Cyberops Chapters 21-23
Which algorithm can ensure data confidentiality?
AES
A company implements a security policy that ensures that a file sent from the headquarters office to the branch office can only be opened with a predetermined code. This code is changed every day. Which two algorithms can be used to achieve this task? (Choose two.)
AES 3DES
What are two symmetric encryption algorithms? (Choose two.)
AES,3DES
What is an example of a symmetric encryption algorithm?
Advanced Encryption Standard
Which of the following uses a learned baseline model?
Anomaly-based strategy
Which device management activity addresses the inventory and control of hardware and software configurations?
Configuration Management
Which algorithm provides asymmetric encryption?
Diffie-Hellman
What technology supports asymmetric key encryption used in IPsec VPNs?
IKE
During which stage would you develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities?
Identify
Which term is a list of TCP or UDP processes that are available to accept data?
Port used
What is a list of TCP or UDP processes that are available to accept data
Ports used
What is a difference between symmetric and asymmetric encryption algorithms?
Symmetric encryption algorithms use pre-shared keys. Asymmetric encryption algorithms use different keys to encrypt and decrypt data.
Which two statements correctly describe certificate classes used in the PKI? (Choose two.)
A class 4 certificate is for online business transactions between companies. A class 0 certificate is for testing purposes.
Which statement describes the use of certificate classes in the PKI?
A class 5 certificate is more trustworthy than a class 4 certificate.
True or False? In asymmetric encryption, encryption and decryption use the same key.
False
Which type of endpoint protection includes iptables and TCP Wrapper?
Host-based firewall
Which statement describes the threat-vulnerability (T-V) pairing?
It is the identification of threats and vulnerabilities and the matching of threats with vulnerabilities
Which statement describes the term attack surface?
It is the total sum of vulnerabilites in a system that is accessible to an attacker
Which HIDS is an open-source based product?
OSSEC
What technology has a function of using trusted third-party protocols to issue credentials that are accepted as an authoritative identity?
PKI Certificates
Which technology is used by Cisco Advanced Malware Protection (AMP) in defending and protecting against known and emerging threats?
Threat intelligence
Which CVSS metric expresses whether human action is required for the exploit to succeed?
User interaction
Which device management activity is designed to proactively prevent the exploitation of IT vulnerabilities that exist within an organization?
Vulnerability Management
In network security assessments, which type of test employs software to scan internal networks and Internet facing servers for various types of vulnerabilities?
Vulnerability assessment
Which of the following uses a profile-based approach to configuring firewall functionality?
Windows firewall
Which protocol is an IETF standard that defines the PKI digital certificate format?
X.509
In Windows Firewall, when is the Domain profile applied?
when the host is connected to a trusted network such as an internal business network
What is the difference between an HIDS and a firewall?
An HIDS monitors operating systems on host computers and processes file system activity. Firewalls allow or deny traffic between the computer and other systems.
Which statement describes agentless antivirus protection?
Antivirus scans are performed on hosts from a centralized system
Which device management activity involves the implementation of systems that track the location and configuration of networked devices and software across an enterprise?
Asset Management
Which security management function is concerned with the implementation of systems that track the location and configuration of networked devices and software across an enterprise?
Asset management
Which CVSS metric expresses the number of components, software, hardware, or networks, that are beyond the attacker's control and that must be present for a vulnerability to be successfully exploited?
Attack Complexity
Which CVSS metric reflects the proximity of the threat actor to the vulnerable component?
Attack vector
Which term is the logical location of essential systems or data?
Critical asset address space
During which stage would you develop and implement the appropriate activities to identify the occurrence of a cybersecurity event?
Detect
What technology allows users to verify the identity of a website and to trust code that is downloaded from the Internet?
Digital signature
What are the steps in the vulnerability management life cycle?
Discover Prioritize assets Assess Report Remediate Verify
Which management activity is the most effective way to mitigate software vulnerabilities and is required by some security compliance regulations?
Enterprise patch management
Which class of metric in the CVSS Base Metric Group defines the features of the exploit such as the vector, complexity, and user interaction required by the exploit?
Exploitability
Which two classes of metrics are included in the CVSS Base Metric Group?
Exploitability, Impact metrics
On a Windows host, which tool can be used to create and maintain blacklists and whitelists?
Group Policy Editor
What is a feature of HMAC?
HMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
In which way does the use of HTTPS increase the security monitoring challenges within enterprise networks?
HTTPS traffic enables end-to-end encryption
As described by the SANS Institute, which attack surface includes the use of social engineering?
Human attack surface
What are the core functions of the NIST Cybersecurity Framework?
Identify Protect Detect Respond recover
Which metric class in the CVSS Basic Metric Group identifies the impacts on confidentiality, integrity, and availability?
Impact
What is the purpose of a digital certificate?
It authenticates a website and establishes a secure connection to exchange confidential data.
What is a host-based intrusion detection system (HIDS)?
It combines the functionalities of antimalware applications with firewall protection.
Which statement describes the policy-based intrusion detection approach?
It compares the operations of a host against well-defined security rules.
What does the telemetry function provide in host-based security software?
It enables host-based security programs to have comprehensive logging functions.
Which statement describes the Cisco Threat Grid Glovebox?
It is a sandbox product for analyzing malware behaviors.
Which type of attack does the use of HMACs protect against?
Man-in-the-middle
Which device management activity has measures that can disable a lost device, encrypt the data on the device, and enhance device access with more robust authentication measures?
Mobile device management
Which CVSS metric captures the level of access that is required for a successful exploit of the vulnerability?
Privileges required
During which stage would you develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services?
Protect
During which stage would you develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event?
Recover
During which stage would you develop and implement the appropriate activities to take action regarding a detected cybersecurity event?
Respond
Which risk response involves stopping performing the risky activities?
Risk Avoidance
Which risk response accepts the risk and its consequences?
Risk Retention
Which risk response outsources some of the risk to other parties, such as Security as a Service?
Risk Sharing
Which risk response takes measures to reduce vulnerability?
Risk reduction
Which statement describes the Software-Optimized Encryption Algorithm (SEAL)?
SEAL is a stream cipher
Which has function is the most secure?
SHA-3
Which technique could be used by security personnel to analyze a suspicious file in a safe environment?
Sandboxing
Which CVSS metric expresses whether multiple authorities must be involved in an exploit?
Scope
When establishing a server profile for an organization, which element describes the type of service that an application is allowed to run on the server?
Service account
What is the term for the time between the establishment of a data flow and its termination?
Session duration
When a network baseline is being established for an organization, which network profile element indicates the time between the establishment of a data flow and its termination?
Session duration
What role does an RA play in PKI?
Subordinate CA
Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?
Switch
Which of the following is a rule-based control and logging system for Linux?
TCP Wrappers
In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?
Telementry
What is a feature of distributed firewalls?
They combine the feature of host-based firewalls with centralized management.
What refers to the amount of data passing from a given source to a given destination in a given period of time?
Total throughput
True or False? Endpoints are hosts on the network that can access or be accessed by other hosts on the network.
True
Which security endpoint setting would be used by a security analyst to determine if a computer has been configured to prevent a particular application from running?
blacklisting
Which technology might increase the security challenge to the implementation of IoT in an enterprise environment?
cloud computing
Which security management function is concerned with the inventory and control of hardware and software configurations of systems?
configuration management
The ip addresses or the logical location of essential systems or data
critical asset address space
develop and implement the appropriate activities to identify the occurrence of a cybersecurity event
detect
What is an action that should be taken in the discovery step of the vulnerability management life cycle?
developing a network line baseline
Which step in the Vulnerability Management Life Cycle performs inventory of all assets across the network and identifies host details, including operating system and open services?
discover
What are the three outcomes of the NIST Cybersecurity Framework identify core function?
governance, asset management, risk assessment
develop an organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities
identify
Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?
integrity
What is the purpose of code signing?
integrity of source .EXE files
What allows Linux system administrators to configure network access rules that are part of the Linux kernel Netfilter modules?
iptables
When a server profile for an organization is being established, which element describes the TCP and UDP daemons and ports that are allowed to be open on the server?
listening ports
Which type of endpoint protection permits only authorized and compliant devices to connect to the network?
network admission control
As described by the SANS Institute, which attack surface includes the exploitation of vulnerabilities in wired and wireless protocols used by IoT devices?
network attack surface
develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services
protect
In addressing an identified risk, which strategy aims to decrease the risk by taking measures to reduce vulnerability?
risk reduction
In profiling a server, what defines what an application is allowed to do or run on a server?
service accounts
the time between the establishment of a data flow and its termination
session duration
Which antimalware software approach can recognize various characteristics of known malware files to detect a threat?
signature-based
Which type of antimalware software recognizes various characteristics of known malware files?
signature-based
What is the purpose of the DH algorithm?
to generate a shared secret between two hosts that have not communicated before
the amount of data from given source to a given destination in a given period of time
total throughput
A cybersecurity analyst is performing a CVSS assessment on an attack where a web link was sent to several employees. Once clicked, an internal attack was launched. Which CVSS Base Metric Group Exploitability metric is used to document that the user had to click on the link in order for the attack to occur?
user interaction
What provides filtering of websites and blacklisting to prevent endpoints from accessing malicious web pages?
web security appliance
