Test your basic knowledge |

Instructions:
  • Answer 50 questions in 15 minutes.
  • If you are not ready to take this test, you can study here.
  • Match each statement with the correct term.
  • Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Uses inclusive or exclusive lists - inclusive analysis utilizes a list of keywords - exclusive analysis utilizes a list of events that can be ignored






2. It handles the establishment and maintenance of connections between systems






3. An FTP that allows downloads only if the user knows the exact name of the file they're looking for






4. Publish separate mail - web - and DNS servers to the internet - provide appropriate access from internal network to internet - protect internal from external attack - provide defense in depth - protect all aspects of the system






5. Spread as an office attachment with executable code programmed using macro facility - targets are data files - visual basic editor and other macro languages - payload executes when the code is launched






6. Trivial File Transfer Protocol - method to transfer files from one device to another without needing authentication






7. War dialing - war driving - Sniffing - eavesdropping - dumpster diving - social engineering






8. CIDR is a shorthand way of specifying which portion of the address is the network - and which portion is the host






9. Uniform protection - protected enclaves - information centric - threat vector analysis






10. Combines the functionality of a hub and bride into a single device - keeps track of MACs attached to each port






11. Simplest form of a research honeypot - useful in identifying nature of TCP scans - allows attacker to complete 3-way handshake - listens on a defined port - logs incoming requests for analysis






12. Personal area network - phone tethering - bluetooth - etc






13. OSI






14. Attacks systems through known vulnerabilities - automatically scans for more systems to attack - lowers system defenses - installs rootkit or root shell - opens up back doors - self contained malware that can copy itself






15. Means multiple iterations won't matter. If you encrypt with a key - then re-encrypt - it's the same as using one key.






16. Protected at rest - protected in transit - secure the key






17. Provides insight into the tactics - motives - and attacker tools






18. local area network - small network confined to small location - all equipment owned by a single entity - vulnerable to inside threats and logic bombs






19. Confidentiality - integrity - availability






20. A low end firewall that can quickly be deployed using existing hardware. They examine packets themselves with no content.






21. Considered to be a perimeter device






22. flags anomalous conditions in traffic on the network - requires understanding on what is normal - bases good traffic as a baseline






23. A list of files is defined that should be monitored for a change - HIDS software calculates a one-way hash for each file - if a change is made to the file - the hash is changed






24. A system resource that has no legitimate purpose or reason for someone to connect to it - its purpose is to draw in attackers to understand how they break into a system






25. Most commonly used transport protocol today - ensures reliable packet delivery - has error handling built in






26. Small program triggered by an event that provides an action. E.g. scheduled file removal if countdown isn't reset - ie: employee was fired






27. Attaches itself to existing program files and activated when the exe is launched






28. FIN 130 - ACK 131 - FIN 570 - ACK 571






29. Unencrypted message in its original form






30. Syn - Syn/Ack - Ack






31. Allows admins to remotely access a system for troubleshooting. - E.g VNC - GoToMyPc - PC Anywhere






32. UDP based infection - infected through vulnerability in SQL server - caused DoS on saturated networks






33. An appliance that controls access between public internet and a companies private network - or between a PC NIC and the rest of the PC.






34. Strips OS commands and characters from input - avoid making system calls from within the app * especially based on user input






35. A TCP version of ping - sends custom TCP packets to a host and listens for replies - enables port scanning and spoofing simultaneously






36. Uses a 1 to 1 substitution of arbitrary numbers - given a one character mapping - you cannot determine the key






37. Network scanner.






38. open source tool for monitoring - can be used as a NIDS - has quick updates and flexibility for custom rules






39. 8 bytes per packet - UDP SRC port - UDP DST Ports - UDP length - UDP Checksum






40. When someone has compromised the integrity of data or a program. Allows attackers to create backdoors.






41. NTP - BootP/DHCP - NFS file systems - SNMP - TFTP






42. 128.0.0.0 through 191.255.255.255 - with a subnet mask of 255.255.0.0






43. 53 bytes - 48 bytes for data - 5 bytes for the header






44. Threat requires a vector to cross the vulnerability - stop the ability of the threat to use the vector






45. Physical layer - Data link layer - Network Layer - Transport Layer - Session Layer - Presentation Layer - Application Layer






46. An agreement on how different computer will work - protocols define the format and order of messages and what to do upon receipt of the messages - basically the rules of the network






47. A hash is produced when applied to a monitored file. The hash always generates the same value unless a change was made. HIDS software checks the hashes of monitored files and if a change is found - analyst is notified. - ie: tripwire






48. Very simplistic. All systems are attached to the same cable segment. Rarely used because they're unreliable - low fault tolerance - poor traffic isolation - with limited scalability






49. Connects many WANs - MANs - and LANs - provided via ISP






50. Attempt to manipulate or trick a person into providing information or access - bypass network security by exploiting humans - vector is often outside attack by telephone or visitor inside