Quiz
ECE 6015 Digital Forensic Mid Term Study Quiz Chapter 1
This quiz has question types that open in the usual player.
Questions in this quiz (37)
1Ensuring that only those who are authorized have access to specific assets and that those who are unauthorized are actively prevented from obtaining access.
- AConfidentiality
- BIntegrity
- CAvailability
2Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable.
- AAvailability
- BIntegrity
- CConfidentiality
3Ensuring that authorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running.
- AConfidentiality
- BIntegrity
- CAvailability
4Patch your systems regularly
- ACyber hygiene
- BNon-repudiation
- CData Integrity
5Only installed signed software updates
- ACyber hygiene
- BNon-repudiation
- CData Integrity
6Source code changes virtually undetectable
- ACyber hygiene
- BNon-repudiation
- CData Integrity
7What is it Governance?
- APolicy
- BRegulations
- CCompliance
- DOversight
- EMicro management
8What is the role of the CISO?
- ASecurity Policy
- BCompliance
- CNo sayer
- DProtect Corporate Secrets
- EProtect personal interest
- FProtect Information Assets
- GBusiness Enablement
9The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.
- ALeast privilege
- BTwo Person Integrity
- CNetwork Separation
- DEnclave
10Requirement for multiple people to authenticate in order to perform certain administrative tasks.
- ALeast privilege
- BTwo Person Integrity
- CNetwork Separation
- DEnclave
11Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point.
- ALeast privilege
- BTwo Person Integrity
- CNetwork Separation
- DEnclave
12A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.
- ALeast privilege
- BTwo Person Integrity
- CNetwork Separation
- DEnclave
131-10-60 Challenge
To effectively combat sophisticated cyberthreats:- ADetect intrusions in under one minute.
- BInvestigate and understand threats in under 10 hours.
- CContain and eliminate the adversary from the environment in under 60 minutes.
- DDetect intrusions in under one hour.
14The time an attack goes undetected (i.e., the delta between intrusion and detection).
- ADwell Time
- BAdvanced Persistent Threat
15[blank_start]Advanced Persistent Threat (APT)[blank_end] attack uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a proloned period of time, with potentially destructive consequences.
- AAdvanced Persistent Threat (APT)
- BGain Access
- C1-10-60 Challenge
16Five Stages of an Evolving APT Attack
- AGain Access
- BEstablish a Foothold
- CDeepen Access
- DMove Laterally
- ELook, Learn, and Remain
- FMove Horizontally
- GShallow Access
- HDetection
- IRemain calm then panic
17Stage 1: [blank_start]Gain Access[blank_end]
Like a burglar forcing open a door with a crowbar, cybercriminals usually gain entry through a [blank_start]network[blank_end], an infected [blank_start]file[blank_end], junk email, or an app [blank_start]vulnerability[blank_end] to insert [blank_start]malware[blank_end] into a target network.- Anetwork
- Bfront door
- Cfile
- Drouter
- Evulnerability
- Fhardening
- Gmalware
- Hfirewall
- IGain Access
- JLook, Learn, and Remain
18[blank_start]Functional Testing[blank_end]: Test cases performed to confirm the system operates as it was designed/specified and meets all functional requirements – [blank_start]Availability[blank_end] and [blank_start]Integrity[blank_end]
- AFunctional Testing
- BPerformance/Load Testing
- CPenetration Testing
- DAvailability
- EConfidentiality
- FIntegrity
- GConfidentiality
19[blank_start]Performance/Load Testing[blank_end]: Test cases performed to confirm the system operates as it was designed/specified and meets performance requirements under a real or simulated load - [blank_start]Availability[blank_end]
- APerformance/Load Testing
- BPenetration Testing
- CFunctional Testing
- DAvailability
- EConfidentiality
20[blank_start]Penetration Testing[blank_end]: Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)
- APenetration Testing
- BPerformance/Load Testing
- CFunctional Testing
21Identify the Incident Response in the MITRE Framework
- APreparation
- BPost-Incident Activity
- CContainment
- DDetection
- EEradication/Recovery
- FEradication/Recovery1
- GContainment1
22[blank_start]Preparation[blank_end]: Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.
- APreparation
- BPanic
- CTrainning
23Preparation step include:
- ACreate incident response plan
- BTrain the team
- CAcquire tools
- DPrepping the environment for defense (hardening) and altering
- EPractice
- FDetermine the root cause
- GAlter system configuration
24[blank_start]Detection[blank_end]: Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.
- ADetection
- BPreparation
- CAnalysis
25Detection sources can include:
[blank_start]Activity logs[blank_end]: A security analyst may receive an alert that a specific administrator account was in use during the time where the administrator was on vacation.
[blank_start]External sources[blank_end]: An ISP or law enforcement agency may detect malicious activity originating in an organization's network and contact them and advise them of the situation.
[blank_start]Internal users[blank_end]: An employee contacting the help desk and informing agent that services are no longer available, or files are suddenly encrypted- AActivity logs
- BRetrospective
- CExternal sources
- DInternal users
- EInternal users
- FExternal sources
26Incident response coordinator: Individual often has overall responsibility for the security of the organization's information; responsible for management of the CSIRT prior to, during, and after an incident
- AChief Security Officer (CSO)
- BInformation Security Officer (ISO)
- CChief Information Security Officer (CISO)
- DChief Executive Officer (CEO)
- EChief Financial Officer (CFO)
27[blank_start]CSIRT senior analyst(s)[blank_end]: Personnel with [blank_start]extensive[blank_end] training and experience in incident response, digital forensics, network data examination
- ACSIRT senior analyst(s)
- BIncident response coordinator
- CSecurity operations center analyst
- DCSIRT analyst(s):
- Eextensive
- Fminimal
28CSIRT senior analyst(s):
- AOften take part in training junior personnel
- BEngage with other CSIRT members to acquire and analyze evidence, direct containment activities, and assist other personnel with remediation
- CHas overall responsibility for the security of the organization's information.
29[blank_start]CSIRT analyst(s)[blank_end]: Personnel with CSIRT responsibilities that have [blank_start]less[blank_end] exposure or experience in incident response activities
- ACSIRT analyst(s)
- BSecurity operations center analyst
- CLegal
- Dless
- Eextensive
30[blank_start]Security operations center analyst[blank_end]: Analysts assigned to the 24/7 Security Operations Center (SOC) [blank_start]monitoring[blank_end] capability; serve as the point person when it comes to incident [blank_start]detection[blank_end] and alerting.
- ASecurity operations center analyst
- BCSIRT analyst(s)
- CChief Information Security Officer (CISO
- Dmonitoring
- Ereporting
- Fdetection
- Gisolation
31[blank_start]Organizational support personnel[blank_end]: Assist with a variety of [blank_start]non-technical[blank_end] issues that fall outside those that are addressed by the CSIRT core and technical support personnel.
- AOrganizational support personnel
- BTech support personnel
- CIT security engineer(s) / analyst(s)
- Dnon-technical
- Etechnical
32Organizational support personnel include:
- ALegal
- BEngineering
- CHuman Resources
- DMarketing / Communications
- ETransportation
- FFacilities
- GCorporate Security
- HFinance
33Devoting time and resources to implement security controls that are irrelevant to the threats the organization is trying to mitigate.
- AMismatching Control to Threat
- BAlert Fatigue
34Stage 2: [blank_start]Establish Foothold[blank_end]
Cybercriminals implant [blank_start]malware[blank_end] that allows the creation of a network of [blank_start]backdoors[blank_end] and tunnels used to move around in systems [blank_start]undetected[blank_end].
The malware often employs techniques like rewriting code to help hackers [blank_start]cover[blank_end] their tracks.- Amalware
- Banti virus
- Cbackdoors
- Dhardening
- Eundetected
- Fdetected
- Gcover
- Hexpose
- IEstablish Foothold
- JGain Access
- KMove Laterally
- LLook, Learn, and Remain
- MDeepen Access
35Stage 3: [blank_start]Deepen Access[blank_end]
Once inside, hackers use techniques such as password cracking to gain access to [blank_start]administrator[blank_end] rights so they can control more of the system and get even [blank_start]greater[blank_end] levels of access.- Aadministrator
- Buser
- Cgreater
- Dlesser
- EDeepen Access
- FMove Laterally
- GGain Access
- HLook, Learn, and Remain
- IEstablish Foothold
36Stage 4: [blank_start]Move Laterally[blank_end]
Deeper inside the system with [blank_start]administrator[blank_end] rights, hackers can move around at will. They can also attempt to access other servers and other secure parts of the network.- AMove Laterally
- BDeepen Access
- Cadministrator
- Duser
- EEstablish Foothold
- FGain Access
- GLook, Learn, and Remain
37Stage 5: [blank_start]Look, Learn, and Remain[blank_end]
From inside system, hackers understand how it works and its vulnerabilities
Harvest the information they want at will.
Hackers keep this process running indefinitely or withdraw once they accomplish a specific goal.
They often leave a back door open to access the system again in the future.- ALook, Learn, and Remain
- BMove Laterally
- CGain Access
- DDeepen Access
- EEstablish Foothold
Information
- Description
- This is quiz for midterm
- Author
- Marjorie Blanco
- Language
- English
- Views
- 25
- Tags
- Rating
- No ratings yet Rate this quiz