CH. 2 CYBERSECURITY THREAT LANDSCAPE

WHICH ONE OF THE FOLLOWING ATTACKERS IS MOST LIKELY TO BE ASSOCIATED WITH AN APT? A. NATION-STATE ACTOR B. HACKTIVIST C. SCRIPT KIDDIE D. INSIDER

A. NATION-STATE ACTOR

WHICH OF THE FOLLOWING THREAT ACTORS TYPICALLY HAS THE GREATEST ACCESS TO RESOURCES? A. NATION-STATE ACTORS B. ORGANIZED CRIME C. HACKTIVISTS D. INSIDER THREATS

A. NATION-STATE ACTORS

URSULA RECENTLY DISCOVERED THAT A GROUP OF DEVELOPERS ARE SHARING INFORMATION OVER A MESSAGING TOOL PROVIDED BY A CLOUD VENDOR BUT NOT SANCTIONED BY HER ORGANIZATION. WHAT TERM BEST DESCRIBES THIS USE OF TECHNOLOGY? A. SHADOW IT B. SYSTEM INTEGRATION C. VENDOR MANAGEMENT D. DATA EXFILTRATION

A. SHADOW IT

KOLIN IS A PENETRATION TESTER WHO WORKS FOR A CYBERSECURITY COMPANY. HIS FIRM WAS HIRED TO CONDUCT A PENETRATION TEST AGAINST A HEALTH-CARE SYSTEM, AND KOLIN IS WORKING TO GAIN ACCESS TO THE SYSTEM BELONGING TO A HOSPITAL IN THAT SYSTEM. WHAT TERM BEST DESCRIBES KOLIN'S WORK? A. WHITE HAT B. GRAY HAT C. GREEN HAT D. BLACK HAT

A. WHITE HAT

WHICH ONE OF THE FOLLOWING INFORMATION SOURCES WOULD NOT BE CONSIDERED AN OSINT SOURCE? A. DNS LOOKUP B. SEARCH ENGINE RESEARCH C. PORT SCANS D. WHOIS QUERIES

C. PORT SCANS

WHAT TYPE OF ASSESSMENT IS PARTICULARLY USEFUL FOR IDENTIFYING INSIDER THREATS? A. BEHAVIORAL B. INSTINCTUAL C. HABITUAL D. IOC's

A. BEHAVIORAL

OF THE THREAT VECTORS LISTED HERE, WHICH ONE IS MOST COMMONLY EXPLOITED BY ATTACKERS WHO ARE AT A DISTANT LOCATION? A. EMAIL B. DIRECT ACCESS C. WIRELESS D. REMOVABLE MEDIA

A. EMAIL

EDWARD SNOWDEN WAS A GOVERNMENT CONTRACTOR WHO DISCLOSED SENSITIVE GOVERNMENT DOCUMENTS TO JOURNALISTS TO UNCOVER WHAT HE BELIEVED WERE UNETHICAL ACTIVITIES. WHICH TWO OF THE FOLLOWING TERMS BEST DESCRIBE SNOWDEN'S ACTIVITIES (CHOOSE TWO) A. INSIDER B. STATE ACTOR C. HACKTIVIST D. APT E. ORGANIZED CRIME

A. INSIDER C. HACKTIVIST

WHICH ONE OF THE FOLLOWING THREAT RESEARCH TOOLS IS USED TO VISUALLY DISPLAY INFORMATION ABOUT THE LOCATION OF THREAT ACTORS? A. THREAT MAP B. PREDICTIVE ANALYSIS C. VULNERABILITY FEED D. STIX

A. THREAT MAP

TOM'S ORGANIZATION RECENTLY LEARNED THAT THE VENDOR IS DISCONTINUING SUPPORT FOR THEIR CUSTOMER RELATIONSHIP MANAGEMENT (CRM) SYSREM. WHAT SHOULD CONCERN TOM THE MOST FROM A SECURITY PERSPECTIVE? A. UNAVAILABILITY OF FUTURE PATCHES B. LACK OF TECHNICAL SUPPORT C. THEFT OF CUSTOMER INFORMATION D. INCREASED COSTS

A. UNAVAILABILITY OF FUTURE PATCHES

GREG BELIEVES THAT AN ATTACKER MAY INSTALLED MALICIOUS FIRMWARE IN A NETWORK DEVIE BEFORE IT WAS PROVIDED TO HIS ORGANIZATION BY THE SUPPLIER. WHAT TYPE OF THREAT VECTOR BEST DESCRIBES THIS ATTACK? A.SUPPLY CHAIN B. REMOVEABLE MEDIA C. CLOUD D. DIRECT ACCESS

A.SUPPLY CHAIN

WHICH OF THE FOLLOWING MEASURES IS NOT COMMONLY USED TO ASSESS THREAT INTELLIGENCE? A. TIMELINESS B. DETAIL C. ACCURACY D. RELEVANCE

B. DETAIL

KEN IS CONDUCTING THREAT RESEARCH ON TRANSPORT LAYER SECURITY (TLS) AND WOULD LIKE TO CONSULT THE AUTHORITATIVE REFERENCE FOR THE PROTOCOL'S TECHNICAL SPECIFICATION. WHAT RESOURCE WOULD BEST MEET HIS NEEDS? A. ACADEMIC JOURNAL B. INTERNET RFC's C. SUBJECT MATTER EXPERT D. TEXTBOOKS

B. INTERNET RFC's

VINCE RECENTLY RECEIVED THE HASH VALUES OF. MALICIOUS SOFTWARE THAT SEVERAL OTHER FIRMS IN HIS INDUSTRY FOUND INSTALLED ON THEIR SYSTEMS AFTER A COMPROMISE. WHAT TERM BEST DESCRIBES THIS INFORMATION? A. VULNERABILITY FEED B. IoC C. TTP D. RFC

B. IoC

WENDY IS SCANNING CLOUD-BASED REPOSITORIES FOR SENSITIVE INFORMATION. WHICH ONE OF THE FOLLOWING SHOULD CONCERN HER MOST, IF DISCOVERED IN A PUBLIC REPOSITORY? A. PRODUCT MANUALS B. SOURCE CODE C. API KEYS D. OPEN SOURCE DATA

C. API KEYS

RENEE IS A CYBERSECURITY HOBBYIST. SHE RECEIVES AN EMAIL ABOUT A NEW WEB-BASED GRADING SYSTEM BEING USED BY HER SON'S SCHOOL AND SHE VISITS THE SITE. SHE NOTICES THAT THE URL FOR THE SITE LOOKS LIKE THIS: HTTPS://WWW.MYSCHOOL.EDU/GRADES.PHP&STUDENTID=1023425 SHE REALIZES THAT 1023425 IS HER SON'S STUDENT ID NUMBER AND SHE THEN ATTEMPTS TO ACCESS THE FOLLOWING SIMILAR URLS: =1023423 =1023424 =1023426 =1023427 WHEN SHE DOES SO, SHE ACCESSES THE RECORDS OF OTHER STUDENTS. SHE CLOSES THE RECORDS AND IMMEDIATELY INFORMS THE SCHOOL PRINCIPAL OF THE VULNERABILITY. EHAT TERM BEST DESCRIES RENEE'S WORK? A. WHITE-HAT HACKING B. GREEN-HAT HACKING C. GRAY-HAT HACKING D. BLACK-HAT HACKING

C. GRAY-HAT HACKING

WHAT LANGUAGE IS STIX BASED ON? A. PHP B. HTML C. XML D. PYTHON

C. XML

CINDY WANTS TO SEND THREAT INFORMATION VIA A STANDARDIZED PROTOCOL SPECIFICALLY DESIGNED TO EXCHANGE CYBER THREAT INFORMATION. WHAT SHOULD SHE CHOOSE? A. STIX 1.0 B. OpenIOC C. STIX 2.0 D TAXII

D TAXII

WHICH ONE OF THE FOLLOWING IS THE BEST EXAMPLE OF A HACKTIVIST GROUP? A. CHINESE MILITARY B. U.S. GOVERNMENT C. RUSSIAN MAFIA D. ANONYMOUS

D. ANONYMOUS

WHAT ORGANIZATION DID THE U.S. GOVERNMENT HELP CREATE TO HELP SHARE KNOWLEDGE BETWEEN ORGANIZATIONS IN SPECIFIC VERTICALS? A. DHS B. SANS C. CERTS D. ISACs

D. ISACs