Cybersecurity Incident and Network Basics
48 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What must be obtained before reproducing or distributing contents from this document?

  • No permission required
  • Verbal agreement
  • Public domain rights
  • Express prior written permission (correct)

    • Which part of an HTTP URI specifies the protocol used?

  • Scheme (correct)
  • Query
  • Path
  • Host

    • What is the default port for HTTP requests?

  • 8080
  • 21
  • 80 (correct)
  • 443

    • In what scenario would a POST request be more suitable than a GET request?

    <p>To send a signup form (D)</p> Signup and view all the answers

    What component follows the path in an HTTP URI and allows passing parameters?

    <p>Query (A)</p> Signup and view all the answers

    Which of the following HTTP methods is NOT commonly implemented by servers?

    <p>SEND (D)</p> Signup and view all the answers

    What do HTTP headers consist of?

    <p>Multiple key-value pairs (B)</p> Signup and view all the answers

    Which part of a query string is used by Google to represent what is being searched?

    <p>q parameter (C)</p> Signup and view all the answers

    What is displayed in the first pane of the Wireshark interface?

    <p>Captured frames sorted by time (C)</p> Signup and view all the answers

    Which protocols can be encapsulated within a frame as shown in the second pane?

    <p>Ethernet, IPv4, TCP, and HTTP (C)</p> Signup and view all the answers

    What type of data representation is provided in the third pane of Wireshark?

    <p>Combined textual and hexadecimal representation (B)</p> Signup and view all the answers

    How is hexadecimal data represented in Wireshark?

    <p>By converting 4 bits to a single character from 0 to F (C)</p> Signup and view all the answers

    What is the purpose of using the display filter in Wireshark?

    <p>To filter frames based on specific criteria (C)</p> Signup and view all the answers

    What would the filter 'ip.dst == 192.168.1.3' achieve in Wireshark?

    <p>It only displays frames with a specific destination IP address (D)</p> Signup and view all the answers

    Which logical operators can be combined with filters in Wireshark?

    <p>AND/OR (D)</p> Signup and view all the answers

    Which of the following best describes the overall functionality of Wireshark?

    <p>To capture and analyze network traffic in real-time (D)</p> Signup and view all the answers

    What is the format of an IP address?

    <p>Four groups of numbers from 0 to 255 (C)</p> Signup and view all the answers

    What does the broadcast IP address typically end with?

    <p>.255 (A)</p> Signup and view all the answers

    Which of the following ranges represents multicast IP addresses?

    <p>224.0.0.0 to 224.0.0.255 (A)</p> Signup and view all the answers

    What should be true for an IP address to be classified as public?

    <p>It must be assigned uniquely to a certain device (A)</p> Signup and view all the answers

    What is the significance of private IP addresses?

    <p>They can be duplicated in different networks. (D)</p> Signup and view all the answers

    Which of the following is NOT a range of private IP addresses?

    <p>200.100.0.0 – 200.100.255.255 (A)</p> Signup and view all the answers

    What must protocols in a network contain to reach their intended recipient?

    <p>An IP address and specific addressing information (B)</p> Signup and view all the answers

    What happens to a device that subscribes to a multicast address?

    <p>It can accept messages sent to that multicast IP. (D)</p> Signup and view all the answers

    What is the primary purpose of the 'User Agent' header?

    <p>To convey information about the requesting client. (B)</p> Signup and view all the answers

    What does a User Agent string allow the server to do?

    <p>Respond differently based on the type of client accessing the server. (D)</p> Signup and view all the answers

    Which component is NOT typically included in a User Agent string?

    <p>Client's geographical location (A)</p> Signup and view all the answers

    What should one do with the document without express prior written permission from Red Alpha Cybersecurity?

    <p>Manufacture or sell any products described in it. (A), Store it in a publicly accessible archive. (C), Reproduce, disclose, or distribute its contents. (D)</p> Signup and view all the answers

    What information does the HTTP response provide?

    <p>Whether the request was handled successfully. (C)</p> Signup and view all the answers

    What is the effect of HTTP response codes?

    <p>They indicate the success or failure of an HTTP request. (C)</p> Signup and view all the answers

    What type of document is described in the content?

    <p>Proprietary document. (A)</p> Signup and view all the answers

    Why is the information extracted from a User Agent string valuable?

    <p>It helps analyze HTTP network traffic and understand client devices. (B)</p> Signup and view all the answers

    What is the significance of a public IP address for an internet network?

    <p>It enables a device to be accessible via the Internet. (C)</p> Signup and view all the answers

    Which of the following statements about MAC addresses is true?

    <p>The first three groups of a MAC address identify the manufacturer. (B)</p> Signup and view all the answers

    What is the format of a Broadcast MAC address?

    <p>FF-FF-FF-FF-FF-FF (C)</p> Signup and view all the answers

    Why are port numbers important in network communication?

    <p>They identify specific running applications that can receive packets. (C)</p> Signup and view all the answers

    Which of the following correctly describes multicast MAC addresses?

    <p>They start with a specific prefix, such as 01-80-C2. (B)</p> Signup and view all the answers

    What is an OUI in the context of MAC addresses?

    <p>The first three groups of a MAC address indicating the manufacturer. (C)</p> Signup and view all the answers

    What happens if a device has a private IP address?

    <p>It cannot be reached via the Internet. (C)</p> Signup and view all the answers

    In a valid MAC address format, which components can represent the values?

    <p>Digits 0-9 and letters A-F. (A)</p> Signup and view all the answers

    What is the main purpose of DNS in internet browsing?

    <p>To translate domain names into IP addresses (D)</p> Signup and view all the answers

    What type of query does a DNS client send to get an IP address?

    <p>DNS request (B)</p> Signup and view all the answers

    What does a DNS reply include in its response?

    <p>The request and the corresponding IP address (C)</p> Signup and view all the answers

    In the context of online gaming, how does DNS function?

    <p>It assists in locating the game server by resolving its domain name (A)</p> Signup and view all the answers

    Which statement is true regarding DNS queries and HTTPS communications?

    <p>DNS queries reveal which sites are visited before an HTTPS request. (A)</p> Signup and view all the answers

    How does the structure of a DNS reply differ from a DNS query?

    <p>It contains the original query along with the answer. (A)</p> Signup and view all the answers

    What is indicated when a computer shuts down while browsing and a network sniffer is running?

    <p>The sniffer can capture traffic only when the computer is on. (C)</p> Signup and view all the answers

    Why is DNS crucial for human usability in Internet browsing?

    <p>It translates complicated domain names into user-friendly formats. (A)</p> Signup and view all the answers

    Study Notes

    Cybersecurity Incident Basics

    • Every cybersecurity incident starts with a motivated attacker.
    • Attackers' motives can include money, power, fame, or revenge.
    • Targets can be individuals, companies, organizations, or countries.
    • Internet-connected networks are often used for attacks.
    • Malware infection and control are intermediate steps for attackers.
    • Attackers often extract data through the same network they used for the attack.
    • Network forensics helps understand attack origins, data leaks, and attackers' motives.

    Network Packets and Protocols

    • Network packets carry various types of information similarly to letters.
    • Envelopes in a network are called packets, and the information type is referred to as the application protocol.
    • Addresses (IP and MAC) in networks ensure correct recipient delivery.
    • IP addresses are four-part number groups (0-255) and are network-dependent.
    • Broadcast IP addresses are meant for all network devices, while multicast addresses are targeted.
    • Private IP addresses (e.g. 10.0.0.0-10.255.255.255, 192.168.0.0-192.168.255.255, 172.16.0.0-172.31.255.255) are not unique to a specific device.
    • Public IP addresses must be unique.
    • MAC addresses are unique to network hardware and cannot be changed.

    MAC Addresses and Special Addresses

    • MAC addresses are fixed hardware addresses in a specific format (XX-XX-XX-XX-XX-XX).
    • Organization Unique Identifiers (OUIs) identify manufacturers.
    • Broadcast MAC addresses (FF-FF-FF-FF-FF-FF) will be received by all devices on a network.
    • Multicast MAC addresses start with a specific prefix and are used for specific communication.

    Ports and Application Protocols

    • Port numbers range from 1 to 65,535 and identify specific applications.
    • They allow network packets to be routed to the correct application.
    • Popular Protocols: HTTP, DNS, TCP
    • HTTP servers are located on ports 80 or 443.
    • DNS translates domain names to IP addresses.

    Network Packet Analysis with Wireshark

    • Wireshark is a network traffic monitoring and analysis tool.
    • It logs network traffic, including malicious activity, and allows offline analysis of packet capture files (PCAP).
    • It can analyze network traffic in real-time or through existing PCAP files.

    Wireshark Analysis

    • Wireshark displays captured frames categorized by protocols (Ethernet, IP, TCP, HTTP).
    • It enables sorting, filtering, and focusing on specific data by protocol and address.
    • Filters like ip.dst == [IP address] allow targeting specific network traffic based on destination IP

    HTTP Protocols

    • HTTP is a client/server protocol where clients send requests, and servers respond.
    • HTTP requests include the type of request, desired resources, or commands.
    • HTTP headers provide additional information about the request.
    • Common header fields include "User-Agent," which reveals client information (e.g., browser, OS).
    • HTTP responses indicate whether a request was successful (e.g., 200 OK), redirected, or resulted in a client or server error.
    • HTTP protocol uses numbered codes to report success or failure.

    DNS Lookups

    • DNS translates domain names to IP addresses.
    • DNS servers help resolve domain names to IP addresses during internet browsing.
    • DNS requests are typically sent before HTTP requests.

    Guided Example

    • John's network investigation involves examining IP addresses, MAC addresses, operating systems, and browsers, examining a PCAP file, using Wireshark's statistical tools.
    • Public and private IPs are identified and special IPs (e.g., broadcast and multicast) are separated out
    • MAC addresses and their associated OUI (Organization Unique Identifier) groups are examined as real devices or broadcast addresses/multicast are separated.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Network Forensics Tutorial PDF

    Description

    Explore the fundamentals of cybersecurity incidents and understand the importance of network packets and protocols. This quiz covers motivations behind attacks, the role of malware, and the use of network forensics. Test your knowledge on how addresses work within networks and the types of information carried by packets.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser