ECE 6015 Digital Forensic Mid Term Study Quiz Chapter 1

Pregunta 1 de 37

1

Ensuring that only those who are authorized have access to specific assets and that those who are unauthorized are actively prevented from obtaining access.

Arrastra la opción correcta hasta el punto naranja

Confidentiality

Integrity

Availability

Explicación

Pregunta 2 de 37

1

Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable.

Arrastra la opción correcta hasta el punto naranja

Availability

Integrity

Confidentiality

Explicación

Pregunta 3 de 37

1

Ensuring that authorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running.

Arrastra la opción correcta hasta el punto naranja

Confidentiality

Integrity

Availability

Explicación

Pregunta 4 de 37

1

Patch your systems regularly

Selecciona una de las siguientes respuestas posibles:

Cyber hygiene
Non-repudiation
Data Integrity

Explicación

Pregunta 5 de 37

1

Only installed signed software updates

Selecciona una de las siguientes respuestas posibles:

Cyber hygiene
Non-repudiation
Data Integrity

Explicación

Pregunta 6 de 37

1

Source code changes virtually undetectable

Selecciona una de las siguientes respuestas posibles:

Cyber hygiene
Non-repudiation
Data Integrity

Explicación

Pregunta 7 de 37

1

What is it Governance?

Selecciona una o más de las siguientes respuestas posibles:

Policy
Regulations
Compliance
Oversight
Micro management

Explicación

Pregunta 8 de 37

1

What is the role of the CISO?

Selecciona una o más de las siguientes respuestas posibles:

Security Policy
Compliance
No sayer
Protect Corporate Secrets
Protect personal interest
Protect Information Assets
Business Enablement

Explicación

Pregunta 9 de 37

1

The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

Selecciona una de las siguientes respuestas posibles:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explicación

Pregunta 10 de 37

1

Requirement for multiple people to authenticate in order to perform certain administrative tasks.

Selecciona una de las siguientes respuestas posibles:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explicación

Pregunta 11 de 37

1

Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point.

Selecciona una de las siguientes respuestas posibles:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explicación

Pregunta 12 de 37

1

A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.

Selecciona una de las siguientes respuestas posibles:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explicación

Pregunta 13 de 37

1

1-10-60 Challenge
To effectively combat sophisticated cyberthreats:

Selecciona una o más de las siguientes respuestas posibles:

Detect intrusions in under one minute.
Investigate and understand threats in under 10 hours.
Contain and eliminate the adversary from the environment in under 60 minutes.
Detect intrusions in under one hour.

Explicación

Pregunta 14 de 37

1

The time an attack goes undetected (i.e., the delta between intrusion and detection).

Selecciona una de las siguientes respuestas posibles:

Dwell Time
Advanced Persistent Threat

Explicación

Pregunta 15 de 37

1

Selecciona la opción correcta del menú desplegable para completar el texto.

( Advanced Persistent Threat (APT), Gain Access, 1-10-60 Challenge ) attack uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a proloned period of time, with potentially destructive consequences.

Explicación

Pregunta 16 de 37

1

Five Stages of an Evolving APT Attack

Selecciona una o más de las siguientes respuestas posibles:

Gain Access
Establish a Foothold
Deepen Access
Move Laterally
Look, Learn, and Remain
Move Horizontally
Shallow Access
Detection
Remain calm then panic

Explicación

Pregunta 17 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

Stage 1: ( Gain Access, Look, Learn, and Remain )
Like a burglar forcing open a door with a crowbar, cybercriminals usually gain entry through a ( network, front door ), an infected ( file, router ), junk email, or an app ( vulnerability, hardening ) to insert ( malware, firewall ) into a target network.

Explicación

Pregunta 18 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( Functional Testing, Performance/Load Testing, Penetration Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets all functional requirements – ( Availability, Confidentiality ) and ( Integrity, Confidentiality )

Explicación

Pregunta 19 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( Performance/Load Testing, Penetration Testing, Functional Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets performance requirements under a real or simulated load - ( Availability, Confidentiality )

Explicación

Pregunta 20 de 37

1

Selecciona la opción correcta del menú desplegable para completar el texto.

( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

Explicación

Pregunta 21 de 37

1

Identify the Incident Response in the MITRE Framework

Arrastra la opción correcta a cada uno de los puntos naranjas

Preparation

Post-Incident Activity

Containment

Detection

Eradication/Recovery

Eradication/Recovery1

Containment1

Explicación

Pregunta 22 de 37

1

Selecciona la opción correcta del menú desplegable para completar el texto.

( Preparation, Panic, Trainning ): Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.

Explicación

Pregunta 23 de 37

1

Preparation step include:

Selecciona una o más de las siguientes respuestas posibles:

Create incident response plan
Train the team
Acquire tools
Prepping the environment for defense (hardening) and altering
Practice
Determine the root cause
Alter system configuration

Explicación

Pregunta 24 de 37

1

Selecciona la opción correcta del menú desplegable para completar el texto.

( Detection, Preparation, Analysis ): Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.

Explicación

Pregunta 25 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

Detection sources can include:
( Activity logs, Retrospective ): A security analyst may receive an alert that a specific administrator account was in use during the time where the administrator was on vacation.
( External sources, Internal users ): An ISP or law enforcement agency may detect malicious activity originating in an organization's network and contact them and advise them of the situation.
( Internal users, External sources ): An employee contacting the help desk and informing agent that services are no longer available, or files are suddenly encrypted

Explicación

Pregunta 26 de 37

1

Incident response coordinator: Individual often has overall responsibility for the security of the organization's information; responsible for management of the CSIRT prior to, during, and after an incident

Selecciona una o más de las siguientes respuestas posibles:

Chief Security Officer (CSO)
Information Security Officer (ISO)
Chief Information Security Officer (CISO)
Chief Executive Officer (CEO)
Chief Financial Officer (CFO)

Explicación

Pregunta 27 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( CSIRT senior analyst(s), Incident response coordinator, Security operations center analyst, CSIRT analyst(s): ): Personnel with ( extensive, minimal ) training and experience in incident response, digital forensics, network data examination

Explicación

Pregunta 28 de 37

1

CSIRT senior analyst(s):

Selecciona una o más de las siguientes respuestas posibles:

Often take part in training junior personnel
Engage with other CSIRT members to acquire and analyze evidence, direct containment activities, and assist other personnel with remediation
Has overall responsibility for the security of the organization's information.

Explicación

Pregunta 29 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( CSIRT analyst(s), Security operations center analyst, Legal ): Personnel with CSIRT responsibilities that have ( less, extensive ) exposure or experience in incident response activities

Explicación

Pregunta 30 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( Security operations center analyst, CSIRT analyst(s), Chief Information Security Officer (CISO ): Analysts assigned to the 24/7 Security Operations Center (SOC) ( monitoring, reporting ) capability; serve as the point person when it comes to incident ( detection, isolation ) and alerting.

Explicación

Pregunta 31 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

( Organizational support personnel, Tech support personnel, IT security engineer(s) / analyst(s) ): Assist with a variety of ( non-technical, technical ) issues that fall outside those that are addressed by the CSIRT core and technical support personnel.

Explicación

Pregunta 32 de 37

1

Organizational support personnel include:

Selecciona una o más de las siguientes respuestas posibles:

Legal
Engineering
Human Resources
Marketing / Communications
Transportation
Facilities
Corporate Security
Finance

Explicación

Pregunta 33 de 37

1

Devoting time and resources to implement security controls that are irrelevant to the threats the organization is trying to mitigate.

Selecciona una o más de las siguientes respuestas posibles:

Mismatching Control to Threat
Alert Fatigue

Explicación

Pregunta 34 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

Stage 2: ( Establish Foothold, Gain Access, Move Laterally, Look, Learn, and Remain, Deepen Access )
Cybercriminals implant ( malware, anti virus ) that allows the creation of a network of ( backdoors, hardening ) and tunnels used to move around in systems ( undetected, detected ).
The malware often employs techniques like rewriting code to help hackers ( cover, expose ) their tracks.

Explicación

Pregunta 35 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

Stage 3: ( Deepen Access, Move Laterally, Gain Access, Look, Learn, and Remain, Establish Foothold )
Once inside, hackers use techniques such as password cracking to gain access to ( administrator, user ) rights so they can control more of the system and get even ( greater, lesser ) levels of access.

Explicación

Pregunta 36 de 37

1

Selecciona la opción correcta de los menús desplegables para completar el texto.

Stage 4: ( Move Laterally, Deepen Access, Establish Foothold, Gain Access, Look, Learn, and Remain )
Deeper inside the system with ( administrator, user ) rights, hackers can move around at will. They can also attempt to access other servers and other secure parts of the network.

Explicación

Pregunta 37 de 37

1

Selecciona la opción correcta del menú desplegable para completar el texto.

Stage 5: ( Look, Learn, and Remain, Move Laterally, Gain Access, Deepen Access, Establish Foothold )
From inside system, hackers understand how it works and its vulnerabilities
Harvest the information they want at will.
Hackers keep this process running indefinitely or withdraw once they accomplish a specific goal.
They often leave a back door open to access the system again in the future.

	Creado por Marjorie Blanco hace más de 2 años

This is quiz for midterm

ECE 6015 Digital Forensic Mid Term Study Quiz Chapter 1

Pregunta 1 de 37

Ensuring that only those who are authorized have access to specific assets and that those who are unauthorized are actively prevented from obtaining access.

Arrastra la opción correcta hasta el punto naranja

Explicación

Pregunta 2 de 37

Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable.

Arrastra la opción correcta hasta el punto naranja

Explicación

Pregunta 3 de 37

Ensuring that authorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running.

Arrastra la opción correcta hasta el punto naranja

Explicación

Pregunta 4 de 37

Patch your systems regularly

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 37

Only installed signed software updates

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 37

Source code changes virtually undetectable

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 37

What is it Governance?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 37

What is the role of the CISO?

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 37

The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 37

Requirement for multiple people to authenticate in order to perform certain administrative tasks.

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 37

Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point.

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 37

A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 37

1-10-60 Challenge To effectively combat sophisticated cyberthreats:

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 37

The time an attack goes undetected (i.e., the delta between intrusion and detection).

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 37

Selecciona la opción correcta del menú desplegable para completar el texto.

Explicación

Pregunta 16 de 37

Five Stages of an Evolving APT Attack

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 37

Selecciona la opción correcta de los menús desplegables para completar el texto.

Explicación

Pregunta 18 de 37

Selecciona la opción correcta de los menús desplegables para completar el texto.

Explicación

Pregunta 19 de 37

Selecciona la opción correcta de los menús desplegables para completar el texto.

Explicación

Pregunta 20 de 37

Selecciona la opción correcta del menú desplegable para completar el texto.

Penetration Testing Performance/Load Testing Functional Testing( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

Explicación

Pregunta 21 de 37

Identify the Incident Response in the MITRE Framework

1-10-60 Challenge
To effectively combat sophisticated cyberthreats:

( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

( Preparation, Panic, Trainning ): Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.

( Detection, Preparation, Analysis ): Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.

( CSIRT analyst(s), Security operations center analyst, Legal ): Personnel with CSIRT responsibilities that have ( less, extensive ) exposure or experience in incident response activities