Cybersecurity

a Windows tool useful for troubleshooting

Sysinternals

defines how cyber threat information can be shared via services and message exchanges

Trusted Automated exchange of Intelligent Information (TAXII)

Which of the following can help organizations exercise care in ensuring the authenticity and integrity of the components of hardware purchased from a vendor? a. Hardware Source Authenticity b. Vendor Due Diligence c. Supply Chain Risk Assessment d. Trusted Foundry

Trusted Foundry

Which of the following is not considered an application-related indicator of compromise? a. Introduction of New Accounts b. Unauthorized Scheduled Task c. Unexpected Output d. Anomalous Activity

Unauthorized Scheduled Task

Common Vulnerability Scoring System (CVSS)

0-3.9 = Low 4-6.9 = Medium 7-10 = High

How many stages does PASTA threat model have?

7

uses dynamic and static analysis

Veracode

Which of the following enables an encrypted connection over the internet from a device to a network? a. A Software-Defined Network (SDN) b. A Virtual LAN (VLAN) c. A Virtual Private Network (VPN) d. A Virtual Private Cloud (VPC)

Virtual Private Network (VPN)

What are Race conditions?

A race condition is when a device or system attempts to execute two or more operations at the same time

Which of the following correctly describes what a secure enclave is? a. The secure enclave is a secure coprocessor which includes a hardware-based key manager and is isolated from the main processor to provide an extra layer of security b. The secure enclave is a type of hard drive which continuously and automatically encrypts data on the drive without any user interaction c. The secure enclave provides security extensions which allow for the protection of trusted and system resources from untrusted handlers and applications d. The secure enclave is a piece of software which makes it more difficult for attackers to modify the system

A secure coprocessor which includes a hardware-based key manager and is isolated from the main processor to provide an extra layer of security

Which of the following describes an email signature block? a. A signature which provides sender verification, message integrity and nonrepudiation b. An attack designed to trick victims into performing certain actions such as wiring money to an attacker's account c. A set of information such as name, email address, company title, and credentials d. An embedded link in an email

A set of information such as name, email address, company title, and credentials

Which of the following is a social engineering attack that targets wealthy, powerful or prominent individuals? a. Smishing b. Phishing c. Whaling d. Spear phishing

Whaling

set of tactics and techniques used to better classify attacks and assess an organization's risk

ATT&CK Matrix

network suite to analyze wireless LANs

Aircrack-ng

Which option is not considered when creating a Business Impact Analysis (BIA)? a. Assets and asset values b. Financial considerations c. Regulatory responsibilities d. Operational disruption and productivity

Assets and asset values

Which are known as exploitability metrics: a. Confidentiality Impact, Integrity Impact, Availability Impact b. Modified Attack Vector, Modified Attack Complexity, Modified Privileges Required,Modified User Interaction, Modified Scope c. Explicit Code Maturity, Remediation Level, Report Confidence d. Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope

Attack Vector, attack complexity, privileges required, user interaction, scope

Which type of attack involves an attacker manipulating a program so that it places more data into a section of memory than is allocated for that programs use?

Buffer Overflow Attack

Which of the following is a technique that helps to organize digital assets so that security controls can be applied more cleanly with fewer possible human errors? a. Asset Prioritization b. Executable Process Analysis c. Reducing the Attack Surface Area d. Bundling Critical Assets

Bundling Critical Assets

robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other's applications without a host computer

CAN bus

Extracting files out of raw data based on file format specific characteristics present in that data refers to ______. a. Data Acquisition b. Carving c. Hashing d. Virtualization

Carving

______ is not considered a password cracker. a. Cellebrite b. John the Ripper c. Cain & Abel d. Hashcat and oclHashcat

Cellebrite

Which describes a set of rules or configurations for a particular system which all future system configurations can be compared to?

Configuration baseline

Which of the following is the practice of merging the various changes in code made by contributors back to the main branch, or effort, of a code base as early and often as possible? a. Continuous Delivery b. Continuous Integration c. Security Content Automation Protocol (SCAP) d. Continuous Deployment

Continuous Integration

Which of the following Maximum Tolerable Downtime (MTD) categories should be restored first before anything else? a. Urgent b. Normal c. Important d. Critical

Critical

Which is not a stage of an incident management lifecycle? a. Preparation b. Containment, Eradication and Recovery c. Detection and Analysis d. Data Correlation

Data Correlation

Which of the following is a technique that allows one process to gather information from another process or source, then customize a response to a third source using the data from the second process of source? a. Data Enrichment b. Automated Malware Signature Creation c. Threat Feed Combination d. Workflow Orchestration

Data Enrichment

Which option describes the process of covering or replacing parts of sensitive data with data that is not sensitive? a. Deidentification b. Technical Controls c. Tokenization d. Data Masking

Data Masking

______ is a data retention techniques that involves using a magnetic field to completely wipe out the information and data stored on a hard drive. a. Formatting b. Degaussing c. Wiping d. Destruction

Degaussing

perimeter network separated from rest of network

Demilitarized Zone (DMZ)

Which characteristic contributes to the severity level classification? a. Impact b. Downtime c. Asset Location d. Server Capability

Downtime

forensic investigation tool

EnCase

__________ refers to a deliberate balancing of system security and performance aimed at ensuring that, while neither solution option is optimal, both are acceptable to the organization a. Security Controls b. Engineering Tradeoffs c. Compensating Controls d. Systems Assessment

Engineering Tradeoffs

examine purpose of executable file

Executable Process Analysis

scans hard drive, can find deleted emails

FTK

integrated circuit designed to be configured by a customer or a designer after manufacturing

Field programmable Gate Array

Which of the following refers to creating a new partition table after partitioning has been accomplished? a. Degaussing b. Partitioning c. Formatting d. Wiping out a Hard Drive

Formatting

Which legal requirement provides guidelines for securing all financial information and prohibits sharing financial information with third parties? a. GLBA b. PCI DSS c. HIPPA d. GDPR

Gramm-Leach-Bliley Act (GLBA) of 1999

Which of the following is a special trusted computer which is dedicated solely to cryptographic processing? a. Trusted Foundry b. Trusted Platform Module (TPM) c. Hardware Security Module (HSM) d. Hardware Root of Trust

Hardware Security Module (HSM)

Which comes as a live CD that can be mounted on a host without affecting the data on the host and provides the ability to acquire evidence and make drive images? a. Sysinternals b. EnCase c. FTK d. Helix3

Helix3

Which of the following refers to information critical to the function of an organization? a. Sensitive Personal Information (SPI) b. High Value Assets (HVA) c. Intellectual Property (IP) d. Corporate Confidential

High Value Assets (HVA)

Which of the following tools is used to test/audit firewalls? a. Reaver b. Hping c. Aircrack-ng d. Responder

Hping

Which of the following cloud models offer a simple method of accessing computing capabilities on demand over the web? a. Infrastructure as a Service (IaaS) b. Function as a Service (FaaS) c. Platform as a Service (PaaS) d. Software as a Service (SaaS)

Infrastructure as a Service (IaaS)

Which of the following vulnerabilities allow attackers to achieve their malicious goals undetected?

Insufficient logging and monitoring

Which of the following is not a category used in the ATT&CK matrix when profiling threat actors and activities? a. Discovery b. Location c. Initial Access d. Defense Evasion

Location

security strategy that restricts the ability individual resource owners have to grant or deny access to resource objects in a file system. Each user and device on the system is assigned a similar classification and clearance level

Mandatory Access Controls (MAC)

Which of the following checks each start up component, including everything from boot drivers to firmware, to better protect PCs from rootkits and other malware? a. Trusted Firmware Updates b. Device Attestation c. Measured Boot d. Atomic Execution

Measured Boot

small, containerized application services that perform a single task or a small group of related tasks

Microservices

Which of the following is a communication protocol primarily used for transmitting information over serial lines between electronic devices? a. Controller Area Network (CAN) bus b. Supervisory Control and Data Acquisition Systems (SCADA) c. Modbus d. Workflow and Process Automation Systems

Modbus

Which of the following device tracking technologies has the smallest range? a. NFC b. Wi-Fi c. Bluetooth d. GPS

NFC

Which of the following tools is used for Dynamic Analysis of code? a. Qualys b. Veracode c. SonarQube d. Netsparker

Netsparker

Which of the following can be either hardware or software, can examine data packets moving in or out of a network and is used to immediately detect unauthorized activity? a. IDS b. IPS c. HIDS d. NIDS

Network Intrusion Detection Systems (NIDS)

What is not considered a method of mitigating a security incident? a. Avoidance b. Acceptance c. Patching d. Deterrence

Patching

Which data type is concerned with information regarding pathological and other medical tests, medial history and medical insurance? a. Intellectual Property b. Personal Health Information (PHI) c. Personal Identifiable Information (PII) d. Payment Card Information

Personal Health Information (PHI)

Which of the following cloud deployment models is typically used by a single organization? a. Community b. Private c. Public d. Hybrid

Private

Which risk calculation method does not involve quantifying the data in the risk analysis process and instead uses categories that describe the qualities of risk elements? a. Regulatory Risk Analysis b. Monetary Risk Analysis c. Qualitative Risk Analysis d. Quantitative Risk Analysis

Qualitative Risk Analysis

Tool to brute force the WPS of a WiFi Router

Reaver

using least amount of devices/networks

Reducing the Attack Surface Area

set of constraints to guide how Web should behave

Representational State Transfer (REST)

When conducting a risk identification process, which option is not taken into consideration? a. Calculate threat probability and business impact b. Reputation c. Identify vulnerabilities and threats d. Identify assets and asset values

Reputation

Which of the following is not considered a containment method? a. Reverse Engineering b. Removal c. Segmentation d. Isolation

Reverse engineering

Which of the following describes a device present on a network which you do not control or manage?

Rogue devices

Which of the following hashing algorithms generates a Message Digest between 256 bits and 512 bits?

SHA-2 Hashing Algorithm

protocol for operating securely over unsecured network

Secure Shell (SSH)

open standard for exchanging authentication and authorization data between parties

Security Assertions Markup Language (SAML)

using specific standards to enable automated vulnerability management

Security Content Automation Protocol (SCAP)

Which of the following is a messaging protocol based on XML which is used for exchanging information among computers? a. Microservices b. Security Assertions Markup Language (SAML) c. Representational State Transfer (REST) d. Simple Object Access Protocol (SOAP)

Simple Object Access Protocol (SOAP)

Which of the following methods of internet-based machine-to-machine communications uses Extensible Markup Language (XML) as the message format transmits through HTTP or SMTP? a. Trusted Automated eXchange of Intelligent Information (TAXII) b. Secure Shell (SSH) c. Simple Object Access Protocol (SOAP) d. Representational State Transfer (REST)

Simple Object Access Protocol (SOAP)

uses software-based controllers or application programming interfaces (APIs) to communicate with underlying hardware infrastructure and direct traffic on a network, easy to collect network usage information

Software-Defined Network (SDN)

Uses static code analysis to debug

SonarQube

What does STRIDE stand for?

Spoofing Identity, Tampering with data, Repudiation, Information disclosure, Denial of service and elevation of privilege

Which of the following are a type of Industry Control System? a. Supervisory Control and Data Acquisition Systems (SCADA) b. Field-Programmable Gate Arrays (FPGAs) c. Embedded Systems d. System-on-Chip Systems (SoC)

Supervisory Control and Data Acquisition Systems (SCADA)

computer that spans large geographic area, public connection through the Internet

Wide Area Network (WAN)

Virtual Machine Sprawl refers to which of the following? a. An attacker targeting a VM with requests resulting in disruption of the target's online services b. With many virtual machines, there is a greater likelihood of lapses in security making it difficult for an administrator to manage. c. A guest OS is able to connect with the hypervisor, enabling the guest OS to interact directly with other VMs as well as the host d. Migrating a virtual machine to a different host without updating the configuration and security controls which leave it vulnerable to an attack

With many virtual machines, there is a greater likelihood of lapses in security making it difficult for an administrator to manage

What is a Service Level Agreement (SLA)?

a document that defines the level of service you expect from a vendor

identifying known malware

automated malware signature creation

Which of the following are used to identify and control who can access and operate corporate networks and services? a. Monitoring and Logging b. Digital Signatures c. Certificate management d. Mandatory Access Control (MAC)

certificate management

code changes are automatically prepared for production release

continuous delivery

changes are prepared periodically

continuous deployment

the sampling of continuous world information to get data which will be manipulated by a computer

data acquisition

removing association between data and subject

deidentification

software verifies the authenticity and integrity of the hardware and software of a device.

device attestation

mathematical technique which validates the authenticity and integrity of a message, software or digital documents. It allows us to verify the author name, date and time of signatures, and authenticate the message contents

digital signature

has a dedicated function within a larger mechanical or electronic system

embedded system

Which of the following is a controlled network which allows third-parties to connect, allowing them to gain information without connecting to the corporate internal network? a. A WAN b. A DMZ c. An Extranet d. An Intranet

extranet

the foundation on which all secure operations of a computing system depend

hardware root of trust

used to verify data has not been altered

hashing

public and private mix

hybrid cloud

private network within a business

intranet

which of the following are threat actors: a. Nation-state, Zero-days, Hacktivist, Organised Crime b. Nation-state, Intentional insider threat, Ransomware, Organised crime c. Nation-state, Advanced Persistent Threat (APT), Insider threat, Organised crime d. Nation-state, Insider threat, hacktivist, Organised crime

nation state, insider threat, hacktivist, organized crime

each guest can access its' own stuff but not any other guests' stuff

partitioning

Anybody can access, less secure

public cloud

process of taking a piece of software or hardware and analyzing its functions and information flow so that its functionality and behavior can be understood

reverse engineering

divides network into multiple parts

segmentation

sending emails from a known or trusted sender to make targeted individuals reveal confidential information

spear phishing

integrated circuit that integrates all or most components of a computer or other electronic system

system-on-chip

the process of substituting a sensitive data element with a non-sensitive equivalent

tokenization

international standard for a secure cryptoprocessor/chip

trusted platform module (TPM)

threat feed combination

using public database of known threats

group of computers and devices that share a communications line or wireless link to a server within the same geographical area

virtual LAN

process of running multiple virtual instances of a device on a single physical hardware resource

virtualization