Security Concepts Quiz

Security Concepts

• Risk Exposure: Calculated as Probability × Impact.
• NIST Framework: Defines IT security principles (NIST SP 800-14).
• SQL Injection: Attack exploiting SQL queries to alter databases.
• Vishing: Fraudulent phone calls for social engineering.
• IRC: Protocol for C&C via private messages and file sharing.
• Worm: Malware that self-replicates without user interaction.
• Golden Ticket: Technique bypassing authentication using stolen Kerberos tickets.
• Session Hijacking: Stealing session cookies to impersonate users.
• SABSA: Framework for enterprise security architecture, based on Zachman.
• Transfer (Risk Response): Responsibility transfer to a third party in handling risk.
• Smurf Attack: Network flooding with ICMP requests.
• Rainbow Table: Tool for password cracking using precomputed hashes.
• Rootkit: Malware hiding within low-level system components.
• ISO/IEC 27001: ISO standard for information security management.
• DNS Poisoning: Hijacking DNS responses to redirect traffic.
• Steganography: Hiding data within image metadata.
• Coercive Parsing: XML-based attack vector triggering denial-of-service (DoS).
• ITIL: Framework for IT service management (UK Government).
• Nmap: Tool for network scanning and port discovery.
• Tailgating: Social engineering using physical access following someone.
• Residual Risk: Risk remaining after all security controls applied.
• Buffer Overflow: Attack overwriting memory buffers to crash systems.
• Decentralized C&C: Post-attack technique using P2P networks for command and control.
• Data Classification Policy: Standard for classifying data sensitivity.
• Trojan Horse: Malware disguised as legitimate software.
• Wireshark: Tool for intercepting network traffic.
• ARP Spoofing: Exploiting ARP for traffic redirection.
• Program Packers: Compressing malware to evade detection.
• SYN Flood: Attack flooding a server with SYN requests.
• TOGAF: Framework for enterprise architecture (DoD’s TAFIM).
• Qualitative Analysis: Risk assessment using descriptive words instead of numerical values.
• Malvertisement: Attack utilizing malicious advertisements for code delivery.
• Anti-Forensics: Techniques employed to erase forensic evidence.
• Burp Suite: Tool for web application exploitation.
• Clickjacking: Attack tricking users into clicking hidden elements via iframes.

Enumeration

• CIA Triad: Confidentiality, Integrity, Availability.
• Risk Response Techniques: Avoid, Transfer, Mitigate, Accept.
• Social Engineering Types: Phishing, Vishing, Tailgating.
• Password Cracking Methods: Brute-force, Dictionary, Hybrid.
• Privilege Escalation Types: Vertical, Horizontal.
• Web Services Exploits: Probing, Coercive Parsing, External References.
• Security Control Categories: Technical, Physical, Administrative.
• Risk Equation Elements: Threats, Vulnerabilities, Consequences.
• Malware Categories: Virus, Worm, Ransomware, Spyware.
• C&C Communication Channels: IRC, HTTP/S, DNS, ICMP.
• ESA Framework Assessment Phases: Baseline, Internal Network, External Network.
• BYOD Threats: Unpatched Devices, Lost Devices, Forensic Complications.
• Systems Hacking Phases: Reconnaissance, Exploitation.
• DNS Record Types: A, MX, CNAME.
• DoS Attack Techniques: ICMP Flood, SYN Flood, UDP Flood, Buffer Overflow.
• Social Engineering Delivery Media: Email, SMS, Social Networks.
• File Inclusion Attacks: Local (LFI), Remote (RFI).
• Aggregate CIA Score Components: Confidentiality, Integrity, Availability.
• Wireless Threats: Password Cracking, WPS Exploits, Signal Leakage.
• Cloud Infrastructure Threats: VM Escape, Privilege Escalation, Data Remnants.
• Anti-Forensic Techniques: Log Erasure, Program Packers, Memory Residents, Steganography.
• Lateral Movement Tools: PsExec, WMIC, SSH Pivoting.
• XSS Attacks: Stored, Reflected.
• Mobile Platform Threats: Android, iOS, Windows Mobile.
• ERM Objectives: Confidentiality, Legal Compliance, Continuity, Stakeholder Trust.
• Reconnaissance Evasion Techniques: Packet Fragmentation, Encryption, NIDS DoS.
• VPN Pivoting Types: Host-to-Network, Network-to-Network.
• Policy Development Phases: Initiation, Concept, Planning.
• CVSS Base Metrics: Access Vector, Access Complexity, Authentication, Impact.
• Big Data Security Challenges: Privacy Breach, Privilege Escalation, Forensic Complexity.
• Phishing Types: Spear Phishing, Whaling.
• NIST Framework Functions: Identify, Protect, Detect.
• COBIT Principles: Stakeholder Needs, Holistic Approach, Governance/Management Separation
• Session Hijacking Types: Cookie Hijacking, MITM
• Data Exfiltration Methods: Covert Channels, Steganography, Cloud Services