Cs3690 Disa Q&a Exam

Front 1

What is represented as the outermost ring of defense-in-depth.

Back 1

Security Policy

Hint 1

Though this particular “ring” illustration is purely notional; this outer ring choice is valid given that it (i.e., the blank above) effectively “drives” the what and how of the other “rings” of defense.

Front 2

What explains why IDSs are important w/in the DoD?

Back 2

IDSes alert you to anomalies that can indicate malicious activity.

Front 3

What is the term often used to describe the most “amateurish” of black hat hackers?

Back 3

Script-kiddies

Front 4

Which of the attacker categories is generally characterized as motivated by ideological motives?

Back 4

Hacktivist

Front 5

During which phase of an (cyber) attack is the goal; that of determining potential vulnerabilities of the target system(s)?

Back 5

enumeration

Front 6

Which of these does not belong in this list?
a. Cross Site Scripting
b. Pass the hash
c. Buffer Overflow
d. SQL Injection
e. Format String

Back 6

Pass the hash

Front 7

“Pivoting” is mentioned here. What is meant by “pivoting” in this context?

Back 7

Pivoting: an attacker scans a network, compromises a host, port scan is launched from the compromised host, and other network host are attacked (attackers pivots from a compromised host).

Hint 7

(e.g. technique during the Post-Exploitation phase).

Front 8

What attacks are push-based, and have been largely mitigated via savvy use of perimeter defenses including firewalls.

Back 8

Server-side

Front 9

What attacks are pull-based, and thus are poorly mitigated by firewalls.

Back 9

Client-side

Front 10

What URL resource was mentioned for guidance regarding the hardening (“lock down”) of clients and servers?

Back 10

http://iase.disa.mil/stigs

Front 11

What else (besides STIGs) are the configuration standards for DOD IA and IA-enabled devices/systems?

Back 11

DOD Security Technical Implementation Guides and NSA guides

Front 12

What STIG compliance reporting automation protocol was mentioned on this STIG’s page?

Back 12

NIST Security Content Automation Protocol (S-CAP)

Hint 12

four letter acronym and what it stands for

Front 13

Is the following a client-side or server-side attack: Attacks vulnerable listening services directly.

Back 13

Server Side

Front 14

Is the following a client-side or server-side attack: Tricks the user into accessing malicious data or content.

Back 14

Client Side

Front 15

Is the following a client-side or server-side attack: Are more easily mitigated by firewall and patch management.

Back 15

Server Side

Front 16

Is the following a client-side or server-side attack: Attacks user-driven applications on a system.

Back 16

Client Side

Front 17

Which OSI layer would be responsible for “lip sync” (i.e., synchronization) problems with streaming media?

Back 17

Layer 5 Session

Front 18

In which OSI layer (according to the video) would we find the services of application-layer encryption provided?

Back 18

Layer 6 Presentation

Front 19

If you needed to communicate, but could only choose to have the functionality of one layer; which would you choose?

Back 19

Physical layer

Front 20

Which model comprises fewer protocol layers?

Back 20

TCP/IP model

Front 21

Which model layer comprises a presentation layer provides data formatting functions.

Back 21

OSI model

Front 22

Which model layer comprises internet layer encapsulates data into packets or datagrams – fragmenting and reassembling as needed.

Back 22

TCP/IP model

Front 23

Which model layer comprises an application layer is not responsible for data exchanges of extended time periods (e.g., video streams).

Back 23

OSI model

Front 24

Which model layer comprises a physical layer sends the electrical, light or radio signals across the network/s

Back 24

OSI model

Front 25

Which IPv6 field serves the same purpose as IPv4’s TTL field?

Back 25

Hop limit

Front 26

Which IPv6 field serves the same purpose as IPv4’s TOS field?

Back 26

Traffic Class

Front 27

Which IPv6 field serves the same purpose as IPv4’s Protocol field?

Back 27

Next Header

Front 28

Which IPv6 field serves the same purpose as IPv4’s IHL field?

Back 28

Header size is fixed.

Front 29

Which IPv6 field could be employed to support connection-oriented layer-3 service over a packet-switched network?

Back 29

Flow Label

Front 30

Which IPv6 field serves the same purpose as IPv4’s Fragment Offset field?

Back 30

Only source nodes perform fragmentation, not routers

Front 31

What is the most widely deployed Internet Protocol (IP) version.

Back 31

IPv4

Front 32

What IP version contains 128 bits of address data, representing more than 3.4 x 1038 possible addresses.

Back 32

IPv6

Front 33

What IP version has a simplified packet header.

Back 33

IPv6

Front 34

What IP version has packet fragment information included in the header.

Back 34

IPv4

Front 35

What IP version's address space will be exhausted in the near future.

Back 35

IPv4

Front 36

What protocol has connectionless protocol for fast transmissions tolerant of some packet loss?

Back 36

UDP

Front 37

What simple protocol designed to carry data across networks?

Back 37

IP

Front 38

What protocol is slower but more reliable transmissions?

Back 38

TCP

Front 39

What protocol is a helper for IP?

Back 39

ICMP

Front 40

Which RFC covers the three blocks of private IP space, and which IETF organization established this (reserved) IP space?

Back 40

RFC1918 and IANA

Front 41

What provides service-to-service communications and interacts directly with user applications and programs

Back 41

Application Layer

Front 42

What is the Ephemeral port range is used for?

Back 42

random and temporary port allocations

Front 43

What is the combination of an IP address and a port called?

Back 43

socket

Front 44

What is often used to translate private IP addresses into a public IP address for homes and offices?

Back 44

NAT

Front 45

What was the “problem” with version 1 of SSH?

Back 45

It is susceptible to man-in-the-middle attacks.

Front 46

Why is SSH traffic problematic for intrusion analysts?

Back 46

Attackers can employ SSH tunnels to hide malicious traffic.

Front 47

Why is SMTP is a prime candidate for attackers to pivot ?

Back 47

Highly susceptible to denial of service (DoS) attacks, spammers use SMTP for unsolicited mass mailings, can reveal server and/or mail accounts using SMTP commands, and prime candidate for pivoting.

Hint 47

its lack of (organic) authentication or access-control

Front 48

DNS cache poisoning is an attack on (C) (I) or (A)?

Back 48

All three. When DNS cache is poisoned, incorrect information is provided to client machines.

Front 49

What are the three commands (mentioned in this tutorial) that can be used to manipulate a Web server, client, or back-end resources?

Back 49

GET, PUT, and POST

Front 50

What port is used for file-sharing support for UDP (connectionless)

Back 50

138

Front 51

What port is used for file-sharing support for TCP (connection-oritented)

Back 51

139

Front 52

What port is used for name registration and resolution

Back 52

137

Front 53

According to what was presented what is true regarding two common mail “download/access” programs?

Back 53

POP deletes after download.

Front 54

What protocol and port does SMB run over?

Back 54

TCP and 445

Front 55

What does SMB replace as a protcol in post WinNT systems, and is another example of a file transfer protocol?

Back 55

NetBIOS

Front 56

Which protocol mentioned on this slide is commonly used “…as C2 networks for botnets” ?

Back 56

IRC-Internet Relay Chat

Front 57

What is the functionality of FTP/TFTP?

Back 57

file exchange services

Front 58

What is the functionality of SSH/telnet

Back 58

remote log on capability

Front 59

What is the functionality of HTTP/DNS

Back 59

WWW message format definition and transmission/IP address to domain name translation

Front 60

What is the functionality of NetBIOS/SMB/AD?

Back 60

Windows-based services

Front 61

What is the functionality of RPC/EPM?

Back 61

Remote code execution, and assigning and tracking client service port numbers

Front 62

What is the functionality of SMTP/POP/IMAP?

Back 62

Server-to-server message transmission/email services

Front 63

What is the meaning of “nick” when seen in the context of an IRC chat session?

Back 63

nickname

Front 64

Which IDS type, Host or Network, is better “positioned” to provide the highest quality of security alerting on a per-server basis?

Back 64

Host

Front 65

What is not considered one of the three IDS “methods”?

a. Protocol-based
b. Anomaly-based
c. Signature-based
d. Vector-based

Back 65

Vector-based

Front 66

What type of IDS does not scale-well to large networks?

Back 66

Anomaly-based

Front 67

What type of IDS does not exist?

Back 67

Vector-based

Front 68

What type of IDS is not good at detecting a new threat/intrusion?

Back 68

Signature-based

Front 69

What type of IDS works via direct “string matching”?

Back 69

Signature-based

Front 70

What type of IDS is totally made up by Mr. Fulp?

Back 70

Vector-based

Front 71

What type of IDS would be better if all adhered to very specific standards?

Back 71

Protocol-based

Front 72

What type of IDS would most likely detect a bandwidth type DoS attack?

Back 72

Anomaly-based

Front 73

What type of IDS is an independent device that analyzes network traffic for malicious activity?

Back 73

NIDS

Front 74

What type of IDS is a software agent installed on an individual server or workstation?

Back 74

HIDS

Front 75

What type of IDS gains access to network traffic through a hub, switch, or network tap?

Back 75

NIDS

Front 76

What type of IDS has a vantage point allows you to see widespread intrusions?

Back 76

NIDS

Front 77

What IDS operating methods detects whether current traffic is outside of the normal baseline parameters?

Back 77

Anomaly-based IDS

Front 78

What is the most widely know/used open source NIDS?

Back 78

SNORT

Front 79

What event describes when a malicious event occurs but the IDS does not “alert” on it?

Back 79

False negative-a malicious event occurs, IDS is silent

Front 80

What make the “best” target for an attacker to setup a pivot point?

Back 80

A public-facing server in the private network

Hint 80

By “best”, I mean most likely accessible to the attacker, and most likely to be capable of reaching other systems that the attacker would like to exploit/own.

Front 81

How many firewalls is a classic DMZ constructed with?

Back 81

Two

Front 82

How many firewalls is a service-leg DMZ constructed with?

Back 82

One

Front 83

What is a classic DMZ also known as?

Back 83

firewall sandwich

Front 84

What is a service-leg DMZ also known as?

Back 84

3-legged firewall

Front 85

What is the true goal of a DMZ?

Back 85

contain a compromise from spreading to the rest of the network

Front 86

What do DMZ's house?

Back 86

public-facing, Internet-exposed servers

Front 87

What can happen if public facing services are not put in a DMZ?

Back 87

an attacker can more easily use a pivot attack to compromise multiple hosts on a network

Front 88

What class of IP space (A, B, C, D, or E) is used for multicast traffic?

Back 88

D

Front 89

What duplex mode do hubs work in and are they a better choice than switches for an attachment point for monitoring traffic with an IDS?

Back 89

half-duplex and no

Front 90

What is a switch port configured for “promiscuous” operation called by CISCO?

Back 90

SPAN - Switched Port Analyzer port

Front 91

What is a switch port configured for “promiscuous” operation called by HP?

Back 91

mirror port

Front 92

What does a port-aggregator tap allow an IDS to do?

Back 92

tap more than one traffic stream

Front 93

Assume the following: You employ a service-leg type DMZ, both your DMZ and trusted (private) network systems are somewhat vulnerable, you have only one IDS to deploy. Where is the best location to place the IDS?

Back 93

On the organization’s external (Internet-facing) interface

Front 94

Assume the following: You employ a service-leg type DMZ, your DMZ systems are highly hardened (patched & STIG’ed), your trusted (private) network systems are somewhat vulnerable, you have only one IDS to deploy. Where is the best location to place the IDS?

Back 94

In the trusted (private) network

Front 95

Assume the following: You employ a classic type DMZ, both your DMZ and trusted (private) network systems are somewhat vulnerable, you have only one IDS to deploy. Where is the best location to place the IDS?

Back 95

In the DMZ

Front 96

What operates in full duplex and allows the IDS to see traffic that passes through it, without interruption?

Back 96

a TAP

Front 97

What is a very popular/common tool to scan a network to create a “map” of it, and to determine which OSs and applications are running on the various systems connected to it? Also, what is a well-known GUI “front-end” for this tool?

Back 97

Network Scanner such as NMAP-results can be viewed through a GUI called Zenmap

Front 98

Do most IDSes have a concept of trusted and untrusted networks?

Back 98

yes

Front 99

Can tuning your IDS sensors increases the processing load.

Back 99

no

Front 100

Is is important to get permission to perform an active network scan?

Back 100

yes

Front 101

Is it important to tune the IDS to recognize any device running as a web server.

Back 101

yes

Front 102

What layer of the stack (TCP/IP or OSI) is responsible for fragmentation and defragmentation?

Back 102

3

Front 103

What is fragmentation based upon?

Back 103

MTU

Front 104

What indicates a “middle” fragment?

Back 104

More Fragments (MF) = 1, Fragment Offset (FO) != 0

Front 105

What kind of IDS is most likely to be “foiled” by a malicious payload fragmentation attack?

Back 105

Signature-based

Hint 105

What is “GET etc/shadow” an example of…

Front 106

What is “GET etc/shadow” an example of in terms of IDS detection characteristics?

Back 106

Eluding an IDS

Front 107

Under which circumstances could an attacker elude* an IDS when attacking a server?
a. Both IDS and server follow the First Rule (wrt overlapping frag-reassembly)
b. Both IDS and server follow the Last Rule (wrt overlapping frag-reassembly)
c. Either a or b.
d. Neither a nor b.

Back 107

Neither a nor b.

Hint 107

Elude, as used here, means that even though the IDS may indeed obtain and “see” traffic, it does not—for whatever reason (there are many that can be employed)—process the traffic correctly. “Correctly” will in almost all circumstances mean, not the same way that the target machine does.

Front 108

Assume the IDS follows the First Rule, and the target follows the Last Rule. What would result in the attacker successfully “attacking” the server while eluding the IDS?

Back 108

Send GET /etc/shine with frag-offset 0, then send adow with frag-offset 11

Front 109

Can some IDSes can be configured to emulate the reassembly method (First or Last) used by various target systems (OS-dependent)?

Back 109

Yes

Front 110

Linux systems use the ( First / Last ) rule; while Windows systems use the ( First / Last ) rule.

Back 110

Last and First

Front 111

Does fragmentation occurs at the Network layer of the OSI model of interoperability?

Back 111

Yes

Front 112

Can attackers manipulate fragment offsets to overlap fragments?

Back 112

Yes

Front 113

Are fragmentation attacks rare, because it is hard to force fragmentation?

Back 113

No

Front 114

Can Snort's® Frag3 preprocessor lets you customize reassembly policies for individual IP addresses and operating systems?

Back 114

Yes

Front 115

Can NIDS must perform packet reassembly to avoid fragmentation blindness?

Back 115

Yes

Front 116

What layer is segmentation done at?

Back 116

4

Front 117

What layer is fragmentation done at?

Back 117

3

Front 118

What is segmentation set/driven by?

Back 118

MSS (Maximum Segment Size)

Front 119

What is fragmentation set/driven by?

Back 119

MTU (Maximum Transmission Unit)

Front 120

If you knew the path MTU for most/all traffic… what could you do as a server sys-admin to reduce the amount of fragmentation occurring on the Internet with your server’s traffic?

Back 120

Set the _MSS____ (3-letters) to force segmentation so that +TCP_header + IP_header remains less than the __MTU___ (3-letters).

Front 121

What does it mean if a given IDS is said to be incapable of detecting attacks if the attacks are split across fragments?

Back 121

It means that that IDS does not re-build fragments before checking for attack signatures.

Front 122

What does it mean if a given IDS is said to be incapable of detecting attacks if the attacks are split across segments?

Back 122

It does a signature search on individual segments vice rebuilding segments before checking for signatures.

Front 123

Would a lot of very small segments going to a system (single or many) be a legitimate “signature” or “behavior” to take notice of? Why?

Back 123

Abnormal segmentation due to segment size, it will not be normal to get many packets for a segment that could have been able to fit in one segment. Attackers use small segments to evade detection.

Front 124

Which facts related to segmentation pose the greatest risk of attacks?

Back 124

TCP does not set a minimum segment size. A NIDS automatically performs segment reassembly.

Front 125

What would be the logical way to operationally combine CLI sniffers with GUI sniffers?

Back 125

Use CLI-based to pre-filter/-select traffic of interest, then use GUI-based for more detailed analysis.

Front 126

Do all of the three CLI-based protocol analyzers mentioned have equal analysis capabilities?

Back 126

No

Front 127

Can SNORT can be used as a sniffer, a logger, or a NIDS.

Back 127

Yes

Front 128

What method does SNORT use run in NIDS mode?

Back 128

It can be configured for signature, anomaly, or protocol based detection

Front 129

What does LIBPCAP stand for?

Back 129

Promiscuous Capture Library

Front 130

What does GUID stand for?

Back 130

Globally Unique Identifier

Front 131

What command line tool was highlighted here, that allows for searching through packet data information for ASCII-printable characters?

Back 131

Strings

Front 132

What was the Windows go-to site given to find this tool for running on a Windows machine?

Back 132

Microsoft’s Sysinternals website

Front 133

Under the protocol heading of the Packet List Pane, why do you sometimes see the OSI layer 7 protocol (e.g., FTP), and at other times see the layer 4 protocol (e.g., TCP)?

Back 133

Wireshark will display the Highest layer protocol that it recognizes.

Front 134

What filter rule would display TCP traffic from a client ?

Back 134

tcp and ip.src == x.x.x.x

Front 135

How would you preclude seeing any traffic to or from 1.2.3.4?

Back 135

! (ip.addr == 1.2.3.4) —OR— ip.addr != 1.2.3.4

Front 136

What does the Follow TCP Stream option does?

Back 136

Extracts all payload exchanged in a socket-pair and displays it all together for easy viewing.

Front 137

If you’re an analyst whose been alerted about a potential bot-infected machine on your network, and that bot C2 is suspected to be via the IRC protocol; what would be the best way of investigating?

Back 137

Use the find packet feature to search for the string “JOIN”

Front 138

When analyzing header fields what layers should you particularly pay attention to?

Back 138

3 and 4

Front 139

What should you pay attention to when looking at payloads in conjunction with protocols?

Back 139

Encrypted Content for protocols that don't normally do this

Front 140

What was mentioned when analyzing data payloads as an indicator that not only was exploit traffic sent to a target system, but that the exploit was successful?

Back 140

Unique bytes that indicate a exploit from that target.

Front 141

What term of the trade is used to indicate certain “strings” that serve as likely indicators of malicious activity?

Back 141

Dirty Words

Front 142

Which statement is made about client-side attacks?

Back 142

Server-side attacks get most of the security attention.

Front 143

Which statements are true (choose two)?
a. Server-side attacks are generally pushed in.
b. Server-side attacks are generally pulled in.
c. Client-side attacks are generally pushed in.
d. Client-side attacks are generally pulled in.

Back 143

Server-side attacks are generally pushed in.

Client-side attacks are generally pulled in.

Front 144

How do attackers exploit two way traffic flow?

Back 144

injecting malware in responses to outbound traffic

Front 145

What is an attack surface?

Back 145

Entry point[s] into a system, network, or application_that an adversary can leverage to cause harm.

Front 146

How is OS and application attack (target) surface area is largely mitigated?

Back 146

patching

Front 147

How difficult is it to support patch coverage owing to the complex interaction among OSes, applications, and supporting plug-ins (give in percentage 0-100)?

Back 147

100%

Front 148

What are the two primary client-side attack vectors?

Back 148

Emailing or Hosting malicious content

Front 149

Ideally for the attacker; he/she would like to be able to ...

Back 149

directly deliver a malicious .exe as an email attachment

Front 150

If the ideal is not possible, an attacker may employ VBA in order to ...

Back 150

“embed” malicious (executable) code in non .exe files

Front 151

If unable to directly send/embed malicious code, an attacker might try to …

Back 151

exploit a file format vulnerability in an non-malicious application

Front 152

What is meant by a “drive-by download”?

Back 152

No need to click a link or install a program

Front 153

Which of these was not mentioned as a way attackers craft attacks to evade detection?
a. Whitelisting capabilities
b. Using encrypted channels
c. Employing out-of-band channels.
d. Hiding in plain sight.

Back 153

Employing out-of-band channels.

Front 154

What is the meaning of polymorphic malware?

Back 154

Malicious software that constantly changes its signature without modifying its intended purpose which result in creating difficulty for anti-malware programs to detect

Front 155

What do attackers like to employ to avoid most detection security controls that are looking for attacks coming from outside the network?

Back 155

pivoting

Front 156

Does the Botnet problem appear to be in decline owing to wider deployment of modern security-controls.

Back 156

No

Front 157

Can a Botnet attacks also exist for smartphones?

Back 157

Yes

Front 158

Are there are commercial tools available to create botnets?

Back 158

Yes

Front 159

Is a Botnet is typically a two-tier architecture; with a Bot Herder directly controlling an army of zombines?

Back 159

No

Front 160

Is Bot activity is restricted to DoS style attacks?

Back 160

No

Front 161

What is the term for the malicious tools package pulled into a recently bot-infected machine?

Back 161

Stage 2 executable

Front 162

What two techniques were mentioned that may be employed by the Bot architects to obscure stage 2 executables from IDS/IDP systems?

Back 162

Compressing Strings and using encryption algorithms

Front 163

What are the two “classic” strings found in payload that may serve as good candidate “dirty word” searches for the Wireshark’s Strings search tool?

Back 163

Kernel.DLL and LoadLibrary API

Hint 163

one is a DLL the other an API

Front 164

What does DLL and API stand for?

Back 164

Dynamic Link Library and Application Programming Interface

Front 165

What problem does finding KERNEL32.DLL and references to one or more APIs present?

Back 165

false positive

Front 166

Why it is difficult to detect botnet network traffic?

Back 166

Malicious, packed, and sometimes encrypted botnet code passes unfiltered through the firewall to the zombie computer on an internally initiated connection.

Front 167

In a nut-shell, this (Part 3) IDS training is focused on ...

Back 167

Present a structured approach to analysis methodology

Front 168

In a nut-shell, analysis is…

Back 168

Making sense of data.

Front 169

What are the three types of event characterizations?

Back 169

Explained, false-positive, and anamalous.

Front 170

What is presented in regard to (attacker) attribution?

Back 170

This is in purview of a fusion analyst or LEO, but may be quite difficult to do.

Front 171

What DoD document specifies the requirements of a CND analyst?

Back 171

DoD Information Assurance Workforce Improvement Program

Front 172

What is the responsibility of the CND analyst?

Back 172

Correlate information and trends, Propose methods of responding to the threat, Recognize when a system has been compromised, Determine methods used in the event, Characterize the incident

Front 173

In Phase 2 of the Analysis Methodology, what step follows the Incident Response step?

Back 173

Remediation

Front 174

What is the (alternative) forensic term for key indicators?

Back 174

Dirty words

Front 175

Of the 6 data types discussed, which (according to this presentation) is the most common for the intrusion analyst?

Back 175

alert data

Front 176

What two important considerations (i.e. potential problem issue or difficulty) were brought up with regard to Log Data?

Back 176

Time zone of the logs & Access to logs based on storage location of those logs

Front 177

Of the 6 data types discussed, which was characterized as a “gold mine” of information for the analyst?

Back 177

Packet data

Front 178

Which specific product was mentioned in the discussion of packet data data type?

Back 178

Wireshark

Front 179

Of the 6 data types discussed, which is essentially “socket-pair” –level data?

Back 179

Session/Flow Data

Front 180

What does correlation bring to multiple data sources?

Back 180

order

Front 181

What does correlation rely on?

Back 181

dirty word lists

Front 182

What is perhaps the best—single—statement regarding the efficacy/utility of developing a timeline (chronology) relationship?

Back 182

it reveals a cause-effect relationship

Front 183

Which among the 5W+H is more likely to be based upon inference?

Back 183

why

Front 184

What two major “aspects” of the How of the 5W+H should be investigated for the purpose of developing the intrusion/incident narrative?

Back 184

Exploitation & vulnerability

Hint 184

Risk = (Threats * Vulnerabilities * Impact) / Security_Controls

Front 185

What does the acronym RAT stand for in this context?

Back 185

remote access tool

Front 186

Which type of post-exploitation was specifically mentioned as a “specific concern within DoD”?

Back 186

Data exfiltration

Front 187

What are four major considerations for determining "root cause" of a vulnerability?

Back 187

Social Engineering, Unpatched System, Misconfigured security device, and User violation of policy

Front 188

Generally, the analyst should…

Back 188

Present as many plausible hypothetical scenarios as analysis of the data supports.

Front 189

Generally, incident reporting should be done…

Back 189

At any time throughout the incident handling process (as the “narrative” evolves).

Front 190

Which Report type provides information that may enhance STIG development?

Back 190

Technical Report

Front 191

Which Joint Chiefs manual includes procedural information regarding CND Incident Handling, including reporting procedures?

Back 191

Enclosure C, CJCSM 6510.01A

Front 192

What data type gets info about network connections and fills gaps left by alert data?

Back 192

session/flow data

Front 193

What data type will show trends or abnormal spikes in activity?

Back 193

statistical data

Front 194

What data type can be used to review records of systems, users, and network activities?

Back 194

log data

Front 195

What data type is typically the initial focus of CND analysis?

Back 195

alert data

Front 196

What data type provides the most comprehensive info about incidents?

Back 196

packet data

Front 197

What data type provides info about overall security posture of the system/network and helps predict susceptibilities to exploitation?

Back 197

asset/vulnerability data

Front 198

What approach to intrusion analysis tells the story of the incident?

Back 198

develop narratives

Front 199

What approach to intrusion analysis fills gaps in the data

Back 199

analyze & correlate data

Front 200

What approach to intrusion analysis helps to show cause and effect?

Back 200

develop timelines

Front 201

What approach to intrusion analysis gathers data?

Back 201

none

Front 202

What approach to intrusion analysis uses the "dirty word" list?

Back 202

analyze & correlate data

Front 203

What approach to intrusion analysis asks: "How else can you explain this incident?"

Back 203

develop hypotheses

Front 204

What approach to intrusion analysis reveals trends and unusual activity?

Back 204

develop timelines

Front 205

What NIDS rule-syntax is used as a “least-common-denominator” for most other NIDS/NIPS.

Back 205

Snort

Front 206

What are the two composite parts of a NIDS rule?

Back 206

Header and options

Front 207

What is the 7-tuple—in left-to-right order—used for a Snort rule header?

Back 207

Action, protocol, source ip, source port, direction, destination ip, destination port

Front 208

What are the 3 most common Snort IDS actions?

Back 208

Alert, log, and pass

Front 209

Write a Snort rule that would alert on any tcp traffic coming from 1.2.3.4 or 1.2.3.20 on any port, going to any well-known port, of any system in the 5.6.0.0 /16 network.

Back 209

alert tcp [1.2.3.4,1.2.3.20] any -> 5.6.0.0/16 1:1023

Front 210

What is the correct “direction” operator to use if you want your Snort rule to be applied to defined source and destination traffic in both directions?

Back 210

<>

Front 211

Which Windows OSs are dual-stacked (i.e., support both IPv4 and IPv6)?

Back 211

All Windows OS versions since Windows Vista

Front 212

What is the Snort rule options syntax?

Back 212

(keyword1:option1; keyword2:option2; keyword[n]:option[n];)

Front 213

What are the 5 primary Snort keywords for rule options?

Back 213

msg, content, sid, rev, classtype

Front 214

Write version 1 of a Snort log rule (no SID) that would send the message “Likely Reverse DNS query” if any udp traffic goes to port 53 of your DNS server (1.2.3.4) and has the hex string 0900 somewhere in its “payload”.

Back 214

alert udp any any -> 1.2.3.4 53 (msg:”Likely Reverse DNS query”; content:”|09 00|”; rev:1;)

Front 215

Is Message a component of the header or option portion of a Snort rule?

Back 215

Option

Front 216

Is SnortID(SID) a component of the header or option portion of a Snort rule?

Back 216

Option

Front 217

Is Source Port a component of the header or option portion of a Snort rule?

Back 217

Header

Front 218

Is Classtype a component of the header or option portion of a Snort rule?

Back 218

Option

Front 219

Is Revision ID a component of the header or option portion of a Snort rule?

Back 219

Option

Front 220

Is Action a component of the header or option portion of a Snort rule?

Back 220

Header

Front 221

Is Direction a component of the header or option portion of a Snort rule?

Back 221

Header

Front 222

Is Content a component of the header or option portion of a Snort rule?

Back 222

Option

Front 223

What can the Snort keyword option "flow" be used for?

Back 223

“to_server” is one acceptable option, Used only with TCP traffic, Indicates which traffic to analyze

Front 224

Assume you’re looking for the dirty-word “DIRTY”, in upper case, to appear somewhere in the first 20 bytes of the packet payload AND the word “business”, in any case, to appear somewhere within the next 30 byes following the appearance of “DIRTY”. Write a Snort rule.

Back 224

(content:”DIRTY”; depth:20; content:”business”; within: 30; nocase;)

Front 225

Assume you need to find a C2 bot that is delivering commands via any ICMP traffic and that infected machines respond within 5 minutes sending DoS attack traffic. Write a Snort rule that includes a tag option.

Back 225

alert icmp $EXTERNAL_NET -> $HOME_NET (tag: host, 300, seconds, dst;)

Front 226

When you used the tag options what type of file does it automatically create?

Back 226

PCAP

Front 227

What tag modifier defines the unit used to determine the amount of data to log, including seconds, packets, and bytes?

Back 227

metric

Front 228

What tag modifier determines how long the logging is to occur?

Back 228

count

Front 229

What tag modifier defines what will be logged when the rule is triggered, includes session or host?

Back 229

type

Front 230

What tag modifier defines directional flow of traffic to log and can only be used with host type?

Back 230

direction

Front 231

Botnets are grown in what type of iteration?

Back 231

segment

Front 232

What type of ports are bot-to-c2 communications typically on?

Back 232

standard/typical

Front 233

What are the three particular items that were recommended as deserving special attention regarding data exfiltration?

Back 233

Physical data exfiltration, encrypted data exfiltration, compressed data exfiltration

Front 234

Which phase of a worm/bot outbreak would a NIDS be least likely to detect the activity?

Back 234

Initial infection

Front 235

Write a Snort rule that would display the alert message “Attempt to run WIN32/64 executable remotely”. It should search for dirty-word content that would indicate either of the failure signatures for WIN32 or WIN64 going to any external port from any internal port.

Back 235

Alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:”Attempt to run WIN32/64 executable remotely”; content:”MZ”; offset:0; depth:2; content:”This program must be run under WIN”; within:120; nocase; tag:session,50,packets; sid:10000004; rev:2;)

Front 236

What does TTP stand for?

Back 236

Tactics, Techniques, and Procedures

Front 237

What does C/S/A stand for?

Back 237

Command/Service/Agency

Front 238

In the CNS Framework, which tier level provides support at the base, post, camp, or station?

Back 238

Tier Three

Front 239

What are the 3 primary CND services?

Back 239

Protect, Detect, and Respond

Front 240

According to this description of CND services, how often is the subscriber supposed to provide an updated network topology diagram?

Back 240

Semi-annually

Front 241

What does IAVA stand for?

Back 241

Information Assurance Vulnerability Alert

Front 242

Which CND Tiers support Red Teaming?

Back 242

Supported by Tiers 2 and 3

Front 243

What does COA stand for?

Back 243

Course of Action

Front 244

What CND tier includes local control centers that manage information systems at DoD installations?

Back 244

Tier 3

Front 245

What CND tier operates at the component level?

Back 245

Tier 2

Front 246

What CND tier includes USSTRATCOM?

Back 246

Tier 1

Front 247

What CND tier provides CND operational direction or support at the enclave level to DoD bases, posts, camps, and stations?

Back 247

Tier 3

Front 248

What CND tier includes agency and field activity CNDSPs?

Back 248

Tier 2

Front 249

What is the objectives of Incident Analysis?

Back 249

systematically capture the methods used in the attack and the security controls that could prevent future occurrences

Front 250

What does Incident Analysis try to understand?

Back 250

patterns of activity [in order to] characterize the threat and direct protective and defensive strategies

Front 251

What does incident analysis try to identify?

Back 251

root causes of incidents through technical analysis

Front 252

What actions can be taken with incident analysis?

Back 252

research actions that can be taken to respond to and eradicate the risk and/or threat

Front 253

What does incident analysis characterize and communicate?

Back 253

the potential impact of the incident, and to ensure the accuracy and completeness of incident reports

Front 254

What is central repository for storing malware and associated analysis?

Back 254

Joint Malware Catalogue (JMC)

Front 255

Who or what organization maintains the Joint Malware Catalogue (JMC)?

Back 255

USCYBERCOM

Front 256

What is considered a higher precedence: a user-level intrusion or a denial-of-service incident?

Back 256

User level intrusion

Front 257

What is the proper incident categorization (#) for a remote C2-controlled bot that gets installed on one of your systems?

Back 257

1—Root Level Intrusion and 2—User Level Intrusion

Front 258

You discover a user who is using USB drives on systems where this is prohibited by policy. What is the proper event categorization (#) for this?

Back 258

Non-Compliance Activity

Front 259

Which category of incident or event should you never see in any finalized (i.e. “closed”) report?

Back 259

8 - Investigating (Event)

Front 260

What is the primary method used to cause [or deliver…] the incident?

Back 260

attack vector

Front 261

You have detected a Syn-flood attack that appears to be originating from a single IP address. What (correct) attack vector category and sub-category (#+ltr) would you report this as?

Back 261

7 - Resource Exhaustion, A - Non-Distributed Network Activity

Front 262

It appears that an attacker has obtained one of your agency’s employee’s RSA SecureID (OTP) token and used it to access a sensitive agency file. What (correct) attack vector category and sub-category (#+ltr) would you report this as?

Back 262

6 - Transitive Trust, B - Masquerading

Front 263

Should you identify and mitigate the root cause prior to recovering or restoring any system.

Back 263

yes

Front 264

What are the four "classes" of impact?

Back 264

realized, potential, technical, and operational

Front 265

What type of effect does a low impact have?

Back 265

Limited

Front 266

What type of effect does a moderate impact have?

Back 266

Serious

Front 267

What type of effect does a high impact have?

Back 267

Severe/Catastrophic

Front 268

The Incident and Reportable Event Categories matrix supports which step of the methodology?

Back 268

Validate the Incident

Front 269

Further analyzing the incident information to expand on the initial assessment is part of which step?

Back 269

Determine Impact

Front 270

Systematically recording and categorizing major classes of security controls is part of which step?

Back 270

Determine System Weaknesses

Front 271

Identifying and collecting all relevant information about the incident for use in your incident analysis is part of which step?

Back 271

Gather Information

Front 272

Which step expands upon the identified attack vectors and system weaknesses by identifying conditions that allowed the incident to occur?

Back 272

Identify Root Causes

Front 273

Of the 5 primary types of analysis presented, which is most directly employed to conduct the initial triage on the incident?

Back 273

Volatile Data Analysis

Front 274

As an incident analyst, you must (should) keep what in mind through all of your analysis efforts?

Back 274

correlation

Front 275

What 3 locations are considered a location/media for volatile data?

Back 275

Chipset registers, System RAM, and System (L1 or L2) caches

Front 276

At any point in time, the exact “array” of specific values that represent (captures) exactly what the machine is doing, is referred to as the what of the system/machine?

Back 276

integrity/state

Front 277

What is the opposite of volatile data?

Back 277

Persistent Data / Non-volatile data

Front 278

Disk imaging should not only collect/preserve a target disk’s files, including deleted, hidden and swap files; but also accurately capture what two types of space?

Back 278

slack and unallocated

Front 279

Malware should be investigated in an isolated environment that will protect against accidental further infection. This isolated environment is generally referred to as a what?

Back 279

sandbox

Front 280

Which level of malware analysis is intended to determine the basic nature and intent of the malware?

Back 280

Surface

Front 281

Which level of malware analysis provides a high degree of confidence with respect to understanding adversarial intent via direct executable code analysis?

Back 281

Static

Front 282

Which level of malware analysis provides the most in-depth analysis that can provide a definitive understanding of the malware?

Back 282

Reverse Engineering

Front 283

Which level of malware analysis entails “black box” level analysis?

Back 283

Behavioral

Hint 283

Hopefully you recall the notion of black- vs glass-box analysis of any system

Front 284

Which level of malware analysis entails running the malware in a sandbox environment with the goal of developing an initial idea of adversarial intent?

Back 284

Run-time

Front 285

What 4 things does forensic analysis identify and confirm?

Back 285

compromises , infection vectors and security violations and may also generate additional indicators and recommendations for intrusion detection and prevention

Front 286

What is the main distinction between the two overlapping fields of forensics analysis and “Other types” (e.g., Intrusion/Incident) of analysis?

Back 286

Forensic Analysis is focused on processing and preserving authenticity and integrity of data while other types are focused on gaining a technical understanding.

Front 287

Which type of analysis gathers and reviews all information from or about the affected system or systems to further incident analysis and better understand the full scope of the incident?

Back 287

System/host analysis

Front 288

Which type of analysis combines elements of law and computer science to collect and analyze data from computer system, networks, wireless communication devices, and storage devices in a way that is admissible as evident in a court of law?

Back 288

Forensic analysis

Front 289

Which type of analysis collects, examines, and interprets network traffic to identify and respond to incidents affecting networked resources?

Back 289

Network analysis

Front 290

Which type of analysis analyzes and captures the capabilities of software artifacts suspected of being malicious code?

Back 290

Malware/binary analysis

Front 291

Which type of analysis involves pattern matching, protocol analysis, and statistical anomaly detection?

Back 291

Network/traffic analysis

Front 292

Which type of analysis involves behavioral analysis, run-time analysis, and reverse engineering?

Back 292

Malware/binary analysis

Front 293

Which type of analysis involves analysis of volatile and persistent (non-volatile) data?

Back 293

System/host analysis

Front 294

Which type of analysis involves collection, examination, analysis, and reporting as the primary phases in its analysis process?

Back 294

Forensic analysis

Front 295

Which type of analysis involves analysis of logs, files, processes and connections?

Back 295

System/host analysis

Front 296

Which type of analysis must be conducted in isolation?

Back 296

Malware/binary analysis

Front 297

What type of analysis activity is related to surface analysis?

Back 297

Malware/binary analysis

Front 298

What type of analysis activity is related to correlation between data types?

Back 298

Network/traffic analysis

Front 299

What type of analysis activity is related to analysis of open sockets and ports?

Back 299

System/host analysis

Front 300

What type of analysis activity is related to wire speed network packet capture?

Back 300

Network/traffic analysis

Front 301

What type of analysis activity is related to reverse engineering?

Back 301

Malware/binary analysis

Front 302

What type of analysis activity is related to configuration settings?

Back 302

System/host analysis

Front 303

Which level of malware analysis involves quick checks to character the sample?

Back 303

surface analysis

Front 304

Which level of malware analysis involves controlled execution of the malware sample in an isolated environment to monitor, observer, and record run-time behavior?

Back 304

run-time analysis

Front 305

Which level of malware analysis involves execution of the malware in a sandbox to observe its interactions with the environment?

Back 305

behavioral analysis

Front 306

Which level of malware analysis involves examining and interpreting the contents of the malware sample to determine adversarial intent with a high degree of confidence?

Back 306

static analysis

Front 307

Which level of malware analysis is the most in-depth method of analysis?

Back 307

reverse engineering

Front 308

Why do you think Snort made the determination of “potentially malicious” regarding the 3rd alert shown (“POLICY Inbound . . . attempt”)?

Back 308

The packet data shows an internal system connecting to an external IP via an HTTP GET request for an LNK file. LNK files are subject to many security vulnerabilities.

Hint 308

This is directly addressed in the audio commentary, and has to do with “payload” information (full packet data) and a particular file type. You may be interested in researching the meaning of a .lnk file to better understand this.

Front 309

What is it about the top-most Snort alert that would likely have gotten your attention?

Back 309

VNC is virtual network computing which is a way to access a desktop remotely and it is from an external IP

Hint 309

Do you think remote desktop access is likely something your (professional) C/S/A is going to permit across your network perimeter? Here the alert data is the primary cue.

Front 310

What piece of session type data was involved in this example that would likely have raised an analyst’s eyebrow?

Back 310

The source port is also the default port for Metasploit (4444) which is an open source exploitation framework often used by threat actors.

Front 311

I argue that 2 of the 6 bullets presented have little to do with determining if any other of your other systems are vulnerable. Which two address awareness of the existence of vulnerabilities, vice awareness of whether they exist on any of your systems?

Back 311

Consult IAVAs, IAVBs, and IATAs identified and distributed by DoD-CERT and review latest VAA results and Review latest red team assessments (CNDSP) of potentially affected systems

Front 312

What does IAVA, IAVB and IATA stand for, and which DoD agency issues them.

Back 312

Information Assurance Vulnerability Alert (IAVA), Information Assurance Technical Advisory (IATA), and Information Assurance Vulnerability Bulletin (IAVB) is issued by DOD-Computer Emergency Response Team (DOD-CERT)

Front 313

Defense-in-depth is discussed here. Which of these firewall rules would prevent this attack (as it was conducted in this incident), and would present an additional layer in your defensive posture?

Back 313

deny tcp any eq 4444 any any

Hint 313

Recall the basic ACL syntax: permit/deny sIP sPort dIP dPort

for traffic leaving your network

Front 314

Which element(s) of the CIA-Triad does MAC address?

Back 314

Integrity and Availability