Network Security and Incident Response
48 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which data type is protected through hard disk encryption?

  • Data at rest (correct)
  • Data in process
  • Data in use
  • Data in transit

    • Which protocol should you use to encrypt configuration files in transit over an unsecured network?

  • TFTP
  • SSH (correct)
  • Telnet
  • HTTP

    • What does a Warning severity message from a DNS server indicate?

  • The server has a hardware error that does not require immediate attention
  • The DNS server is unusable due to a severe malfunction and is shutting down
  • An error condition is occurring that must be addressed immediately (correct)
  • A condition exists that will cause errors in the future if the issue is not fixed

    • Where should you go to view the scan result after completing a full scan of a Windows 10 PC?

    <p>Windows Security</p> Signup and view all the answers

    What action should you take to determine if a suspicious URL is malicious?

    <p>Submit the URL to a threat intelligence portal for analysis</p> Signup and view all the answers

    What should you do when the company intranet site isn't accepting login information and shows misspellings?

    <p>Restore a backup copy of the authentication database</p> Signup and view all the answers

    What does the CVSS tool primarily assist with in Vulnerability Management?

    <p>Evaluating the severity of vulnerabilities</p> Signup and view all the answers

    Which cybersecurity tool would likely be used for patch management?

    <p>Patch Management Software</p> Signup and view all the answers

    What does the Listening state indicate about the TCP ports when using the netstat -l command?

    <p>The ports are open on the system and are waiting for connections.</p> Signup and view all the answers

    Which NIST incident response lifecycle phase focuses on mitigating the impact of an incident?

    <p>Containment, Eradication and Recovery</p> Signup and view all the answers

    What is the primary function of a hypervisor in a virtualized environment?

    <p>It creates and runs virtual machines.</p> Signup and view all the answers

    Which process allows the network security team to monitor the operating system version and updates on devices?

    <p>Security policies and procedures.</p> Signup and view all the answers

    What type of entry should be created to prevent spoofing of the internal network?

    <p>An ACL.</p> Signup and view all the answers

    Which two private IPv4 addresses are typically blocked on the internet for security reasons? (Choose 2)

    <p>192.168.18.189</p> Signup and view all the answers

    During a risk evaluation, which risks related to a web server should be considered?

    <p>Hardware failure and software failure.</p> Signup and view all the answers

    In the context of incident response, what is the primary focus of the post-incident activity phase?

    <p>Reporting the cause and costs of the incident.</p> Signup and view all the answers

    What immediate action should be taken to scan affected workstations and remove malware?

    <p>Scan affected workstations and remove malware</p> Signup and view all the answers

    What does the command 'ls -l' do in a Linux terminal?

    <p>To display the file permission and ownership of the executable file</p> Signup and view all the answers

    Which device is most appropriate for filtering websites available to employees on the company network?

    <p>Proxy server</p> Signup and view all the answers

    What term best describes a weakness that potentially exposes organizations to cyber attacks?

    <p>Vulnerability</p> Signup and view all the answers

    Which action should be classified under containment when addressing a worm infection?

    <p>Remove or block infected system from the network</p> Signup and view all the answers

    What is the potential for loss, damage, or destruction classified as?

    <p>Risk</p> Signup and view all the answers

    What treatment approach involves cleaning and patching the infected system?

    <p>Mitigation</p> Signup and view all the answers

    Which type of endpoint attack is characterized by overwhelming a service with excessive traffic?

    <p>DDoS</p> Signup and view all the answers

    Which action likely caused the hacker to gain root access on a Linux server?

    <p>Accessing the server as a guest</p> Signup and view all the answers

    Which wireless encryption technology relies on AES for securing home networks?

    <p>WPA2</p> Signup and view all the answers

    Which of the following is NOT considered an authentication factor in a multifactor authentication scenario?

    <p>Something you earn</p> Signup and view all the answers

    What is an example of corrective measure control in cybersecurity?

    <p>Restoring a system after an event</p> Signup and view all the answers

    Which two disasters would necessitate a company's implementation of a disaster recovery plan?

    <p>Volcanic eruptions</p> Signup and view all the answers

    What should be done if a laptop user cannot print to their wireless printer after an OS update?

    <p>Install a new device driver for the wireless printer</p> Signup and view all the answers

    Which activity exemplifies active reconnaissance during a penetration test?

    <p>Performing an Nmap port scan on the LAN to determine types of connected devices and open ports</p> Signup and view all the answers

    An analyst accesses employee data on a company server without authorization. This action is considered:

    <p>A breach of the cybersecurity code of ethics</p> Signup and view all the answers

    Which framework is primarily responsible for protecting healthcare information of individuals?

    <p>HIPAA</p> Signup and view all the answers

    What type of cybersecurity threat is indicated by repeated website crashes after restarting?

    <p>Denial of service</p> Signup and view all the answers

    Which command can display the configured DNS server information and resolve a URL's IP address?

    <p>Nslookup</p> Signup and view all the answers

    What type of authentication is demonstrated by entering a strong password along with a 5-digit code sent to your smartphone?

    <p>Multifactor</p> Signup and view all the answers

    What does the process of hashing primarily ensure for communication?

    <p>Data integrity</p> Signup and view all the answers

    Which of the following protects the personal information of members of the European Union?

    <p>GDPR</p> Signup and view all the answers

    In the event of an alert concerning malicious files detected by the IDS, what is the recommended next step?

    <p>Log the alert and watch for a second occurrence</p> Signup and view all the answers

    Which framework is responsible for protecting information about individuals stored by federal agencies?

    <p>FISMA</p> Signup and view all the answers

    Which two actions should be taken immediately regarding telnet access on the corporate database server? (Choose 2)

    <p>Implement SSH access on the server.</p> Signup and view all the answers

    Which activity by an adversary is an example of an exploit attempting to gain credentials?

    <p>Sending an email with a link to a fictitious web portal login page.</p> Signup and view all the answers

    What is one basic metric to consider when assigning a severity to a vulnerability during assessment?

    <p>The impacts that an exploit of the vulnerability will have on the organization.</p> Signup and view all the answers

    Which two disadvantages of public vulnerability databases should be noted? (Choose 2)

    <p>Threat actors can access the databases to learn how to vary their threats to avoid detection.</p> Signup and view all the answers

    What type of events do application logs contain?

    <p>Events from programs running on the device.</p> Signup and view all the answers

    Which action should NOT be taken when evaluating vulnerabilities?

    <p>Ignore historical data related to previous exploits.</p> Signup and view all the answers

    Which log type records the success or failure of audit policy events?

    <p>Security logs</p> Signup and view all the answers

    What should be a primary focus when considering a vulnerability's potential for exploitation?

    <p>The likelihood of an adversary exploiting it.</p> Signup and view all the answers

    Study Notes

    Network Issues and Response

    • A network experiencing slow response times might indicate TCP ports are in a listening state, waiting for connections.
    • Netstat -l command displays TCP ports in a listening state.

    Incident Response Lifecycle

    • Preparation: Mitigate the impact of the incident, report cause and cost, and steps to prevent future incidents.
    • Detection and Analysis: Evaluate incident indicators (legitimate attacks vs. illegitimate), and alert the organization.
    • Containment, Eradication, and Recovery: Establish incident response capability to secure organizational assets.

    Hypervisor Purpose

    • Creates and runs virtual machines.

    Operating System Monitoring

    • Security teams track operating system versions, security updates, and patches on devices, typically through asset management.

    Internal Network Spoofing Prevention

    • DNS records can help prevent internal network spoofing.

    Security and Performance Issues

    • Two private IPv4 addresses that should be blocked on the internet for security and performance reasons are 192.168.18.189 and 203.0.113.168.

    Risk Management

    • Risk reduction: Implementing measures to lessen the negative impacts of risks.
    • Risk avoidance: Choosing not to engage in activities that might involve risks.
    • Risk acceptance: Acknowledging the risks but not taking actions to prevent them.
    • Risk transfer: Passing risk to a third party.

    CIA Triad

    • Confidentiality: Data is accessible only to authorized users.
    • Integrity: Data cannot be altered without authorization.
    • Availability: Data is accessible to authorized users when required.

    Cybersecurity Threats

    • Spear phishing: Targeted phishing attacks attempting to steal sensitive data.
    • Smishing: Phishing attacks via SMS or text messages.
    • Ransomware: Malicious software that encrypts data and demands payment for decryption.
    • Vishing: Phishing attacks using voice calls.

    Network Troubleshooting

    • Implement MAC address filtering to prevent an unknown host from attaching to a network.
    • Block the host's IP address.

    Risk Management Phases

    • Choosing risk strategies: Selecting strategies for dealing with identified risks.
    • Measuring residual risk: Assessing how much risk is left after mitigation actions.
    • Mitigating risks: Taking steps to reduce or eliminate the risks.
    • Determining a risk profile: Understanding and categorizing an organization's risks.

    Attack Types

    • Man-in-the-middle (MitM): An attacker intercepts communication between two parties.
    • Advanced Persistent Threat (APT): A prolonged and sophisticated attack aimed at persistent access and significant damage.
    • Distributed Denial-of-Service (DDoS): Flooding a target with traffic to overwhelm it.
    • Ransomware: Malicious software that encrypts data and demands payment for decryption.

    Security and Accessibility

    • VPN is a security method for accessing a company's secure network remotely.

    Data Protection

    • Hard disk encryption protects data at rest.

    Network Protocols for Secure Transfers

    • SSH can encrypt files transferred over an unsecured network.

    Cybersecurity Tools

    • Nmap, Nessus Scanner, CVSS, Firewall and Patch Management Software.

    Windows Operating System Logs

    • Windows logs track system activity, which can be viewed in Windows Event Viewer (System logs, Application logs, Security logs).

    Threat Intelligence Portals

    • Threat intelligence portals are used to analyze suspicious URLs.

    Authentication Methods

    • Multifactor authentication involves using multiple methods to confirm a user's identity (e.g., password, code sent via phone).

    Control Measures

    • Detective measures: Identify threats and events.
    • Preventive measures: Prevent threats from occurring.
    • Corrective measures: Respond to and resolve detected threats and incidents.

    Disaster Recovery

    • Natural disasters like floods and hazardous material spills can require disaster recovery plans.

    Network Device Troubleshooting

    • To fix wireless printing issues, a new device driver may be required.

    Active Reconnaissance

    • Activity like looking at HTTP source code of a website to gather info.

    Remote Access Procedures

    • Disable telnet to force more secure authentication methods.

    Cybersecurity Tools and Purposes

    • SIEM (Security Information and Event Management) systems can be used to detect anomalies in user activity.
    • Log files contain information about programs running on the device, software installations, hardware/driver operations, and policy successes/failure.
    • Vulnerability databases are helpful but can take time for reporting/investigation before being adopted by security platforms.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    ITS Examination for Cybersecurity PDF

    Description

    This quiz delves into network security concepts, incident response lifecycle, hypervisor functionality, and operating system monitoring. Explore how to effectively address network issues, prepare for incidents, and prevent spoofing while ensuring system security.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser