General Information Quiz

A reconnaissance attack aims to gather information about a network's devices and accessibility to plan further attacks or exploits.

A network attack that overwhelms a system by sending a high volume of SYN requests, preventing legitimate users from connecting.

Cisco Span mirrors network traffic from one port or VLAN to another for analysis without affecting the original traffic flow.

SOAR (Security Orchestration, Automation, and Response) automates incident response, analyzes events, and provides incident response procedures.

A coordinated attack from a botnet of compromised computers to overwhelm a target system and disrupt service.

A cybersecurity attack that depletes the pool of available IP addresses to prevent legitimate devices from obtaining IP addresses.

A network monitoring solution used to analyze network traffic and provide services for user access control.

A proprietary Security Information and Event Management (SIEM) system.

To find and report vulnerabilities, not to exploit them.

A vulnerability scanner used to discover weaknesses in computer systems.

Provides an audit trail of IP flows and statistics about network traffic.

An attack where a malicious actor intercepts and controls communication between two parties.

Social engineering, tricking a user into revealing sensitive information.

To capture traffic from multiple VLANs by disguising the attacker's device.

Automatic sharing of cybersecurity information between public and private organizations.

A tool that identifies security weaknesses in a system.

A standard for communicating cyber threat information, allowing for real-time exchange of threat indicators between organizations.

Ensuring secure access for applications or services like APIs, microservices, or containers when they connect to databases.

Tracking and logging user actions and resource access to monitor network activity.

The process of verifying the identity of a user or device.

The process of determining what resources a user or device is allowed to access.

A security approach that uses multiple layers of protection to safeguard data and systems.

Having multiple security layers makes it harder for attackers to penetrate all defenses, increasing overall security.

Even if one security layer fails, the other layers continue to protect the system.

A network protocol used for centralized authentication, authorization, and accounting (AAA) for users accessing network services. It uses UDP ports for communication and encrypts only the password for security.

Physical or digital tokens used for authentication by providing a unique, time-dependent code or factor to verify user identity.

An access control model where access rights are assigned based on predefined roles and responsibilities, rather than individual ownership of data.

The strictest access control model where access rights are assigned and enforced based on predefined security labels, typically used in high-security environments.

An access control model that evaluates access based on attributes of the user, the object, or the environment.

The process of converting data into an unreadable format to protect its confidentiality during transmission or storage.

Categorization of digital certificates based on their intended purpose and trust level. Lower class numbers generally indicate higher trust levels.

Digital signatures used to verify the integrity of executable files downloaded from a vendor website. This ensures that the file hasn't been tampered with and is authentic.

PKI certificates are issued by trusted third-party entities to verify the identity of individuals or organizations. They are used in various online security applications, such as email encryption and online banking.

This metric assesses how easy it is for an attacker to exploit a vulnerability. It considers factors like the complexity of the attack and whether user interaction is required.

A risk management strategy where an organization accepts the potential consequences of a risk, often because the cost of mitigation outweighs the potential impact.

A type of security test that scans internal networks and internet-facing servers for vulnerabilities. It identifies weaknesses that could be exploited by attackers.

The NIST Cybersecurity Framework identifies three core functions: Identify, Protect, and Detect.

Recommendations for enhancing security on devices like computers, laptops, and mobile phones. They aim to protect against various threats and vulnerabilities.

The CVSS Base Metric Group includes two classes of metrics: Exploitability and Impact.

Sguil uses categories to classify security events. 'Below 3464' refers to a category for events considered less critical and may require further analysis.

A security alert triggered by a security tool, but it's not actually a real threat.

A security alert triggered by a security tool, and it's actually a real threat.

A security tool fails to detect a real threat.

A security tool correctly identifies that there's no threat.

Examining past security events to understand how a malware attack happened and how to prevent similar incidents.

The Sguil interface displays security events. It shows the priority of events using a field called 'Pr'.

The initial phase of an attack where attackers gather information about a target, like employee contacts and network details.