Security Control Categories Quiz
48 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is considered a known threat?

  • Advanced Persistent Threats (APTs)
  • Documented exploits against software vulnerabilities (correct)
  • Obfuscated malware code
  • Zero-day exploits

    • Nation-state actors primarily focus on committing fraud and blackmail.

    False

    What is the primary goal of hacktivist groups?

    To promote a political agenda or ideology.

    An APT stands for __________.

    <p>Advanced Persistent Threat</p> Signup and view all the answers

    Match the following threat actor types with their descriptions:

    <p>Nation-State = Groups backed by governments with cybersecurity expertise Organized Crime = Groups involved in fraud and blackmail Hacktivist = Groups promoting political ideologies</p> Signup and view all the answers

    What distinguishes nation-state actors from other threat types?

    <p>They are funded by government entities for military or commercial goals.</p> Signup and view all the answers

    Obfuscated malware code is classified as a known threat.

    <p>False</p> Signup and view all the answers

    What does effective threat intelligence involve?

    <p>Understanding the behavior of adversary groups.</p> Signup and view all the answers

    Which of the following describes a DDoS attack?

    <p>A sudden spike in network traffic</p> Signup and view all the answers

    In the Kill Chain, exploitation refers to the creation of payload and exploit code.

    <p>False</p> Signup and view all the answers

    What phase follows reconnaissance in the Kill Chain?

    <p>Weaponization</p> Signup and view all the answers

    In the Kill Chain, the phase during which an attacker identifies the best way to deliver the weaponized code is called ______.

    <p>Delivery</p> Signup and view all the answers

    Match the TTP to its indication:

    <p>DDoS = Spike in network traffic Viruses/Worms = Increased CPU or memory usage Network Reconnaissance = Port scanning Data Exfiltration = Unusual spikes in data transfers</p> Signup and view all the answers

    What technique might an attacker use to evade detection during reconnaissance?

    <p>Using zombie hosts or botnets</p> Signup and view all the answers

    Data exfiltration is indicated by consistent and low network traffic.

    <p>False</p> Signup and view all the answers

    What are the seven steps of the Lockheed Martin Kill Chain?

    <p>Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.</p> Signup and view all the answers

    What is a primary focus of Endpoint Detection and Response (EDR)?

    <p>Logging endpoint observables</p> Signup and view all the answers

    User and Entity Behavior Analytics (UEBA) are primarily used for data collection.

    <p>False</p> Signup and view all the answers

    What is the purpose of sandboxing in cybersecurity?

    <p>To isolate untrusted data in a closed virtual environment for testing and analysis.</p> Signup and view all the answers

    EDR aims to provide __________ and historical visibility into compromises.

    <p>real-time</p> Signup and view all the answers

    Match the following technologies with their primary function:

    <p>EDR = Logging endpoint observables UEBA = Behavioral analysis Sandboxing = Testing malicious data AI and Machine Learning = Reducing false positives in analysis</p> Signup and view all the answers

    Which of the following is a characteristic of User and Entity Behavior Analytics (UEBA)?

    <p>Comparison to a baseline for behavior analysis</p> Signup and view all the answers

    Sandboxing can only be used for malware analysis.

    <p>False</p> Signup and view all the answers

    Identify one example of a UEBA solution mentioned.

    <p>Microsoft's Advanced Threat Analytics or Splunk UEBA.</p> Signup and view all the answers

    What does the 'DPT' field indicate in an iptables log entry?

    <p>Destination port</p> Signup and view all the answers

    The MAC address appears at the end of the iptables log entry.

    <p>False</p> Signup and view all the answers

    What does SPT denote in the iptables log?

    <p>Source port</p> Signup and view all the answers

    The _____ format is used by the Windows-based firewall for logging.

    <p>W3C Extended Log File</p> Signup and view all the answers

    Which of the following fields is NOT included in the Windows Firewall log format?

    <p>DPT</p> Signup and view all the answers

    Match the component with its description in the Windows Firewall log:

    <p>c-ip = Client IP s-IP = Server IP cs-method = Action taken by the client cs-username = Name of the user accessing the server</p> Signup and view all the answers

    The 'TTL' field indicates the time taken for a packet to reach its destination.

    <p>False</p> Signup and view all the answers

    What does the 'SC-status' field represent in the Windows Firewall log?

    <p>Server response code</p> Signup and view all the answers

    What feature should a sandbox provide to monitor changes made by an executed malware file?

    <p>Monitor all system and API calls</p> Signup and view all the answers

    A sandbox host used for malware analysis should be physically isolated from the main network.

    <p>True</p> Signup and view all the answers

    What is the primary goal of reverse engineering malware?

    <p>To understand how it functions and propagates.</p> Signup and view all the answers

    Static analysis involves reading the code of the malicious application to understand its ______.

    <p>goals</p> Signup and view all the answers

    Match the following aspects of malware analysis with their descriptions:

    <p>Static Analysis = Reading the code to understand goals Sandbox = Isolated environment for malware execution Network Access Control = Precautions against exploiting vulnerabilities Reverse Engineering = Examining the code structure and patterns</p> Signup and view all the answers

    Which of the following is NOT a feature of a sandbox for malware analysis?

    <p>User intervention during analysis</p> Signup and view all the answers

    Java class files are more difficult to reverse engineer compared to applications written in other languages.

    <p>False</p> Signup and view all the answers

    What precautions must be taken regarding host patch management?

    <p>To protect against vulnerabilities in hypervisors.</p> Signup and view all the answers

    What port number does the syslog protocol use?

    <p>514</p> Signup and view all the answers

    Heuristic analysis relies solely on predefined rules to generate alerts.

    <p>False</p> Signup and view all the answers

    What does SIEM stand for in the context of logging and analysis?

    <p>Security Information and Event Management</p> Signup and view all the answers

    Anomaly analysis identifies events that do not follow expected ______.

    <p>patterns</p> Signup and view all the answers

    Which of the following is NOT a detection method mentioned?

    <p>Network-based analysis</p> Signup and view all the answers

    Match the analysis types with their descriptions:

    <p>Behavioral Analysis = Recognizes baseline traffic patterns Anomaly Analysis = Identifies events that do not conform to expected patterns Trend Analysis = Detects patterns within a dataset over time Heuristic Analysis = Allows machines to infer information independently</p> Signup and view all the answers

    Trend Analysis can be used to predict future events based on past patterns.

    <p>True</p> Signup and view all the answers

    What is the simplest form of correlation used in SIEM tools?

    <p>Signature-based detection rules</p> Signup and view all the answers

    Study Notes

    Security Control Categories

    • Security controls are categorized into technical, operational, and managerial types.
    • Preventative controls are implemented before a threat event.
    • Detective controls monitor for and identify malicious activity.
    • Corrective controls restore to previous state after an incident.

    Technical Controls

    • These controls include hardware and software components safeguarding systems from cyber threats.
    • Examples include firewalls, IDS, IPS, encryption, and authentication mechanisms.

    Operational Controls

    • These controls, implemented by people, supplement technical security.
    • They often rely on management activities and other technical controls.
    • Examples include labeling, documentation, security awareness training, and personnel security.

    Managerial Controls

    • These controls manage development, maintenance, and use of systems and processes.
    • Examples include system-specific policies, procedures, rules of behavior, and individual roles and responsibilities.

    Incident Response Capability

    • A critical component of security, it is essential for dealing with cybersecurity breaches.
    • Physical security practices help prevent unauthorized access to sensitive assets.

    Deterrents

    • Controls discourage attackers from attacking systems.
    • May only give a slight deterrent effect rather than stop attacks, like making a perceived threat more time-consuming for attackers.

    Compensating Controls

    • Alternative controls implemented when a specific security measure is impossible or impractical to execute.

    CIA Triad

    • Confidentiality, Integrity, and Availability are primary goals of information security.
    • Controls must protect all three principles to ensure security.

    Security Information and Event Management (SIEM)

    • A collection of tools, designed for analysis and incident response of security events.
    • Provides a central location for managing data from various IT systems

    Cyber Threat Intelligence (CTI)

    • A component of cybersecurity focused on collecting and analyzing attack intelligence information.
    • Involves 5 interconnected phases: Requirements, Collection, Analysis, Dissemination, and Feedback.

    Security Controls, Important Note

    • A variety of control types used is more effective than a single control approach.

    Threat Classification

    • Known threats include malware and documented exploits.
    • Unknown threats include zero-day exploits and obfuscated malware code.

    Threat Actor Types

    • Threat intelligence focuses on adversary groups’ behavior instead of just malware signatures.
    • Group types considered include organized crime, hacktivists, and nation-states.

    .

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    CySA+ Lessons 1-4 (Quiz 1) PDF

    Description

    Test your understanding of the three main categories of security controls: technical, operational, and managerial. This quiz covers examples of each type and explores their functions in safeguarding systems against cyber threats. Enhance your knowledge on preventative, detective, and corrective mechanisms.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser