O GoConqr está de visual novo! Conte para nós o que você achou.

Registre-se grátis

Flashcards

CSA Chapter 1

Frank VonFriedland Computer Studies IT Certs Inglês 144 flashcards

Flashcards do conjunto (144)

  1. 1Topology DiscoveryDetermining the devices on a network, their connectivity relationships and the internal IP addressing scheme.
  2. 2OS FingerprintingFinding out what OS version and build number is being used to help find common vulnerabilities.
  3. 3Service DiscoveryFinding which services are running to find potential vulnerabilities.
  4. 4Packet CaptureThe use of capture programs to capture raw packets from the network.
  5. 5What are some of the things a hacker could discover by performing a packet capture.-Sensitive data
    -OS, network, service information
    -Packets between routers may reveal network and device info.
  6. 6E-Mail harvestingThe act of gathering as many E-mail addresses through various means for spamming, social engineering, or phishing attacks.
  7. 7Social Media ProfilingGathering information from employees social media pages to use for future attacks?
  8. 8What could you do to possibly lessen social media profiling.While not much can be done, employee training on the subject could help.
  9. 9Social engineeringGaining the trust of a user and in some way convincing him/her to reveal sensitive info or to commit an action to lower the security of the network.
  10. 10DNS HarvestingThe attempt of gaining the DNS records to your network.
  11. 11What is the "A" DNS record?A host record, representing a single device to an IPv4 Address
  12. 12What is the "AAAA" DNS record?A host record, representing a single device to an IPv6 address
  13. 13What is the "CNAME" DNS record?A alias record, which represents an additional hostname to an IPv4 address that already has an A record mapped.
  14. 14What is the "NS" DNS record?A Name Server record, which represents a DNS server mapped to an IPv4 address
  15. 15What is the "MX" DNS record?A mail exchanger record, which represents an e-mail server mapped to an IPv4 address
  16. 16What is the "SOA" DNS record?A Start of Authority record, which represents a DNS server that is authoritative for a DNS namespace
  17. 17What does the tracert do?Follows a packet from it's source to it's destination allowing for minor recon
  18. 18What is Whois?Whois is a protocol used to query databases that contain information about the owners of internet resources.
  19. 19What is a zone transfer attack?An attacker might be able to transfer a DNS in to his zone, but with the proper settings this can't happen.
  20. 20PhishingThe act of sending a mass e-mail to people that think it's coming from a trusted source, their bank or their boss for example.
  21. 21WPA Personal has what access controlA preshared key
  22. 22WPA Personal has what type of encryption?TKIP
  23. 23WPA Enterprise uses what access control?802.1X RADIUS
  24. 24WPA Enterprise uses what encryptionTKIP
  25. 25WPA2 Personal uses what access control?Preshared key
  26. 26WPA2 Personal uses what type of encryption?CCMP, AES
  27. 27WPA2 Enterprise uses what kind of access control802.1X RADIUS
  28. 28WPA2 Enterprise uses what kind of encryption?CCMP, AES
  29. 29WPA2 Enterprise uses what kind of Integrity?CCMP
  30. 30WPA2 Personal uses what type of Integrity?CCMP
  31. 31WPA Enterprise uses what integrity?Michael
  32. 32WPA Enterprise uses what type of integrity?Michael
  33. 33What is a VM Escape?When the guest OS escapes from it's VM Encapsulation to interact directly with the hypervisor.
  34. 34What is an unsecured VM Migration?Occurs when a VM is migrated to a new host and security policies and configuration are not upgraded.
  35. 35What is a VM Sprawl?Occurs when the number of VMs gets to a point where the administrator can't realistically manage them any more.
  36. 36Hypervisor attackThis involves taking control of the hypervisor and gaining access to the VM's and their data.
  37. 37What is a denial of service attack?Either one or multiple people pinging a single target to stop actual users from using the services.
  38. 38What is inadequate VM isolation?It enables a VM to communicate improperly, can be used to gain access to multiple guests and possibly the host.
  39. 39A firewall has more openings when?An extranet or DMZ web server has access to internal databases.
  40. 40Excessive extranet and DMZ connections provide what?Potential entry points for malicious code.
  41. 41Extranet and DMZ connections afford what?An avenue of access for unauthorized users to exploit sensitive or proprietary information.
  42. 42If one network is compromised what could that mean for other networks?An entry point for compromise exists for all the other networks connected to it.
  43. 43Inadequate access controls and a lack of extranet security policies and requirements can what?Expose the interconnected networks.
  44. 44What two things should be partitioned from the company intranet?The Extranets and DMZs
  45. 45What does a Virtual private network (VPN) provide?Secure connectivity.
  46. 46External users are uniquely identified using what?Strong authentication
  47. 47Implementing authorization relies on what principle?The principle of least privilege.
  48. 48What is principle of least privilege (PoLP)?Ensures that a process, a user, or a program must be able to access only the information and resources that are necessary or required for daily duties.
  49. 49Ensure a routable path doesn't exists between?Partner networks
  50. 50What are some control measures that could be implemented on a network to aid in the increase of network securityReal-time monitoring
    Auditing
    Alerting
  51. 51Multi-tenancy can lead to what?-Allowing other users or attackers to see others data or to assume a users identity
    -Residual data from old users exposed to new users.
  52. 52In terms of the cloud, authentication and authorization may become?Improper or inadequate.
  53. 53In terms of the cloud, users may lose access due to?Inadequate or redundant and fault-tolerance measures.
  54. 54In terms of the cloud, Shared ownership of data with the customer can limit what?The legal liability of the provider.
  55. 55In terms of the cloud, what would a provider do with access to user data.User it improperly, EX; Data mining.
  56. 56In terms of the cloud, why is data jurisdiction an issue?Where does the data reside and what laws affect it based on it's location?
  57. 57Nmap is what type of program?A popular port scanning tool
  58. 58What is the URG flag?Urgent pointer field significant
  59. 59What is the ACK flag?Acknowledgment field significant
  60. 60What is the PSH flag?Push function
  61. 61What is the RST flag?Reset the connection
  62. 62What is the SYN flag?Synchronize sequence numbers.
  63. 63What is the FIN flag?No more data from sender.
  64. 64What is a Null scan?A series of TCP packets that contain a sequence number of 0 and no flags set.
  65. 65What does a Null scan do?Because it doesn't contain any set flags it can sometimes penetrate firewalls and edge routers.
  66. 66What does "no response" mean on a Null scanThe port is open on the target.
  67. 67What does "RST" mean on a Null scanThe port is closed on the target.
  68. 68What is a FIN scan?A scan where the FIN bit is set.
  69. 69What does "no response" mean on a FIN ScanThe port is open on the target
  70. 70What does "RST/ACK" mean on a Null scanThe port is closed on the target.
  71. 71What are the two types of responses you can get from a FIN ScanNo Response and RST/ACK.
  72. 72What is an XMAS scan?This scan sets the FIN, PSH, and URG flags.
  73. 73What are the two responses of a XMAS Scan?No response
    RST
  74. 74What does "no response" mean on a XMAS scanThe port is open on the target.
  75. 75What does "RST" mean on a XMAS scanThe port is closed on the target
  76. 76What does Host Scanning do?It identifies all live hosts on the network.
  77. 77What command do you run in NMAP to perform a live host scan?nmap -sP x.x.x.x-100
    x's are your IP range.
  78. 78What does network mapping do?Creating a logical network diagram that identifies not only the systems but their connective relationships.
  79. 79What is another name for Network mapping?Fingerprinting.
  80. 80Where is the Netstat command inputted?The command line.
  81. 81What does the Netstat -a command do?Displays network connections for TCP/IP, Routing Tables, network interfaces, and network protocol statistics.
  82. 82On a Netstat -a command, what does Listening mean?Waiting for a connection request from any remote TCP connection and port.
  83. 83On a Netstat -a command, what does SYN-SENT mean?Waiting for a matching connection request after having sent a connection request.
  84. 84On a Netstat -a command, what does Syn-Received mean?Waiting for a confirming connection request acknowledgement after having both sent and received a connection request.
  85. 85On a Netstat -a command, what does ESTABLISHED mean?An open connection and data received can be delivered to a user.
  86. 86On a Netstat -a command, what does FIN-WAIT1 mean?Waiting for a connection termination request from a remote TCP connection or an acknowledgement of the connection termination request previously sent.
  87. 87On a Netstat -a command, what does FIN-WAIT2 mean?Waiting for a connection termination request from the remote TCP connection.
  88. 88On a Netstat -a command, what does a CLOSE-WAIT mean?Waiting for a connection termination request acknowledgement from the remote TCP connection.
  89. 89On a Netstat -a command, what does LAST-ACK mean?Waiting for acknowledgement of the connection termination request previously sent to the remote TCP connection.
  90. 90What does IDS stand for?Intrusion detection system
  91. 91What does IPS stand for?Intrusion prevention system.
  92. 92What does an IDS do?It is responsible for detecting authorized access or attacks against systems and networks.
  93. 93What can an IDS do?Verify, itemize, and characterize threats from outside and inside the network.
  94. 94What is a signature based IDS?It analyzes traffic and compares it to attack or state patterns called Signatures, that reside in the IDS database.
  95. 95What is another name for an IDS?Misuse-detection system.
  96. 96What is a downfall of a Signature based IDS?It only recognizes attacks as compared with its database and is only effective as the signatures provided.
    Must be updated often!
  97. 97What are the two types of Signature based IDS's?Pattern Matching
    Stateful matching
  98. 98What does a Pattern matching IDS do?It compares traffic to a database of attack patterns and carries out specific steps when it detects an attack
  99. 99What does a stateful matching IDS do?It records the initial operating system state. Any changes to the system state that specifically violate the defined rules result in an alert or notification sent.
  100. 100What does an anomaly based IDS do?It analyzes traffic and compares it to normal traffic to see if its a threat.
  101. 101What is another name for an anomaly based IDS?Behavior or profile based.
  102. 102What is the problem with an anomaly based IDS?Any traffic outside of expected norms is reported resulting in more false positives.
  103. 103What are the 3 main types of anomaly based IDS's?Statistical anomaly based
    Protocol anomaly based
    Traffic anomaly based
  104. 104What does a statistical anomaly based IDS do?It samples the live environment to record activities. the longer it's in operation the more accurate the profile is built.
  105. 105What is an issue with the statistical based IDS?Developing a profile without a large number of false positives is difficult and time consuming.
  106. 106What does a Protocol anomaly based IDS do?It has knowledge of protocols it will monitor, a profile of normal usage is built and compared to activity.
  107. 107What does a traffic anomaly based IDS do?It tracks changes in traffic patterns. All future traffic patterns are compared to the sample.
  108. 108How does a rule or heuristic based IDS work?it uses a knowledge base, an interference engine and rule-based programming.
  109. 109How does a rule/heuristic based IDS work?The knowledge is configured in the rules, the data and traffic are analyzed and the rules are applied to analyzed traffic.
  110. 110What does the interference engine do in the rule/heuristic based IDS?It uses it's intelligent software to learn, when characteristics of an attack are met, they trigger warnings or notifications.
  111. 111What does an IPS do?It is responsible for preventing attacks.
  112. 112Can an IPS be network or host based?Both!
  113. 113What mode must the NIC be in for a network based IDS to work?Promiscuous mode
  114. 114What does NIDS stand for?Network intrusion detection system.
  115. 115What does HIDS stand for?Host intrusion detection system.
  116. 116NIDS can only monitor what activity?Network activity!
  117. 117HIDS can only monitor what activity?Host based activity.
  118. 118What is the difference between a HIDS and a NIDS?HIDS protects a single system while NIDS protects a network segment.
  119. 119What does a packet filtering firewall inspect?Only the header of a packet, looking for allowed IP addresses and ports.
  120. 120A packet filtering firewall is weak against what?IP Spoofing
    Attacks against applications
    Attacks depending on packet fragmentation.
    Or attacks taking advantage of the TCP handshake.
  121. 121What are some advantages to a stateful firewall?Aware of the order of the TCP handshake
    Keeps track of all connections
    Recognizes when packets entering the network don't make sense in terms of the TCP handshake.
  122. 122How does a stateful firewall work?It maintains a state table about all current connections and the status of each connection process.
  123. 123How does a proxy firewall work?A firewall that stands between each connection from the outside to the inside and makes a connection on their behalf.
  124. 124Circuit level proxies operate at what layer?5, Session layer
  125. 125Application level proxies perform what kind of inspection?Deep packet inspection.
  126. 126What is dynamic packet filtering?When an internal computer tries to make a connection with a remote PC, it places both the source and destination port numbers in the packet.
  127. 127How does dynamic filtering work?A PC will send a packet to the destination port and will randomly select a source port the firewall will create a rule allowing the connection dynamically.
  128. 128What does a kernel proxy firewall do?Inspects a packet at every layer of the OSI model.
  129. 129What is a bastion host?It is the position of any device if it is exposed directly to the internet or any untrusted network.
  130. 130What does Reducing the attack surface mean?Stopping all unnescessary services
    All unrequired ports are closed
    All security patches must be up to date.
  131. 131What is a dual homed firewallOne that has two network interfaces, one pointing to the internal network and the other to the untrusted network.
  132. 132What is the main issue with a dual homed firewall?It provides a single point of failure.
  133. 133What is a multi homed firewall?One with three interfaces.
    One to the internal
    One to the DMZ
    One to the untrusted network.
  134. 134What does DMZ stand for?Demilitarized zone.
  135. 135In networking terms, what does a DMZ do?It is the portion of the network that is access regularly from the untrusted network
  136. 136What is a screened subnet?It is a subnet between two firewalls.
  137. 137What is a Syslog server?A server that records all of the system logs from firewalls, routers and switches.
  138. 138What does NTP stand for?Network time protocol
  139. 139What does an NTP server do?Ensures proper sequencing of time from a single source.
  140. 140What does a passive vulnerability scanner do?Monitors network traffic at the packet layer
  141. 141What does PVS stand for?Passive vulnerability scanner.
  142. 142What can a passive vulnerability scanner determine?Topology, services, and vulnerabilities.
  143. 143What does AVS stand for?Active vulnerability scanner
  144. 144What does an active vulnerability scanner do?They can take action against an attack such as blocking a dangerous IP.

Informações

Descrição
IT Certs Computer Studies FlashCards sobre CSA Chapter 1, criado por Frank VonFriedland em 12-01-2019.
Visualizações
1
Avaliação

Fale Conosco

Sobre o que é sua mensagem?

O que você acha do novo visual?

Você gostou?