Podcast
Questions and Answers
In which two cases might an organization use PKI applications to securely exchange information between users? (Choose two)
In which two cases might an organization use PKI applications to securely exchange information between users? (Choose two)
- 802.1x authentication (correct)
- SMTP email service
- FTP file transfer
- HTTPS web service (correct)
Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?
Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?
Deploy a Cisco SSL Appliance.
Which three objectives must the BYOD security policy address? (Choose three)
Which three objectives must the BYOD security policy address? (Choose three)
- The level of access of employees when connecting to the corporate network must be defined. (correct)
- Safeguards must be put in place for any personal device being compromised. (correct)
- All personal devices must be registered with the IT department.
- Rights and activities permitted on the corporate network must be defined. (correct)
What type of attack targets an SQL database using the input field of a user?
What type of attack targets an SQL database using the input field of a user?
What are two characteristics of Ethernet MAC addresses? (Choose two)
What are two characteristics of Ethernet MAC addresses? (Choose two)
What conclusion can be drawn based on the connectivity test using the command 'ping 127.0.0.1' that returns four positive replies?
What conclusion can be drawn based on the connectivity test using the command 'ping 127.0.0.1' that returns four positive replies?
What characterizes a threat actor?
What characterizes a threat actor?
What type of malware presents a user with a screen requesting payment before data access?
What type of malware presents a user with a screen requesting payment before data access?
Which ICMPv6 message type provides network addressing information to hosts that use SLAAC?
Which ICMPv6 message type provides network addressing information to hosts that use SLAAC?
Which tool included in the Security Onion is a series of software plugins that send different types of data to the Elasticsearch data stores?
Which tool included in the Security Onion is a series of software plugins that send different types of data to the Elasticsearch data stores?
Which two types of unreadable network traffic could be eliminated from data collected by NSM? (Choose two)
Which two types of unreadable network traffic could be eliminated from data collected by NSM? (Choose two)
What is the core open source component of the Elastic-stack responsible for accepting data in its native format?
What is the core open source component of the Elastic-stack responsible for accepting data in its native format?
In the NIST incident response process life cycle, which type of attack vector involves the use of brute force?
In the NIST incident response process life cycle, which type of attack vector involves the use of brute force?
What is a characteristic of CybOX?
What is a characteristic of CybOX?
What are two ways that ICMP can be a security threat to a company? (Choose two)
What are two ways that ICMP can be a security threat to a company? (Choose two)
What are two problems that can be caused by a large number of ARP request and reply messages? (Choose two.)
What are two problems that can be caused by a large number of ARP request and reply messages? (Choose two.)
Which field in the Sguil application window indicates the priority of an event or set of correlated events?
Which field in the Sguil application window indicates the priority of an event or set of correlated events?
Match the job titles to SOC personnel positions:
Match the job titles to SOC personnel positions:
If the default gateway is configured incorrectly on the host, what is the impact on communications?
If the default gateway is configured incorrectly on the host, what is the impact on communications?
When a connectionless protocol is in use at a lower layer of the OSI model, how is missing data detected and retransmitted if necessary?
When a connectionless protocol is in use at a lower layer of the OSI model, how is missing data detected and retransmitted if necessary?
What is the prefix length notation for the subnet mask 255.255.255.224?
What is the prefix length notation for the subnet mask 255.255.255.224?
Which network monitoring tool saves captured network frames in PCAP files?
Which network monitoring tool saves captured network frames in PCAP files?
What is the TCP mechanism used in congestion avoidance?
What is the TCP mechanism used in congestion avoidance?
What is the Internet?
What is the Internet?
Which protocol is used by the traceroute command to send and receive echo-requests and echo-replies?
Which protocol is used by the traceroute command to send and receive echo-requests and echo-replies?
What are two ICMPv6 messages that are not present in ICMP for IPv4? (Choose two.)
What are two ICMPv6 messages that are not present in ICMP for IPv4? (Choose two.)
What are two monitoring tools that capture network traffic and forward it to network monitoring devices? (Choose two.)
What are two monitoring tools that capture network traffic and forward it to network monitoring devices? (Choose two.)
Which network monitoring tool is in the category of network protocol analyzers?
Which network monitoring tool is in the category of network protocol analyzers?
Based on the command output shown, which file permission or permissions have been assigned to the other user group for the data.txt file?
Based on the command output shown, which file permission or permissions have been assigned to the other user group for the data.txt file?
What are three benefits of using symbolic links over hard links in Linux? (Choose three.)
What are three benefits of using symbolic links over hard links in Linux? (Choose three.)
A network security specialist is tasked to implement a security measure that monitors the status of critical files in the data center. Which aspect of secure communications is addressed by this security measure?
A network security specialist is tasked to implement a security measure that monitors the status of critical files in the data center. Which aspect of secure communications is addressed by this security measure?
A network administrator is configuring a AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)
A network administrator is configuring a AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)
In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)
In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)
Which two types of messages are used in place of ARP for address resolution in IPv6? (Choose two.)
Which two types of messages are used in place of ARP for address resolution in IPv6? (Choose two.)
What is indicated by a true negative security alert classification?
What is indicated by a true negative security alert classification?
Normal traffic is correctly ignored and erroneous alerts are not being issued. What does this describe?
Normal traffic is correctly ignored and erroneous alerts are not being issued. What does this describe?
Match the description to the antimalware approach:
Match the description to the antimalware approach:
Which two protocols are associated with the transport layer? (Choose two.)
Which two protocols are associated with the transport layer? (Choose two.)
A network administrator is creating a network profile to generate a network baseline. What is included in the critical asset address space element?
A network administrator is creating a network profile to generate a network baseline. What is included in the critical asset address space element?
What are the three impact metrics contained in the CVSS 3.0 Base Metric Group? (Choose three.)
What are the three impact metrics contained in the CVSS 3.0 Base Metric Group? (Choose three.)
What is a characteristic of DNS?
What is a characteristic of DNS?
What are two differences between HTTP and HTTP/2? (Choose two.)
What are two differences between HTTP and HTTP/2? (Choose two.)
Match the step to the task performed by the router when sending a packet destined for a network in the routing table:
Match the step to the task performed by the router when sending a packet destined for a network in the routing table:
Which statement describes a typical security policy for a DMZ firewall configuration?
Which statement describes a typical security policy for a DMZ firewall configuration?
After complaints from users, a technician identifies that the college web server is running very slowly. What is the source of the problem?
After complaints from users, a technician identifies that the college web server is running very slowly. What is the source of the problem?
Which two statements describe access attacks? (Choose two.)
Which two statements describe access attacks? (Choose two.)
Which two actions can be taken when configuring Windows Firewall? (Choose two.)
Which two actions can be taken when configuring Windows Firewall? (Choose two.)
Which statement describes the state of the administrator and guest accounts after a user installs Windows desktop version to a new computer?
Which statement describes the state of the administrator and guest accounts after a user installs Windows desktop version to a new computer?
What is a purpose of entering the nslookup cisco.com command on a Windows PC?
What is a purpose of entering the nslookup cisco.com command on a Windows PC?
How is the event ID assigned in Sguil?
How is the event ID assigned in Sguil?
Which two types of network traffic are from protocols that generate a lot of routine traffic? (Choose two.)
Which two types of network traffic are from protocols that generate a lot of routine traffic? (Choose two.)
What are two elements that form the PRI value in a syslog message? (Choose two.)
What are two elements that form the PRI value in a syslog message? (Choose two.)
Which three pieces of information are found in session data? (Choose three.)
Which three pieces of information are found in session data? (Choose three.)
What kind of ICMP message can be used by threat actors to perform network reconnaissance and scanning attacks?
What kind of ICMP message can be used by threat actors to perform network reconnaissance and scanning attacks?
A flood of packets with invalid source IP addresses requests a connection on the network. What type of attack has occurred?
A flood of packets with invalid source IP addresses requests a connection on the network. What type of attack has occurred?
An attacker is redirecting traffic to a false default gateway in an attempt to intercept the data traffic of a switched network. What type of attack could achieve this?
An attacker is redirecting traffic to a false default gateway in an attempt to intercept the data traffic of a switched network. What type of attack could achieve this?
Users report that a database file on the main server cannot be accessed. What type of attack has the organization experienced?
Users report that a database file on the main server cannot be accessed. What type of attack has the organization experienced?
What two kinds of personal information can be sold on the dark web by cybercriminals? (Choose two.)
What two kinds of personal information can be sold on the dark web by cybercriminals? (Choose two.)
What three services are offered by FireEye? (Choose three.)
What three services are offered by FireEye? (Choose three.)
After containment, what is the first step of eradicating an attack?
After containment, what is the first step of eradicating an attack?
Which activity is typically performed by a threat actor in the installation phase of the Cyber Kill Chain?
Which activity is typically performed by a threat actor in the installation phase of the Cyber Kill Chain?
When dealing with a security threat and using the Cyber Kill Chain model, which two approaches can an organization use to help block potential exploitations on a system? (Choose two.)
When dealing with a security threat and using the Cyber Kill Chain model, which two approaches can an organization use to help block potential exploitations on a system? (Choose two.)
How does using HTTPS complicate network security monitoring?
How does using HTTPS complicate network security monitoring?
What are the two important components of a public key infrastructure (PKI) used in network security? (Choose two.)
What are the two important components of a public key infrastructure (PKI) used in network security? (Choose two.)
Which three algorithms are designed to generate and verify digital signatures? (Choose three.)
Which three algorithms are designed to generate and verify digital signatures? (Choose three.)
Which section of a security policy is used to specify that only authorized individuals should have access to enterprise data?
Which section of a security policy is used to specify that only authorized individuals should have access to enterprise data?
Refer to the exhibit. A cybersecurity analyst is viewing captured packets forwarded on switch S1. Which device has the MAC address d8:cb:8a:5c:d5:8a?
Refer to the exhibit. A cybersecurity analyst is viewing captured packets forwarded on switch S1. Which device has the MAC address d8:cb:8a:5c:d5:8a?
What kind of message is sent by a DHCPv4 client requesting an IP address?
What kind of message is sent by a DHCPv4 client requesting an IP address?
What is the responsibility of the human resources department when handling a security incident?
What is the responsibility of the human resources department when handling a security incident?
How does a security information and event management system (SIEM) in a SOC help the personnel fight against security threats?
How does a security information and event management system (SIEM) in a SOC help the personnel fight against security threats?
At which OSI layer is a source IP address added to a PDU during the encapsulation process?
At which OSI layer is a source IP address added to a PDU during the encapsulation process?
What is the purpose of CSMA/CA?
What is the purpose of CSMA/CA?
Why is DHCP preferred for use on large networks?
Why is DHCP preferred for use on large networks?
Which NIST incident response life cycle phase includes continuous monitoring by the CSIRT to quickly identify and validate an incident?
Which NIST incident response life cycle phase includes continuous monitoring by the CSIRT to quickly identify and validate an incident?
What will a threat actor do to create a back door on a compromised target according to the Cyber Kill Chain model?
What will a threat actor do to create a back door on a compromised target according to the Cyber Kill Chain model?
Which type of evidence supports an assertion based on previously obtained evidence?
Which type of evidence supports an assertion based on previously obtained evidence?
A technician is configuring email on a mobile device. Which email protocol should the technician use to synchronize folders between the mobile device and the server?
A technician is configuring email on a mobile device. Which email protocol should the technician use to synchronize folders between the mobile device and the server?
What is the goal of an attack in the installation phase of the Cyber Kill Chain?
What is the goal of an attack in the installation phase of the Cyber Kill Chain?
Which two statements are characteristics of a virus? (Choose two.)
Which two statements are characteristics of a virus? (Choose two.)
What is a characteristic of a Trojan horse as it relates to network security?
What is a characteristic of a Trojan horse as it relates to network security?
What technique is used in social engineering attacks?
What technique is used in social engineering attacks?
What is a purpose of implementing VLANs on a network?
What is a purpose of implementing VLANs on a network?
A cybersecurity analyst needs to collect alert data. What are three detection tools to perform this task in the Security Onion architecture? (Choose three.)
A cybersecurity analyst needs to collect alert data. What are three detection tools to perform this task in the Security Onion architecture? (Choose three.)
In network security assessments, which type of test is used to evaluate the risk posed by vulnerabilities to a specific organization?
In network security assessments, which type of test is used to evaluate the risk posed by vulnerabilities to a specific organization?
In addressing an identified risk, which strategy aims to shift some of the risk to other parties?
In addressing an identified risk, which strategy aims to shift some of the risk to other parties?
What is a network tap?
What is a network tap?
If a SOC has a goal of 99.999% uptime, how many minutes of downtime a year would be considered within its goal?
If a SOC has a goal of 99.999% uptime, how many minutes of downtime a year would be considered within its goal?
The HTTP server has responded to a client request with a 200 status code. What does this status code indicate?
The HTTP server has responded to a client request with a 200 status code. What does this status code indicate?
What is an advantage for small organizations of adopting IMAP instead of POP?
What is an advantage for small organizations of adopting IMAP instead of POP?
What debugging security tool can be used by black hats to reverse engineer binary files when writing exploits?
What debugging security tool can be used by black hats to reverse engineer binary files when writing exploits?
What is a property of the ARP table on a device?
What is a property of the ARP table on a device?
What is the purpose of Tor?
What is the purpose of Tor?
Which two network protocols can be used by a threat actor to exfiltrate data in traffic that is disguised as normal network traffic? (Choose two.)
Which two network protocols can be used by a threat actor to exfiltrate data in traffic that is disguised as normal network traffic? (Choose two.)
What is a key difference between the data captured by NetFlow and data captured by Wireshark?
What is a key difference between the data captured by NetFlow and data captured by Wireshark?
Which tool captures full data packets with a command-line interface only?
Which tool captures full data packets with a command-line interface only?
Which method can be used to harden a device?
Which method can be used to harden a device?
In a Linux operating system, which component interprets user commands and attempts to execute them?
In a Linux operating system, which component interprets user commands and attempts to execute them?
A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)
A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)
What is privilege escalation?
What is privilege escalation?
What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
An IT enterprise is recommending the use of PKI applications to securely exchange information between the employees.
An IT enterprise is recommending the use of PKI applications to securely exchange information between the employees.
Flashcards
Router Advertisement
Router Advertisement
A network discovery mechanism used in IPv6 networks to inform nodes about the presence of routers and network parameters.
Beats
Beats
A collection of lightweight data shippers that help send different types of data (logs, metrics, etc.) to Elasticsearch for analysis.
Unreadable Network Traffic
Unreadable Network Traffic
Network traffic that is encrypted and therefore cannot be read by standard tools.
Logstash
Logstash
Signup and view all the flashcards
Attrition
Attrition
Signup and view all the flashcards
CybOX
CybOX
Signup and view all the flashcards
Information Gathering
Information Gathering
Signup and view all the flashcards
Denial of Service (DoS) Attacks
Denial of Service (DoS) Attacks
Signup and view all the flashcards
Study Notes
ARP Requests and Local Network
- High volume of ARP requests creates network processing overhead for all local nodes.
- Flooding occurs due to ARP requests being broadcast to the entire subnet.
Security Operations Center (SOC) Personnel
- Tier 1 Alert Analyst: Monitors incoming alerts and verifies incidents.
- Tier 2 Incident Responder: Conducts in-depth investigation of incidents.
- Tier 3 Subject Matter Expert: Engages in threat hunting and implements detection tools.
Network Communication Issues
- Incorrect default gateway prevents communication with remote networks while allowing local communication.
Data Detection and Retrospection
- Connectionless protocols rely on upper-layer connection-oriented protocols to detect missing data and request retransmissions.
Internet Routing and Protocols
- Prefix length notation for subnet mask 255.255.255.224 is /27.
- Traceroute utilizes ICMP for echo requests and replies.
- Neighbor Solicitation and Router Advertisement messages are unique to ICMPv6.
Network Monitoring Tools
- Wireshark is identified as a protocol analyzer that captures network frames in PCAP files.
- SPAN and network tap are monitoring tools that capture and forward traffic.
TCP and Network Security
- Sliding window is used in TCP for congestion avoidance.
- Ransomware encrypts files and demands payment for access.
Cyber Security Practices
- TACACS+ provides encrypted communication and separates authentication from authorization processes.
- Sharing indicators of compromise among cyber analysts enhances detection and prevention.
Network Traffic Management
- ICMP messages like neighbor solicitation and advertisement function in IPv6 for address resolution.
- HTTP/2 improves efficiency with multiplexing and header compression compared to HTTP.
Security Incident Responses
- True negative security alerts indicate correct identification of normal traffic.
- Security policies define authorized access to enterprise data.
Cyber Kill Chain Model
- Back doors are created for future access in the installation phase post-compromise.
- Risk analysis evaluates vulnerabilities and their impact on organizations.
Data Exfiltration and Threat Actors
- DNS and HTTP can be misused by threat actors for data exfiltration.
- Identifying and verifying incidents involves continuous monitoring in incident response.
Public Key Infrastructure (PKI)
- Digital certificates and certificate authorities are essential components of PKI in network security.
Common Malware Characteristics
- Viruses require user activation, can remain dormant, and activate later.
- Trojans disguise malware within legitimate-looking programs.
Email Configuration and Protocols
- IMAP allows synchronization of emails across devices while retaining originals on the server.
Network Access Control
- Risk sharing shifts some risk to other parties and can help mitigate threats in network infrastructure.
Traffic Analysis and Monitoring Tools
- Network taps passively forward all traffic for analysis and capture metadata for understanding flow dynamics.
System Hardening Techniques
- Disabling root access over SSH and implementing SSH for secure remote access are essential for hardening devices.
Personal Security Awareness
- BYOD policies must define user rights, safeguard personal devices, and regulate access levels to corporate networks.
Cybersecurity Threat Impacts
- SQL injection attacks exploit input fields to manipulate databases.
- Corroborating evidence supports claims with supplementary facts.
Final Insights
- Effective security monitoring against SSL-encrypted traffic requires specialized tools like Cisco SSL Appliances.
- Networking reliability is gauged by uptime metrics, aiming for minimal yearly downtime, around 5 minutes for high availability goals.### Network Security Concepts
- Router Advertisement: A network discovery mechanism used in IPv6 networks to inform nodes about the presence of routers and network parameters.
Tools in Security Onion
- Beats: A collection of lightweight data shippers that help send different types of data (logs, metrics, etc.) to Elasticsearch for analysis.
Network Traffic and Data Collection
- Unreadable Network Traffic:
- IPsec Traffic: Encrypted traffic that secures Internet Protocol communications, often eliminating visibility into the data.
- SSL Traffic: Encrypted traffic using Secure Sockets Layer for secure communication over a computer network, making the data unreadable.
Log Management
- Logstash: A core open-source component of the Elastic Stack that processes and transforms data from various sources, making data consistent for analysis.
Incident Response Processes
- Attrition: An attack vector characterized by using brute force techniques to compromise devices, networks, or services.
Cyber Threat Intelligence
- CybOX: A standardized framework that helps in specifying, capturing, characterizing, and communicating cybersecurity events and properties related to network operations.
ICMP Security Threats
- Information Gathering: ICMP can be exploited to gather information about network structure and devices, revealing potential vulnerabilities.
- Denial of Service (DoS) Attacks: ICMP can facilitate DoS attacks by overwhelming targeted systems with traffic, affecting network availability.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
This quiz features flashcards designed for the CyberOps Associate 1.0 final exam. It covers key concepts such as ARP messages and event prioritization in network security tools. Test your knowledge and prepare for your certification with these essential questions.
