Mid-Term Study Guide
In DNS, what is the maximum number of sub-levels that is allowed
127
From 2011 to 2013, probes and intrusions into computer networks of critical infrastructure in the United States increased by what percentage?
1700
An asymmetric cryptographic digital system uses how many sets of keys?
2
What technology provides processor extensions as a chip-level solutions that allow virtualization to issue privileged x86 instructions VMMs can not virtualize
AMD's AMD-V Intel's Virtualization Technology (VT)
Examples of contactless smart cards (CSC) are,..
Access Control Badges U.S. Electronic Passport VISA, MasterCard, and American Express
The primary types of RFID tags when categorized by power source are,...
Active Passive Battery-assisted passive
What does APT stand for?
Advanced Persistent Threat
Which type of firewall would provision for web and e-mail filtering?
Application Gateway
On Window, an API stands for an,...
Application Programming Interface
For which events was TOR used?
Arab Spring Green Revolution
Shellcode is written in what language, which is passed through an assembler to create the binary machine code that the central processing unit (CPU) can execute.
Assembly Language
Which element of the CIA Triad concerns itself with attacks that try to prevent access to a network
Availbility
One common system level vulnerability and attack that uses computer memory is what type of attack?
Buffer Overflow
Exploit kits such as Death Pack and Neosploit are written in what language(s)
C PHP
Why do attackers use proxies?
Capture Traffic Mask IP Make traffic look legitimate
A trusted third party used to produce digital certificates that explicitly tie an entity to a public key is known as a
Certificate Authority
Which is not a Host-based firewalls solution?
Cisco iptables
PPC has resulted in what type of fraud?
Click Fraud
Which element of the CIA Triad concerns itself with attacks used to gain entry into computer networks to monitor activities
Confidentiality
The most pervasive type of cybercrime is
Credential Crime
Stuxnet required which type of individuals to develop the malware
Cyber Experts Engineers familiar with Siemens equipment Nuclear Physics
The use of digital tools by criminals to steal or otherwise carry out illegal activities is called?
Cybercrime
The global domain within the information environment consisting of the independent network of of information technology infrastructure, including the Internet, telecommunication networks, computers systems and embedded processors and controllers is
Cyberspace
Which type of attack is based on the principle that responding to incoming queries or request consume computer resources and network bandwidth?
DOS
Which is an example of loss of data availability? (select all that apply)
DOS Attack DDOS Attack
The National Research Council defined cyber attacks as which of the following
Deliberate actions to alter, disrupt, deceive, degrade, or destroy computer systems or networks or information
The impact of a successful SQL injection attack can include which of the following
Destruction of the entire database Sensitive Data Leakage Website Defacement
Antivirus vendors can not detect a modification to the firewall settings of Windows Firewall
False
Attacker proxies never handle or use the User Datagram Protocol (UDP).
False
Block ciphers are less common in symmetric encryption algorithms
False
Competitors cannot benefit from click fraud
False
Default passwords are generally not a problem with dealing with network security
False
Digital signatures are easy to steal
False
For information assurance, the concerns for protecting confidentiality only consider the electronic world.
False
In malware, the payload is used to exploit a well known or zero day vulnerability
False
Most Web exploit tools are so very complex and require the operator to perform difficult task to prepare the executable virus for installation.
False
Once the initial exploitation and exfiltration is over, an APT is no longer an concern
False
Paravirtualization does not require modification to the virtual machine's operating system
False
Shellcode IS NOT operating system specific
False
Shellcodes ports well between Linux, UNIX, and Windows platforms
False
The "phone home" phase of an APT attack is very difficult to detect
False
The HTTP protocol can not be used for tunneling because of the limited space for content (or payload) in the request or reply message.
False
There is no "quality assurance" involved in APTs during development
False
Using IDS iodine signatures available for Snort, it is impossible to "hack" tunnels to foil the defenses offered
False
Most smishing attacks target what institution?
Financial
Which is the core protocol for which the Internet "rides on".
HTTP
Asprox used which type of "flux" strategy?
Hydra-Flux
Botnets use which type of communication channel to manage infected machines
IRC
Which organizations provide access to the Internet to the common household?
ISP
Which are valid Windows scheduling priority classes
Idle Below Normal Above Normal High Real-Time
Which element of the CIA Triad concerns itself with attacks used to change data rather than extract information.
Integrity
What does impersonation do when used within a service
It impersonates a client while accessing requested resources on the server
When authentication requires more than one piece of information (factor), we call this,...
Multifactor Authentication
NIAG stands for
National Information Assurance Glossary
What features below describe the operations of a firewall?
Network Devices or Software Separates one trusted network from an untrusted network Uses rule-based filtering of network traffic
The Windows library function to create a process is
NtCreateProcessEx
Which are commercial PHP obfuscation commonly used by Web exploit tool authors
NuSphere's NuCoder Zend Guard
Decentralized botnets use what type of communication to send commands between bots?
P2P
The Internet is a _______ network
Packet-Switched
A unique identifier given to a new process by the system during initiation is
Process Identifier (PID)
RFID stands for,...
Radio Frequency Identification
What two categories do DNS resolvers fall into two categories:
Recursive Non-Recursive
The name RAT used within Shady RAT stands for
Remote Administration Tool
Double-flux involves
Rotating Host IPs Rotating DNS IPs
For an adversary, fast-flux solves which of the following problems
Routing Issues Firewall Filtering Infection Remediation
The TCP port 1080 is used by,...
SOCKS Proxy
Which is an example of loss of data integrity?
SQL Attack
Which is one of the most common tunneling implementations? Researchers cannot help but think of when hearing the word tunneling
Secure Shell (SSH)
Traditional antivirus software relies on what for malware detection?
Signatures
Which best describes APTs
Specific Target Work of a team Combine organization, intelligence, complexity, and patience to develop
Encryption using Exclusive OR (XOR) is what form of encryption?
Symmetric
What technology aids users in evading government surveillance and censorship
TOR
The "control plane" is used for,...
The dynamic sharing of router information
What company hosted the Taliban website that kept a running tally of suicide bombing and other attacks against the US troops in Afghanistan
ThePlanet
Administrators can detect the use of proxies through by which of the following,
Track Configuration Changes Use IDS Use tools like decloak.net
Rogue anti-virus uses what type of malware technique
Trojan
Buffer overflows are a common exploit technique using shellcode as a payload to execute code within the targeted process
True
Click Fraud occurs when an ad network charges an advertiser for a click when there is no opportunity for a legitimate "conversion"
True
Metadata is data about data, information that describes the nature of communication, rather than the content.
True
One technique for detecting Click Fraud is to record IP addresses and only count multiple "clicks" as one "click" when they occur from the same IP within a predetermined time frame, such as 30 minutes
True
PPC is based on the premises that ad publishers get paid by the number of potential customer who click on an ad on the publishers website
True
Performing an XOR operation on the same data twice with the same key will always result in the same ciphertext.
True
Shady RAT was a state-related (sponsored) campaign
True
Shellcode is binary code
True
Software flaws can lead to loss of data integrity
True
The registry key at HKCU\Software\Microsoft\Windows\CurrentVersion\InternetSettings, entry named "ProxyServer", controls the proxy settings for Internet Explorer.
True
To instruct the PDF viewer to execute the JavaScript code upon opening the file, the malware author must also assign an action to the object
True
To prevent overflow attacks, a program can validate data received for both size and content
True
Web browsers load PDF files automatically, so a malicious PDF file can exploit a user's computer without any interaction once the user visits a malicious website.
True
With virtualization, each virtual machine is capable of running its operating system independent of the other virtual machines running on the same physical machine.
True
Virtualization systems consist of key components
VMM Physical Hardware Virtual Hardware Virtual Operating System Host Operating System
"doxing" is
an attacked focuses on revealing personal information to the public
When an attacker tricks a DNS server into accepting data from a nonauthoritative server and returns them to other resolvers it is called,..
cache poisoning
Exploit tools analyze the referrer HTTP header to determine
if the victim originates from an infected page, avoid sending malicious content to malware researchers who may try to analyze a website
On Linux, to perform a system call, the shellcode issues an
interrupt
Authorization relates to
permissions
A PRNG algorithm is,...
pseudo-random number generation
Which below DOES NOT describes when a binary executable becomes an actual program.
the OS reserves all resource required by the executable
An access control lists describes
the access that identities may request when accessing the token.
In PPC, an "Impression" is
the number of times a viewer sees an ad
