General Information Quiz

<p>Protecting systems from vulnerabilities (C)</p> Signup and view all the answers

<p>Encryption of the password only (A), Encryption of the entire body of the packet (C)</p> Signup and view all the answers

<p>To support the Automated Information Sharing (AIS) (C)</p> Signup and view all the answers

<p>Phishing attempt (B)</p> Signup and view all the answers

<p>Authentication (D)</p> Signup and view all the answers

<p>Access control based on roles and responsibilities (D)</p> Signup and view all the answers

<p>To capture traffic from multiple VLANs (B)</p> Signup and view all the answers

<p>Provides real-time packet analysis (C)</p> Signup and view all the answers

<p>Mandatory access control (MAC) (B)</p> Signup and view all the answers

<p>Authentication factors (A)</p> Signup and view all the answers

<p>Relies on UDP ports for authentication and accounting (A)</p> Signup and view all the answers

<p>Class 0 (A)</p> Signup and view all the answers

<p>Encryption (A)</p> Signup and view all the answers

<p>It helps in tracking the behavior of the malware. (A)</p> Signup and view all the answers

<p>Reconnaissance (B)</p> Signup and view all the answers

<p>OSSEC (C)</p> Signup and view all the answers

<p>True positive (C)</p> Signup and view all the answers

<p>Sguil (C)</p> Signup and view all the answers

<p>Event priority (D)</p> Signup and view all the answers

<p>Initial access vector (B)</p> Signup and view all the answers

<p>Creation of community rules (B)</p> Signup and view all the answers

<p>Network operations properties (A)</p> Signup and view all the answers

<p>Container (A), API (C), Microservice (D)</p> Signup and view all the answers

<p>To determine resource access for users (C)</p> Signup and view all the answers

<p>Accounting (B)</p> Signup and view all the answers

<p>Each layer must be penetrated to access target data (C)</p> Signup and view all the answers

<p>Three or more devices are required (C)</p> Signup and view all the answers

<p>Multiple safeguards can protect against failures (C)</p> Signup and view all the answers

<p>Continuous verification is required (A)</p> Signup and view all the answers

<p>To scan for accessibility (C), To gather information about the network and devices (D)</p> Signup and view all the answers

<p>SYN flooding (A)</p> Signup and view all the answers

<p>It mirrors traffic for analysis on another port (D)</p> Signup and view all the answers

<p>StealthWatch (A)</p> Signup and view all the answers

<p>Uses artificial intelligence for incident detection (B), Automates complex incident response procedures (C), Presents correlated and aggregated event data in real-time (D)</p> Signup and view all the answers

<p>DDoS (C)</p> Signup and view all the answers

<p>DHCP starvation (C)</p> Signup and view all the answers

<p>To identify vulnerabilities for exploitation (D)</p> Signup and view all the answers

<p>To verify the integrity of executable files (A)</p> Signup and view all the answers

<p>Public Key Infrastructure (PKI) certificates (A)</p> Signup and view all the answers

<p>Exploitability (B)</p> Signup and view all the answers

<p>Risk retention (A)</p> Signup and view all the answers

<p>Impact metrics and Exploit Code Maturity (A), Impact metrics and Modified Base (C)</p> Signup and view all the answers

<p>Vulnerability assessment (A)</p> Signup and view all the answers

<p>Identify, protect, detect (C)</p> Signup and view all the answers

<p>Implementing multi-factor authentication (B)</p> Signup and view all the answers

A reconnaissance attack aims to gather information about a network's devices and accessibility to plan further attacks or exploits.

A network attack that overwhelms a system by sending a high volume of SYN requests, preventing legitimate users from connecting.

Cisco Span mirrors network traffic from one port or VLAN to another for analysis without affecting the original traffic flow.

SOAR (Security Orchestration, Automation, and Response) automates incident response, analyzes events, and provides incident response procedures.

A coordinated attack from a botnet of compromised computers to overwhelm a target system and disrupt service.

A cybersecurity attack that depletes the pool of available IP addresses to prevent legitimate devices from obtaining IP addresses.

A network monitoring solution used to analyze network traffic and provide services for user access control.

A proprietary Security Information and Event Management (SIEM) system.

To find and report vulnerabilities, not to exploit them.

A vulnerability scanner used to discover weaknesses in computer systems.

Provides an audit trail of IP flows and statistics about network traffic.

An attack where a malicious actor intercepts and controls communication between two parties.

Social engineering, tricking a user into revealing sensitive information.

To capture traffic from multiple VLANs by disguising the attacker's device.

Automatic sharing of cybersecurity information between public and private organizations.

A tool that identifies security weaknesses in a system.

A standard for communicating cyber threat information, allowing for real-time exchange of threat indicators between organizations.

Ensuring secure access for applications or services like APIs, microservices, or containers when they connect to databases.

Tracking and logging user actions and resource access to monitor network activity.

The process of verifying the identity of a user or device.

The process of determining what resources a user or device is allowed to access.

A security approach that uses multiple layers of protection to safeguard data and systems.

Having multiple security layers makes it harder for attackers to penetrate all defenses, increasing overall security.

Even if one security layer fails, the other layers continue to protect the system.

A network protocol used for centralized authentication, authorization, and accounting (AAA) for users accessing network services. It uses UDP ports for communication and encrypts only the password for security.

Physical or digital tokens used for authentication by providing a unique, time-dependent code or factor to verify user identity.

An access control model where access rights are assigned based on predefined roles and responsibilities, rather than individual ownership of data.

The strictest access control model where access rights are assigned and enforced based on predefined security labels, typically used in high-security environments.

An access control model that evaluates access based on attributes of the user, the object, or the environment.

The process of converting data into an unreadable format to protect its confidentiality during transmission or storage.

Categorization of digital certificates based on their intended purpose and trust level. Lower class numbers generally indicate higher trust levels.

Digital signatures used to verify the integrity of executable files downloaded from a vendor website. This ensures that the file hasn't been tampered with and is authentic.

PKI certificates are issued by trusted third-party entities to verify the identity of individuals or organizations. They are used in various online security applications, such as email encryption and online banking.

This metric assesses how easy it is for an attacker to exploit a vulnerability. It considers factors like the complexity of the attack and whether user interaction is required.

A risk management strategy where an organization accepts the potential consequences of a risk, often because the cost of mitigation outweighs the potential impact.

A type of security test that scans internal networks and internet-facing servers for vulnerabilities. It identifies weaknesses that could be exploited by attackers.

The NIST Cybersecurity Framework identifies three core functions: Identify, Protect, and Detect.

Recommendations for enhancing security on devices like computers, laptops, and mobile phones. They aim to protect against various threats and vulnerabilities.

The CVSS Base Metric Group includes two classes of metrics: Exploitability and Impact.

Sguil uses categories to classify security events. 'Below 3464' refers to a category for events considered less critical and may require further analysis.

A security alert triggered by a security tool, but it's not actually a real threat.

A security alert triggered by a security tool, and it's actually a real threat.

A security tool fails to detect a real threat.

A security tool correctly identifies that there's no threat.

Examining past security events to understand how a malware attack happened and how to prevent similar incidents.

The Sguil interface displays security events. It shows the priority of events using a field called 'Pr'.

The initial phase of an attack where attackers gather information about a target, like employee contacts and network details.