Cybersecurity
What tier in a SOC involves further investigating security incidents?
2
What algorithm use different keys to encrypt and decrypt data?
asymmetric encryption
What algorithim is used when network admins connect to Cisco routers with SSH?
asymmetric key
Because of implemented security controls, a user can only acvess a server with FTP, which relates to what component of AAA?
authorisation
What access attack write data beyond the allocated buffer memory to overwrite valid data or to exploit systems to execute malicious code?
buffer overflow
What technology might increase the security challenge to the implementation of IOT in an enterprise environment?
cloud computing
What database ensures that data is in a format that allows for manipulation and that the data is open and free to the public?
community veris
What NIST incident response life cycle phase does preparation?
conduct csirt
What is the IP addresses or the logical location of essential systems or data called?
critical asset address space
What model is action on objectives a phase of?
cyber kill chain
What can be achieved by disabling the root account over SSH?
device hardening
What algorithm is not used for encrypting data due to the large numbers used that slow down bulk transfers?
diffie hellman
What provides assurance that code downloaded from the internet is authentic, actually sourced by the publisher and has not been modified?
digital signing
When handling a security incident, HR is responsible for applying what measures if the incident is caused by an employee?
disciplinary
What can threat actors use to collect personal information and encode the data in outgoing dns queries?
dns
What is used by attackers to exfiltrate data in traffic disguised as normal client queries?
dns
What translates a website name into a network address?
dns
What NIST incident response life cycle phase does post-incident activities?
document incident handling
What is necessary to ensure a private transfer of dats using a VPN?
encryption
What type of algorithms are AES and 3DES?
encryption
Malicious traffic not identified as a threat will give what security alert?
false negative
Normal traffic incorrectly identified as a threat will give what security alert?
false positive
What commonly motivates cybercriminals to attack networks?
financial gain
What technology in a layered defense-in-depth approach denies connections initiated from untrusted networks to internal networks, but allows internal users within an organisation to connect to untrusted networks?
firewall
Why might pings between computers in the same room fail?
firewall
Using security devices that include what results in the devices introducing processing delays and privacy issues?
https decryption and inspection
According to the SANS Institute, what attack surface indicates the use of social engineering?
human
What is used by attackers to identify hosts on a network and the structure of the network?
icmp
What NIST incident response life cycle phase does detection and analysis?
identify analyse and validate an incident
What metric class in the CVSS Basic Metric Group identifies the impacts on CIA?
impact
What NIST incident response life cycle phase does containment, eradication and recovery?
implement procedures
What OS should network admins choose if they don't want to pay?
linux
What do cybercriminals use to allow the browser to load a webpage from another source?
malicious iframe
What is an example of volatile data?
memory register
What tool provides usage-based network billing and network monitoring?
netflow
What are net use and net share associated with?
network resource sharing
What is a passive device that forwards all traffic and physical layer errors to an analysis device?
network tap
What provides more security features than FAT32 and supports larger partitions?
ntfs
What protocol uses a hierarchy of authoritative time sources to send time information between devices on the network?
ntp
What access attack can be implemented by the use of brute force attack methods, trojan horses or packet sniffers?
password attack
What are two evasion techniques are used by hackers?
pivot and rootkit
What intrusion detection approach compares the operations of a host against well-defined security rules?
policy based
What is the list of TCP or UDP processes that are available to accept data called?
ports used
If a network admin issues the tcpdump command, what would the number 6337 indicate?
process id
What Linux command can be used to find the process ID for a specific process before using the kill command?
ps
According to NIST, what step in the digital forensics process involves preparing and presenting information that resulted from scrutinising data?
reporting
What technology should be included in a security information and event management system in a SOC? (2)
security monitoring
What is the time between the establishment of a data flow and its termination called?
session duration
What provides a message format for communication between network device managers and agents?
snmp
Technologies, people and processes are major categories of elements in what?
soc
In a standard ACL, what criterion is used to filter traffic?
source ip address
What algorithms use pre-shared keys?
symmetric encryption
What uses UDP port 514 for logging event messages from network devices and endpoints?
syslog
What logs in Windows Event Viewer includes events regarding the operation of drivers, processes and hardware?
system
Compared to RADIUS, what allows for separation of authentication from authorisation?
tacacs
What technology should be included in a security information and event management system in a SOC? (1)
threat intelligence
What does the following describe? The amount of data passing from a given source to a given destination in a given period of time.
total throughput
What layer identifies the applications and services on the client and server that should handle transmitted data?
transport
What layer meets the reliability requirements of applications?
transport
What layer multiplexes multiple communication streams from many users or applications on the same network?
transport
If host A sends an IP packet to host B, the destination address in the frame when it leaves host A will be BB:BB:BB:BB:BB:BB. True or false?
true
Normal traffic not identified as a threat will give what security alert?
true negative
What security alert indicates that normal traffic is correctly ignored and erroneous alerts are not being issued?
true negative
Malicious traffic correctly identified as a threat will give what security alert?
true positive
In terms of NetFlow collector output, the output of the traffic flow is what kind of response to a client machine?
udp dns
What typically requires end-user activation and can be dormant and then activate at a specific time?
virus
What technology should be included in a security information and event management system in a SOC? (3)
vulnerability
In a home or small business, what acts as an ethernet switch and an access point?
wireless router
What travels to new computers without any intervention and is self-replicating?
worm
A cybersecurity analyst is viewing captured packets forwarded on switch S1. Does PC-A have the MAC address d8:cb:8a:5c:d5:8a?
yes
What attack do threat actors prefer in the Cyber Kill Chain weaponisation phase to avoid detection by the target?
zero day