Security Control Categories Quiz
48 Questions
6 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is considered a known threat?

  • Advanced Persistent Threats (APTs)
  • Documented exploits against software vulnerabilities (correct)
  • Obfuscated malware code
  • Zero-day exploits

Nation-state actors primarily focus on committing fraud and blackmail.

False (B)

What is the primary goal of hacktivist groups?

To promote a political agenda or ideology.

An APT stands for __________.

<p>Advanced Persistent Threat</p> Signup and view all the answers

Match the following threat actor types with their descriptions:

<p>Nation-State = Groups backed by governments with cybersecurity expertise Organized Crime = Groups involved in fraud and blackmail Hacktivist = Groups promoting political ideologies</p> Signup and view all the answers

What distinguishes nation-state actors from other threat types?

<p>They are funded by government entities for military or commercial goals. (B)</p> Signup and view all the answers

Obfuscated malware code is classified as a known threat.

<p>False (B)</p> Signup and view all the answers

What does effective threat intelligence involve?

<p>Understanding the behavior of adversary groups.</p> Signup and view all the answers

Which of the following describes a DDoS attack?

<p>A sudden spike in network traffic (C)</p> Signup and view all the answers

In the Kill Chain, exploitation refers to the creation of payload and exploit code.

<p>False (B)</p> Signup and view all the answers

What phase follows reconnaissance in the Kill Chain?

<p>Weaponization</p> Signup and view all the answers

In the Kill Chain, the phase during which an attacker identifies the best way to deliver the weaponized code is called ______.

<p>Delivery</p> Signup and view all the answers

Match the TTP to its indication:

<p>DDoS = Spike in network traffic Viruses/Worms = Increased CPU or memory usage Network Reconnaissance = Port scanning Data Exfiltration = Unusual spikes in data transfers</p> Signup and view all the answers

What technique might an attacker use to evade detection during reconnaissance?

<p>Using zombie hosts or botnets (C)</p> Signup and view all the answers

Data exfiltration is indicated by consistent and low network traffic.

<p>False (B)</p> Signup and view all the answers

What are the seven steps of the Lockheed Martin Kill Chain?

<p>Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives.</p> Signup and view all the answers

What is a primary focus of Endpoint Detection and Response (EDR)?

<p>Logging endpoint observables (C)</p> Signup and view all the answers

User and Entity Behavior Analytics (UEBA) are primarily used for data collection.

<p>False (B)</p> Signup and view all the answers

What is the purpose of sandboxing in cybersecurity?

<p>To isolate untrusted data in a closed virtual environment for testing and analysis.</p> Signup and view all the answers

EDR aims to provide __________ and historical visibility into compromises.

<p>real-time</p> Signup and view all the answers

Match the following technologies with their primary function:

<p>EDR = Logging endpoint observables UEBA = Behavioral analysis Sandboxing = Testing malicious data AI and Machine Learning = Reducing false positives in analysis</p> Signup and view all the answers

Which of the following is a characteristic of User and Entity Behavior Analytics (UEBA)?

<p>Comparison to a baseline for behavior analysis (B)</p> Signup and view all the answers

Sandboxing can only be used for malware analysis.

<p>False (B)</p> Signup and view all the answers

Identify one example of a UEBA solution mentioned.

<p>Microsoft's Advanced Threat Analytics or Splunk UEBA.</p> Signup and view all the answers

What does the 'DPT' field indicate in an iptables log entry?

<p>Destination port (D)</p> Signup and view all the answers

The MAC address appears at the end of the iptables log entry.

<p>False (B)</p> Signup and view all the answers

What does SPT denote in the iptables log?

<p>Source port</p> Signup and view all the answers

The _____ format is used by the Windows-based firewall for logging.

<p>W3C Extended Log File</p> Signup and view all the answers

Which of the following fields is NOT included in the Windows Firewall log format?

<p>DPT (C)</p> Signup and view all the answers

Match the component with its description in the Windows Firewall log:

<p>c-ip = Client IP s-IP = Server IP cs-method = Action taken by the client cs-username = Name of the user accessing the server</p> Signup and view all the answers

The 'TTL' field indicates the time taken for a packet to reach its destination.

<p>False (B)</p> Signup and view all the answers

What does the 'SC-status' field represent in the Windows Firewall log?

<p>Server response code</p> Signup and view all the answers

What feature should a sandbox provide to monitor changes made by an executed malware file?

<p>Monitor all system and API calls (D)</p> Signup and view all the answers

A sandbox host used for malware analysis should be physically isolated from the main network.

<p>True (A)</p> Signup and view all the answers

What is the primary goal of reverse engineering malware?

<p>To understand how it functions and propagates.</p> Signup and view all the answers

Static analysis involves reading the code of the malicious application to understand its ______.

<p>goals</p> Signup and view all the answers

Match the following aspects of malware analysis with their descriptions:

<p>Static Analysis = Reading the code to understand goals Sandbox = Isolated environment for malware execution Network Access Control = Precautions against exploiting vulnerabilities Reverse Engineering = Examining the code structure and patterns</p> Signup and view all the answers

Which of the following is NOT a feature of a sandbox for malware analysis?

<p>User intervention during analysis (A)</p> Signup and view all the answers

Java class files are more difficult to reverse engineer compared to applications written in other languages.

<p>False (B)</p> Signup and view all the answers

What precautions must be taken regarding host patch management?

<p>To protect against vulnerabilities in hypervisors.</p> Signup and view all the answers

What port number does the syslog protocol use?

<p>514 (D)</p> Signup and view all the answers

Heuristic analysis relies solely on predefined rules to generate alerts.

<p>False (B)</p> Signup and view all the answers

What does SIEM stand for in the context of logging and analysis?

<p>Security Information and Event Management</p> Signup and view all the answers

Anomaly analysis identifies events that do not follow expected ______.

<p>patterns</p> Signup and view all the answers

Which of the following is NOT a detection method mentioned?

<p>Network-based analysis (B)</p> Signup and view all the answers

Match the analysis types with their descriptions:

<p>Behavioral Analysis = Recognizes baseline traffic patterns Anomaly Analysis = Identifies events that do not conform to expected patterns Trend Analysis = Detects patterns within a dataset over time Heuristic Analysis = Allows machines to infer information independently</p> Signup and view all the answers

Trend Analysis can be used to predict future events based on past patterns.

<p>True (A)</p> Signup and view all the answers

What is the simplest form of correlation used in SIEM tools?

<p>Signature-based detection rules</p> Signup and view all the answers

Flashcards

Threat Classification

Categorizing threats into known and unknown types, including malware, documented exploits, zero-day exploits, and obfuscated malware.

Threat Actor Types

Understanding adversary groups like Nation-States, Organized Crime, and Hacktivists to understand their motives and capabilities.

Nation-State

Government-backed threat actors with high resources and expertise, often targeting espionage and strategic advantages like energy or electoral systems.

Organized Crime

Criminal groups focused on financial gain, often engaging in fraudulent activities and blackmailing.

Signup and view all the flashcards

Hacktivist

Groups using cyber skills with political motivation, promoting an ideology or agenda.

Signup and view all the flashcards

Advanced Persistent Threat (APT)

A skillful adversary who can infiltrate systems and remain undetected for a long period using various tools and techniques.

Signup and view all the flashcards

Malware

Software designed to cause harm or damage, classified as a known threat.

Signup and view all the flashcards

Zero-day exploits

Exploits of unknown vulnerabilities, categorized as unknown threats.

Signup and view all the flashcards

TTPs

Tactics, Techniques, and Procedures used in attacks.

Signup and view all the flashcards

DDoS Attack

Sudden surge of network traffic to overwhelm a target.

Signup and view all the flashcards

Malware (Viruses/Worms)

Software designed to damage or disable a system.

Signup and view all the flashcards

Network Reconnaissance

Attacker scanning for vulnerabilities in a network.

Signup and view all the flashcards

Kill Chain

Series of steps attackers follow to achieve their goals.

Signup and view all the flashcards

Kill Chain: Reconnaissance

Finding out about target's security and attack methods.

Signup and view all the flashcards

Kill Chain: Weaponization

Creating the attack tools tailored for targets.

Signup and view all the flashcards

Kill Chain: Delivery

Getting the attack tools to the target’s system.

Signup and view all the flashcards

iptables INPUT drop

A command that rejects network traffic coming into a system through interface eth0.

Signup and view all the flashcards

IN=eth0

Incoming network traffic on network interface 'eth0'.

Signup and view all the flashcards

SRC=10.1.0.102

Source IP address of the network packet.

Signup and view all the flashcards

DST=10.1.0.10

Destination IP address of the network packet.

Signup and view all the flashcards

SPT=2584

Source port number of the TCP connection.

Signup and view all the flashcards

DPT=21

Destination port number of the TCP connection.

Signup and view all the flashcards

MAC Address

A unique identifier assigned to network interface cards (NICs).

Signup and view all the flashcards

Windows Firewall Log Format

Log format used by Windows Firewall that contains detailed information about network activity.

Signup and view all the flashcards

EDR vs. EPP

Endpoint Detection and Response (EDR) aims to detect and respond to threats in real-time, focusing on analyzing behavior and anomalies, while Endpoint Protection Platforms (EPP) primarily rely on signature-based detection and prevention.

Signup and view all the flashcards

EDR's Goal

The goal of EDR is to provide visibility into an attack, contain it within a single host, and enable remediation to restore the host to its original state.

Signup and view all the flashcards

UEBA

User and Entity Behavior Analytics (UEBA) analyzes user and machine behavior to identify potential threats by comparing it to a baseline of expected behavior.

Signup and view all the flashcards

UEBA's Focus

UEBA tracks behavior across various devices and cloud services, analyzing user accounts, machine accounts, and embedded hardware.

Signup and view all the flashcards

Sandboxing

Sandboxing isolates untrusted data in a controlled virtual environment for analyzing threats and vulnerabilities without risking the host system.

Signup and view all the flashcards

Sandbox Applications

Sandboxes are used for various purposes, including testing application code during development and analyzing potential malware.

Signup and view all the flashcards

Sandbox Benefits

Sandboxing offers more comprehensive security analysis than traditional anti-malware solutions, allowing for testing in various environments.

Signup and view all the flashcards

UEBA & AI

UEBA heavily relies on advanced computing techniques like artificial intelligence (AI) and machine learning to analyze complex behavior patterns and reduce false positives.

Signup and view all the flashcards

Sandbox Features

A sandbox for malware analysis should monitor system changes, execute malware, track API calls, take snapshots, and record file activity.

Signup and view all the flashcards

Sandbox Isolation

The sandbox should be isolated (physically or virtually) from the main network to prevent malware from spreading.

Signup and view all the flashcards

Reverse Engineering

Examining the structure of a system or application to understand how it functions, especially relevant for malware analysis.

Signup and view all the flashcards

Static Analysis

Analyzing malware code without executing it to understand its goals by examining its structure and instructions.

Signup and view all the flashcards

Dynamic Analysis

Analyzing malware by executing it in a controlled environment to observe its behavior, including system changes and network activity.

Signup and view all the flashcards

Malware Attribution

Determining the source of malware by identifying patterns in its code, execution, or communication.

Signup and view all the flashcards

Honeypot

A system designed to lure and trap attackers, especially for malware analysis and studying attacker behavior.

Signup and view all the flashcards

C&C Communication

Malware often communicates with a server for remote control and instructions, referred to as Command and Control (C&C).

Signup and view all the flashcards

Syslog

A standard protocol used by network devices to send event data logs to a central location for analysis and reporting.

Signup and view all the flashcards

SIEM

Security Information and Event Management, a software solution that gathers and analyzes security data from various sources to detect and respond to threats.

Signup and view all the flashcards

Signature-Based Detection

A basic form of threat detection that uses predefined patterns or signatures to identify known malicious activity.

Signup and view all the flashcards

Heuristic Analysis

A more advanced method of threat detection that uses machine learning to analyze suspicious activity and identify patterns that may not be explicitly defined.

Signup and view all the flashcards

Behavioral Analysis

A method of threat detection that analyzes user and network behavior to identify anomalies that deviate from the expected norms.

Signup and view all the flashcards

Anomaly Analysis

A technique that looks for events that do not follow the expected patterns or rules defined for a system.

Signup and view all the flashcards

Trend Analysis

Analyzing historical data to detect emerging trends and predict future events or threats.

Signup and view all the flashcards

What is the difference between anomaly analysis and trend analysis?

Anomaly analysis focuses on identifying deviations from expected behavior in individual events, while trend analysis identifies patterns over time to predict future occurrences.

Signup and view all the flashcards

Study Notes

Security Control Categories

  • Security controls are categorized into technical, operational, and managerial types.
  • Preventative controls are implemented before a threat event.
  • Detective controls monitor for and identify malicious activity.
  • Corrective controls restore to previous state after an incident.

Technical Controls

  • These controls include hardware and software components safeguarding systems from cyber threats.
  • Examples include firewalls, IDS, IPS, encryption, and authentication mechanisms.

Operational Controls

  • These controls, implemented by people, supplement technical security.
  • They often rely on management activities and other technical controls.
  • Examples include labeling, documentation, security awareness training, and personnel security.

Managerial Controls

  • These controls manage development, maintenance, and use of systems and processes.
  • Examples include system-specific policies, procedures, rules of behavior, and individual roles and responsibilities.

Incident Response Capability

  • A critical component of security, it is essential for dealing with cybersecurity breaches.
  • Physical security practices help prevent unauthorized access to sensitive assets.

Deterrents

  • Controls discourage attackers from attacking systems.
  • May only give a slight deterrent effect rather than stop attacks, like making a perceived threat more time-consuming for attackers.

Compensating Controls

  • Alternative controls implemented when a specific security measure is impossible or impractical to execute.

CIA Triad

  • Confidentiality, Integrity, and Availability are primary goals of information security.
  • Controls must protect all three principles to ensure security.

Security Information and Event Management (SIEM)

  • A collection of tools, designed for analysis and incident response of security events.
  • Provides a central location for managing data from various IT systems

Cyber Threat Intelligence (CTI)

  • A component of cybersecurity focused on collecting and analyzing attack intelligence information.
  • Involves 5 interconnected phases: Requirements, Collection, Analysis, Dissemination, and Feedback.

Security Controls, Important Note

  • A variety of control types used is more effective than a single control approach.

Threat Classification

  • Known threats include malware and documented exploits.
  • Unknown threats include zero-day exploits and obfuscated malware code.

Threat Actor Types

  • Threat intelligence focuses on adversary groups’ behavior instead of just malware signatures.
  • Group types considered include organized crime, hacktivists, and nation-states.

.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

CySA+ Lessons 1-4 (Quiz 1) PDF

Description

Test your understanding of the three main categories of security controls: technical, operational, and managerial. This quiz covers examples of each type and explores their functions in safeguarding systems against cyber threats. Enhance your knowledge on preventative, detective, and corrective mechanisms.

More Like This

CIS Security Controls: Comprehensive Cybersecurity Measures Quiz
10 questions

CIS Security Controls: Comprehensive Cybersecurity Measures Quiz

GoldMaroon avatar
GoldMaroon
IT Chapter-5
120 questions

IT Chapter-5

StunnedVoice avatar
StunnedVoice
Cybersecurity threats and controls
10 questions

Cybersecurity threats and controls

AdvantageousVerisimilitude avatar
AdvantageousVerisimilitude
IndianOil Cyber Security and IT Policy
40 questions

IndianOil Cyber Security and IT Policy

OptimalSeal avatar
OptimalSeal
Use Quizgecko on...
Browser
Open
Browser
Browser