200-201 questions and answers

split brain

scanning

phishing

Add space to the existing partition and lower the retention penod.

Use FAT32 to exceed the limit of 4 GB.

Use the Ext4 partition because it can hold files up to 16 TB.

Mean Time to Respond (MTTR)

Mean Time to Acknowledge (MTTA)

Mean Time to Detect (MTTR)

Identified open SMB ports on the server

Gathered information on processes running on the server

Gathered a list of Active Directory users

transaction data

statistical data

session data

probabilistic

indirect

best

Deep packet inspection is more secure than stateful inspection on Layer 4

Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer
7

Stateful inspection is more secure than deep packet inspection on Layer 7

referrer

host

accept-language

traffic fragmentation

resource exhaustion

tunneling

Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time

Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior

Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis

least privilege

need to know

due diligence

Zero Trust addresses access control and states that an individual should have only the minimum access privileges necessary to perform specific tasks.

Zero Trust states that no users should be given enough privileges to misuse the system on their own.

Zero Trust states that unless a subject is given explicit access to an object, it should be denied access to that object.

A binary named "submit" is running on VM cuckoo1.

A binary on VM cuckoo1 is being submitted for evaluation

A URL is being evaluated to see if it has a malicious binary

encryption

load balancing

tunneling

sequence numbers

IP identifier

timestamps

anomaly

threshold

availability

Rule-based detection is effective with fewer false positives, and behavioral adapts over time.

Behavioral detection is easier to deploy without rules, and rule-based needs historical data.

Rule-based detection excels at APT hunts with updates, and behavioral focuses on anomalies.

best evidence

indirect evidence

forensic evidence

running processes

listening ports

OS fingerprint

password cracking DoS attack on Windows endpoint

regular Linux log and 10.10.10.10 is legitimate host

brute force attack on Linux from 10.10.10.10

After attackers penetrate a network, they can use privilege escalation to expand their reach.

Attackers build botnets, large fleets of compromised devices, and use them to direct false traffic at networks or servers.

Attackers replicate malicious traffic as legitimate and bypass network protection solutions.

circumstantial evidence

indirect evidence

corroborative evidence

The attack surface is the SQL injection targeted on the database, and the database is the vulnerability that might be exploited.

The attack surface is a sum of measured risks for a particular asset, and the vulnerability is an unmeasured exploitable risk

A vulnerability is unsanitized user input sent to exploit a web application and the browser is the attack surface for the web application

man-in-the-middle

IDS evasion

port scanning

TOR

ACL

NAT

The tool does not support Linux.

The file does not support the "-" character.

The file has an incorrect extension.

security of sensitive information

individual approach to incident response

consistent threat identification

Federated Identity ID (FII)

Payment Card Industry (PCI)

Self-sovereign Identity (SSI)

remote code execution that causes a denial-of-service on the system

exploit that can be used to perform remote code execution

set of vulnerabilities used by an attacker to disable root access on the system

Fake Social Security Administration personnel contact random individuals, inform them that there has been a computer problem on their end, and ask that those individuals confirm their Social Security Number, all for the purpose of committing identity theft.

The attacker focuses on creating a good pretext, or a fabricated scenario, that is used to try and steal victims' personal information.

Someone without the proper authentication follows an authenticated employee into a restricted area.
The attacker might impersonate a delivery driver and wait outside a building to get things started.

failure of the full packet capture solution

misconfiguration of a web filter

insufficient network resources

checksum violated image

integrity violated image

untampered image

risk scores

vendor suggestions

vulnerability exposure

An attack surface identifies vulnerabilities that require user input or validation; and an attack vector
identifies vulnerabilities that are independent of user actions.

An attack vector identifies components that can be exploited, and an attack surface identifies the potential path an attack can take to penetrate the network.

An attack vector identifies the potential outcomes of an attack; and an attack surface launches an
attack using several methods against the identified vulnerabilities.

A vulnerability is a weakness that can be exploited and the risk is the potential for loss or damage

A vulnerability is an attack surface, and the risk is the vector of the attack

A risk is a possible danger that an exploit applies to and a vulnerability represents the threat actor

company assets that are threatened

customer assets that are threatened

victims of the attack

preparation

detection and analysis

containment

reconnaissance

delivery

weaponization

SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

on a dedicated proxy server monitoring egress traffic

on a tap switch port

on a span switch port

Key exchange is not secure as the SHA256 hashing algorithm is used.

The certificate is signed by GTS CA on May 24 and is invalid.

Asymmetric cryptography is used for key exchange.

directed

encoded

cascaded

Handshake has been established

Fin flag is not set

Reset flag is not set

DNS cache poisoning

MAC address table overflow

MAC flooding attack

An insider threat compromised the service account to delete sensitive data.

External attackers gained access and are exfiltrating data stealthily.

A misconfigured backup process malfunctioned, causing unexpected file changes.

blocked phishing attempt on a company

spam emails on an employee workstation

virus detection by the AV software

A security practice focused on clarifying and narrowing intrusion points.

A security practice of performing actions rather than acknowledging the threats.

A process to recover from service interruptions and restore business-critical applications

Agentless and agent-based protection for security are used.

Access control models are involved.

Authentication, authorization, and accounting mechanisms are used.

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

A policy violation is active for host 10.201.3.149.

availability

confidentiality

scope

vulnerability scanner

configuration management

mobile device management

Research data on a specific vulnerability.

Scan a host to find open ports and vulnerabilities.

Construct the appropriate malware and deliver it to the victim.

UID

GID

SID

WMI must be configured.

Symlinks must be enabled.

Ext4 must be implemented.

Rule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.

Behavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags
potentially abnormal patterns using signatures.

Behavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates on Layer 3 of the
OSI model

Deep packet inspection is capable of TCP state monitoring only, and stateful inspection can inspect
TCP and UDP.

Stateful inspection is capable of packet data inspections, and deep packet inspection is not

encapsulation

TOR

tunneling

additional PPTP traffic due to Windows clients

unauthorized peer-to-peer traffic

deployment of a GRE network on top of an existing Layer 3 network

Inline monitors traffic without examining other devices, while a tap mode tags traffic and examines the data from monitoring devices.

Tap mode monitors traffic direction, while inline mode keeps packet data as it passes through the monitoring devices.

Tap mode monitors packets and their content with the highest speed, while the inline mode draws a packet path for analysis.

time it takes to assess the risks of the incident

probability of outage caused by the incident

probability of compromise and impact caused by the incident

[^az]+

az+

a*z+

Legitimate web browsing activity

Distributed Denial of Service (DDoS) attack

User trying to access a file share

subnet

VLAN

command and control

IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination
port 49098 using TCP protocol

IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to
destination port 80 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to
destination port 80 using TCP protocol.

uses less CPU and RAM resources than metadata-based monitoring

provides fewer false negative events than full packet capture

provides full visibility based on capture of packet traffic data

configuration

vulnerability

patch

13

12

1.1 and 13

address space layout randomization

run the web server as a nonprivileged user

host profiling

^Parent File Clean$

File: Clean (.*)

^File: Clean$

Tampered images have the same stored and computed hash.

Untampered images are deliberately altered to preserve as evidence.

Tampered images are used as evidence.

An exploit is an attack path, and a threat represents a potential vulnerability.

An exploit is an attack vector, and a threat is a potential path the attack must go through.

A threat is a result of utilizing flow in a system, and an exploit is a result of gaining control over the system.

Identify the minimum resource required per employee.

Disable administrative accounts to avoid unauthorized changes.

Assign the least network privileges to segment network permissions.

privilege escalation

DDoS attack

man-in-the-middle

Validate the copyright of the data, and ensure that individual data owners are protected with a defense-in-depth approach.

Ensure that the connections are safe and the data delivery is improved continuously with appropriate monitoring and cross-checks.

Implement data tags to identify critical assets and data for preserving the secretness, and develop policies and procedures for accessing data.

The file is clean and does not represent a risk.

Cuckoo cleaned the malicious file and prepared it for usage.

MD5 of the file was not identified as malicious.

2317

1986

2318

192.168.7.138 is sending a packet from port 1983 to port 1983 of IP address 192.168.1.18 using UDP protocol.

192.168.7.138 is sending a packet from port 1983 to port 1983 of IP address 192.168.1.18 using TCP protocol.

192.168.1.18 is sending a packet from port 1983 to port 1983 of IP address 192.168.7.138 using TCP protocol.

confidentiality, identity, and authorization

confidentiality, integrity, and authorization

confidentiality, identity, and availability

output of routing protocol authentication failures and ports used

running processes on the applications and their total network usage

deep packet captures of each application flow and duration

True positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.

True positive alerts are blocked by mistake as potential attacks affecting application availability.

False positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.

legitimate network traffic

flood of SYN-ACK packets

flood of SYN packets