CIT - Final Review

Which of the following does not require DLP protection?

Public facing webpages

2 methods of getting data into Splunk?

Push and Pull (Apache kafka is another tool you can use)

A new company stores sensitive information and wants to secure information, using a system that reports and forensically analyze a security instant. What system should they use?

SEIM

SIEM includes the following log May 21 741pm pcx02 ssh 703 accepted password for root from IP address port number 5581 to ssh?

SSH connection was established on May 21st with a root user.

If the following query was sent to a Siem source var log off what would the output, look like?

Unix authentication log

David, a cybersecurity researcher, found a new way to hack the company's system without having the antivirus react to the breach. Which term relates to his discovery?

Zero-Day

Leakage of employee related information was discovered at a large company. The company learned that the leak took place after a phishing email. What should the company use or do to prevent this from happening again?

All of these (encrypt all sensitive data, analyze and categorize date, antivirus and email security).

Which of the following is true about how an organization should protect itself from malicious emails?

All the above. (Use spam filters and malicious scanners, use strong passwords, use email encryption, don't open suspicious emails)

What is the definition of an alert?

An automated script will be executed

What system scans for strings, hashes, and heuristics?

Antivirus

Which of the following security measures is related to end point security?

Antivirus

Why are IoT devices known to be vulnerable to many attacks?

Because of lack of security awareness among developers

What is the name of the method that exposes data leakage by giving different versions of a sensitive document to each of several suspects and seeing which version gets leaked?

Canary Trap

What would it mean if I said how could you define log aggregation?

Collection of logs with a similar structure.

Which of the following should be used secure a website against abnormal traffic dump?

DMZ

What is a honey pot?

Decoy device that lures attackers

What is DKIM (domainKeys identified mail)?

Email validation technique

What is more dangerous False Positive or Negative?

False Negative

Microsoft security essentials has tagged 2011 Google Chrome as malicious. What is the professional term related to this case?

False Positive

What is the difference between fault tolerance and fail-safe implementation?

Fault tolerance ensures that the remaining components can maintain a system when one or more components fail, fail-safe implementation means that all components work together to prevent or minimize damage in case of disaster (LAST ONE)

What are examples of deterrent access controls? .

Fences, cameras, and motion detectors

What is the difference between firmware and software?

Firmware is fixed date that the user interacts with and the software what the user interacts with.

An attacker launches a mail spoofing attack which of the following commands will probably be used in the attack?

Hello server mail from admin@domain then rcpt to IP domain data.

Which of the following is a security mechanism that is configured to detect the seim and counterattack attempts to unauthorized access?

Honeypot

Security company wants to learn a new attack method, which of the following would be a good way to do that

Honeypots

What is domain key identified mail DKIM?

Mail Security Validation Technique

Why is fenced in layers important to security?

Multiple layers of security have a better chance of thwarting potential intruders

Which of the following is not true about how an organization should protect itself from malicious emails?

Open malicious emails and investigate them

Which of the following systems should be installed to analyze an organization's network traffic?

Snort

Which of the follow artifacts does an AV search?

Strings, hashes, and heuristics

An entropy inspection of a file indicates high entropy measuring, what can be assumed from that?

The file may be encrypted or compressed

What does the PPT triad represent in the context of organizational security?

The required balance for operational security

John downloaded a file a co-worker sent him. His antivirus alerted him about the file. What should John do?

White list the file.

As an analyst in a SOC department, you are responsible for checking IP addresses and verifying that they are not included in four different blacklists. To avoid the repetitive task, you decide to implement a playbook. Which SOAR capability should you use?

Security Operations Automation.

Which of the following query was sent to a Siem source=var log off log off.log what would be the output?

Unix authentication logs

What is considered the weakest link in Security?

Untrained and Unaware people

NOC manager wants to collect logs from windows OS and Splunk?

Install universal forwarder service

What is the main purpose of a pfsense firewall?

Open-source firewall

Why should employee and visitor access to an organization be audited?

To help track events in case of an incident or breach, and to locate the cause.

Why should alerts be generated?

To monitor and handle suspicious events in an organization

What is the main purpose of a SIEM solution?

e-mail security incidents

What is the purpose of a log query?

To retrieve information from the Siem

What is the purpose of log parsing in a system such as Splunk?

To separate data into parts that are easier to handle