Security + quiz 1

A type of threat actor who is often hired by governments to conduct cyberattacks against other nations. They are highly skilled and often have access to advanced resources and tools.

A technique used to enhance the security of one-way hashing algorithms by adding a random value to the input data before hashing. This makes it more challenging for attackers to reverse the hash and obtain the original data.

A type of social engineering attack where attackers create fake websites that closely resemble legitimate online services to trick victims into providing their login credentials and other sensitive information.

A firewall Access Control List (ACL) rule that allows outbound DNS traffic ONLY for a specific IP address, preventing other devices on the network from making DNS requests.

A method that enables users to access multiple applications using a single set of credentials, eliminating the need for separate logins. This simplifies user authentication and improves security by reducing the number of passwords users need to manage.

A type of cyberattack that targets organizations by compromising and manipulating their email communications. Attackers gain unauthorized access to email accounts and send fraudulent emails to unsuspecting recipients, often impersonating executives or other trusted individuals within the organization.

A vulnerability that is specific to the hardware of a device, meaning it exploits flaws in the hardware design or implementation rather than software vulnerabilities.

A type of attack that injects malicious code into a web application to exploit vulnerabilities in the application's database layer.

A type of data center that provides a basic infrastructure with limited resources, often requiring the organization to bring their own equipment and resources. It is suitable for situations with longer recovery times (RTO) and data loss (RPO) tolerance.

A data center that provides a balance between cost and functionality, offering equipment and IT infrastructure, but not fully operational. This site typically has shorter recovery times (RTO) than a cold site.

A security policy that blocks all traffic by default, often used as the last rule in a firewall ACL. It can help prevent unexpected or unauthorized traffic.

Hypervisor is a software that creates and manages virtual machines, enabling a single physical computer to run multiple operating systems or applications as if each one was on a separate machine.

Blocking access to HTTP websites helps prevent connections to unencrypted web services. This can be achieved by filtering URL strings containing "http://" to restrict connections to those using HTTPS.

Firewalls define rules for network traffic. To block a malicious IP address you add a rule that denies all inbound connections from that specific IP address.

A bastion host is a computer specifically configured to be hardened and act as a gateway between the internet and the internal network. It provides a secure point of entry and helps minimize the attack surface by limiting access to only essential services.

Endpoint logs are essential for security investigations, providing details about executed programs and their associated events. This helps to understand the activity of a specific device and identify any malicious behavior.

Threat hunting is a proactive security practice involving proactive searching for threats and vulnerabilities, even if there are no immediate alerts. This helps to identify potential threats before they can exploit vulnerabilities.

Cyber insurance is considered a risk transfer strategy. It acts as a financial safety net, covering potential losses caused by cyberattacks, enabling organizations to financially recover from breaches.

Full disk encryption protects all data stored on a drive, ensuring that access to the device doesn't grant access to the data. This protects data even if a device is lost or stolen.

Acceptable use policies (AUPs) are documents outlining how devices and network resources can be used responsibly. They act as a preventive control by setting expectations and establishing rules of conduct.

The principle of least privilege means granting users only the permissions necessary to perform their assigned tasks. This reduces the potential impact of a compromise by limiting access to sensitive data.

A risk register is a document that lists and documents potential risks, the responsibility for managing each risk, and the thresholds or levels of acceptable risk tolerance.

Change management procedures are essential before implementing any changes to critical systems, particularly firewalls. They help to ensure controlled implementation, minimize disruptions, and reduce security risks.

Bug bounty programs reward security researchers for finding and reporting vulnerabilities in a company's systems. It provides a way to crowdsource security testing and incentivize ethical hacking.

Nation-state actors are highly sophisticated threat actors often backed by governments. They have access to significant resources and technical capabilities, and their motives can be political or economic espionage.

SQL injection is a code injection technique that uses malicious SQL statements to manipulate data or gain unauthorized access to databases. It exploits vulnerabilities in application code that interacts with databases.

Attaching asset inventory stickers to laptops and associating them with employee IDs aids in quickly identifying a device's owner, ensuring appropriate security policies are applied and facilitating communication regarding security incidents.

A periodic security reminder, a new hire documentation update, and a recurring training modification all aim to enhance user awareness; however, recurring training is the most effective option for continuously reinforcing security best practices with existing users.

Dashboards are used to visualize security data efficiently, providing a clear and concise overview of incident data to the board of directors.

A rootkit is a type of malware that conceals its presence and changes system files. This unauthorized modification of the cmd.exe file, coupled with the absence of recent patches, strongly indicates a rootkit infection.

In an Infrastructure-as-a-Service (IaaS) model, the client is responsible for securing the database, including configuration, access management, and data protection.

A Statement of Work (SOW) is a legally binding document outlining a project's details, including scope, timelines, deliverables, and cost, ensuring clear communication and expectations between the client and the security company.

Input validation is a crucial application security technique that prevents cross-site scripting (XSS) attacks by filtering and sanitizing user inputs to remove malicious scripts that could be injected into the application.

High-availability networks emphasize ease of recovery and responsiveness. They ensure minimal downtime and rapid restoration of services by employing redundant components and efficient failover mechanisms.

Before applying any high-priority patch, a change control request must be submitted and approved to ensure proper documentation, communication, and risk assessment before implementing the patch, safeguarding infrastructure stability.

Root cause analysis is performed during incident response to discover the underlying issue that caused the incident, enabling effective remediation and prevention of similar events in the future.

Failing an internal PCI DSS compliance assessment might lead to audit findings, highlighting areas needing improvement. It can also involve potential fines or sanctions if the noncompliance is severe.

Capacity planning is determining the necessary resources, including staff, to maintain business operations during a disruption. It ensures sufficient personnel are available to continue critical functions.

A geolocation policy restricts access to sensitive data based on the user's geographical location. This helps prevent unauthorized access from high-risk regions.

Phishing is a type of social engineering attack where attackers impersonate legitimate entities to trick users into revealing sensitive information. The attacker may send an email, text message, or phone call that appears to be from a trusted source, such as a bank or government agency. The message will often include a link to a phishing website that looks just like the real one. If the user clicks on the link and enters their credentials, the attacker will be able to steal their information.

A jump server is a secure server that acts as an intermediary between an administrator's workstation and the database servers. This server allows administrators to connect to the database servers without giving them direct access to the network segment where the database servers are located. This prevents attackers from exploiting any vulnerabilities on the administrator's workstation to gain access to the database servers.

A web application firewall (WAF) is a software application that protects websites from attacks that target web applications. A WAF can identify and block attacks such as cross-site scripting (XSS), SQL injection, and buffer overflows. By analyzing incoming requests, it can detect and block malicious traffic.

Multi-factor authentication (MFA) is a security measure that requires users to provide two or more forms of authentication before they can access an account. This helps to prevent unauthorized access to accounts, even if attackers have stolen a user's username and password. For example, if a user has a password they must also enter a code sent to their phone.

Smishing is a type of phishing attack that uses text messages to deceive users. Attackers impersonate a trusted source, like a bank or credit card company, and send text messages asking for sensitive information, such as account numbers or passwords. Users may be tricked into believing the text message is legitimate.

Impersonation is a form of social engineering attack, where attackers pretend to be someone else. They might try to convince victims they are from a trusted source or have a specific role. They might use this to gain access to sensitive information, manipulate decisions, or gain access to systems.

A supply chain analysis is a process of identifying and assessing the risks associated with a company's supply chain. This process involves evaluating the suppliers, manufacturers, and distributors that a company works with to identify potential vulnerabilities. The aim is to make sure that the company is not using counterfeit hardware or software, and that its supply chain is reliable and trustworthy.

The rules of engagement (ROE) are a document that outlines the scope and limitations of a penetration test. It includes things like what parts of the network can be tested, what types of tools can be used, and when the tester can stop the test. They are crucial for defining the objectives and boundaries of the test, ensuring the tester has a clear scope and the client understands what to expect.

Active reconnaissance is a type of reconnaissance that involves interacting with the target system in order to gather information. Common active reconnaissance techniques include port scans, banner grabbing, and vulnerability scanning. They can help testers understand the system's services and discover potential vulnerabilities.

A disaster recovery plan (DRP) is a document that outlines how an organization will recover its IT systems and data in the event of a disaster. This plan involves setting up processes for restoring backup data, relocating IT equipment, and communicating with employees and customers. It's important because it helps the organization to quickly recover from a disaster and minimize business disruption.

Side-loading is the process of installing software on a device from a source other than the official app store or manufacturer-approved repository. This can be a security risk because the software may not have been vetted for malware. It may introduce vulnerabilities or bypass security measures.

Password spraying is a type of brute-force attack that involves using a list of common passwords against multiple accounts. Instead of trying all possible combinations for each account, the attacker cycles through a small set of known passwords against many accounts hoping to get lucky. By targeting a few accounts at a time, it can avoid detection by security systems.

Subject role is a method of securing access by grouping users and their permissions based on their role within the organization. It limits access based on the required permissions for the job, not just individual users. This helps to reduce the risk of unauthorized access from different employees.

A jump server acts as a secure intermediary between an administrator's workstation and a restricted network segment. Instead of giving direct access to the restricted segment, the administrator connects to the jump server first, then uses the jump server to access the target resources. This keeps the administrator's workstation isolated from the restricted network segment, reducing the potential for compromise.