3
51
What is the cyber kill chain?
This is a model for identification and cyber intrusion activity. The model identifies what the adversaries must complete in order to achieve their objective.
52
What are the steps of the cyber kill chain?
Reconnaissance – harvesting email address, conference info etc Weaponization – coupling exploit with backdoor into deliverable payload Delivery – delivering weaponised bundle to the victim via email, web, web etc Exploitation – exploiting a vulnerability to execute code on victims system Installation – installing malware on asset Command & control (C2) - command channel for remote manipulation of victim Actions on objectives – intruder accomplishes their original goal
53
What is SIEM?
Security Information and Event Management (SIEM), is a security solution that provides the real time logging of events in an environment - example will be sentinel.
54
What is TCP/IP Model?
Four-layer model that divides network communications into four distinct categories.
55
What layers does the TCP/IP model have?
Application Layer Transport Layer Internet Layer Network Access Layer
56
What is ARP?
The Address Resolution Protocol (ARP) is a communication protocol used for discovering the Data Link Layer address, such as a MAC address, associated with a given Network Layer address, typically an IPv4 address.
57
What is DHCP?
automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
58
Explain OWASP Top 10?
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. (OWASP)
59
What is SQL Injection?
SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
60
What is the difference between static and dynamic malware analysis?
Static Analysis: It is the approach of analyzing malicious software by reverse engineering methods without running them. Dynamic is the approach that examines the behavior of malicious software on the system by running it
61
What is ISO27001
ISO 27001 can help organizations reduce risk, optimize operations within an organization due to clearly defined responsibilities and business processes
62
What does PCI DSS stand for?
Payment Card Industry Data Security Standard A set of security standards for handling major credit cards.

SOC Leaning (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions