ECE 6015 Digital Forensic Mid Term Study Quiz Chapter 1

Question 1 of 37

1

Ensuring that only those who are authorized have access to specific assets and that those who are unauthorized are actively prevented from obtaining access.

Drag the answer into the correct orange point.

Confidentiality

Integrity

Availability

Explanation

Question 2 of 37

1

Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable.

Drag the answer into the correct orange point.

Availability

Integrity

Confidentiality

Explanation

Question 3 of 37

1

Ensuring that authorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running.

Drag the answer into the correct orange point.

Confidentiality

Integrity

Availability

Explanation

Question 4 of 37

1

Patch your systems regularly

Select one of the following:

Cyber hygiene
Non-repudiation
Data Integrity

Explanation

Question 5 of 37

1

Only installed signed software updates

Select one of the following:

Cyber hygiene
Non-repudiation
Data Integrity

Explanation

Question 6 of 37

1

Source code changes virtually undetectable

Select one of the following:

Cyber hygiene
Non-repudiation
Data Integrity

Explanation

Question 7 of 37

1

What is it Governance?

Select one or more of the following:

Policy
Regulations
Compliance
Oversight
Micro management

Explanation

Question 8 of 37

1

What is the role of the CISO?

Select one or more of the following:

Security Policy
Compliance
No sayer
Protect Corporate Secrets
Protect personal interest
Protect Information Assets
Business Enablement

Explanation

Question 9 of 37

1

The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

Select one of the following:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explanation

Question 10 of 37

1

Requirement for multiple people to authenticate in order to perform certain administrative tasks.

Select one of the following:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explanation

Question 11 of 37

1

Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point.

Select one of the following:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explanation

Question 12 of 37

1

A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.

Select one of the following:

Least privilege
Two Person Integrity
Network Separation
Enclave

Explanation

Question 13 of 37

1

1-10-60 Challenge
To effectively combat sophisticated cyberthreats:

Select one or more of the following:

Detect intrusions in under one minute.
Investigate and understand threats in under 10 hours.
Contain and eliminate the adversary from the environment in under 60 minutes.
Detect intrusions in under one hour.

Explanation

Question 14 of 37

1

The time an attack goes undetected (i.e., the delta between intrusion and detection).

Select one of the following:

Dwell Time
Advanced Persistent Threat

Explanation

Question 15 of 37

1

Select from the dropdown list to complete the text.

( Advanced Persistent Threat (APT), Gain Access, 1-10-60 Challenge ) attack uses continuous, clandestine, and sophisticated hacking techniques to gain access to a system and remain inside for a proloned period of time, with potentially destructive consequences.

Explanation

Question 16 of 37

1

Five Stages of an Evolving APT Attack

Select one or more of the following:

Gain Access
Establish a Foothold
Deepen Access
Move Laterally
Look, Learn, and Remain
Move Horizontally
Shallow Access
Detection
Remain calm then panic

Explanation

Question 17 of 37

1

Select from the dropdown lists to complete the text.

Stage 1: ( Gain Access, Look, Learn, and Remain )
Like a burglar forcing open a door with a crowbar, cybercriminals usually gain entry through a ( network, front door ), an infected ( file, router ), junk email, or an app ( vulnerability, hardening ) to insert ( malware, firewall ) into a target network.

Explanation

Question 18 of 37

1

Select from the dropdown lists to complete the text.

( Functional Testing, Performance/Load Testing, Penetration Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets all functional requirements – ( Availability, Confidentiality ) and ( Integrity, Confidentiality )

Explanation

Question 19 of 37

1

Select from the dropdown lists to complete the text.

( Performance/Load Testing, Penetration Testing, Functional Testing ): Test cases performed to confirm the system operates as it was designed/specified and meets performance requirements under a real or simulated load - ( Availability, Confidentiality )

Explanation

Question 20 of 37

1

Select from the dropdown list to complete the text.

( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

Explanation

Question 21 of 37

1

Identify the Incident Response in the MITRE Framework

Drag an answer into the correct orange point.

Preparation

Post-Incident Activity

Containment

Detection

Eradication/Recovery

Eradication/Recovery1

Containment1

Explanation

Question 22 of 37

1

Select from the dropdown list to complete the text.

( Preparation, Panic, Trainning ): Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.

Explanation

Question 23 of 37

1

Preparation step include:

Select one or more of the following:

Create incident response plan
Train the team
Acquire tools
Prepping the environment for defense (hardening) and altering
Practice
Determine the root cause
Alter system configuration

Explanation

Question 24 of 37

1

Select from the dropdown list to complete the text.

( Detection, Preparation, Analysis ): Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.

Explanation

Question 25 of 37

1

Select from the dropdown lists to complete the text.

Detection sources can include:
( Activity logs, Retrospective ): A security analyst may receive an alert that a specific administrator account was in use during the time where the administrator was on vacation.
( External sources, Internal users ): An ISP or law enforcement agency may detect malicious activity originating in an organization's network and contact them and advise them of the situation.
( Internal users, External sources ): An employee contacting the help desk and informing agent that services are no longer available, or files are suddenly encrypted

Explanation

Question 26 of 37

1

Incident response coordinator: Individual often has overall responsibility for the security of the organization's information; responsible for management of the CSIRT prior to, during, and after an incident

Select one or more of the following:

Chief Security Officer (CSO)
Information Security Officer (ISO)
Chief Information Security Officer (CISO)
Chief Executive Officer (CEO)
Chief Financial Officer (CFO)

Explanation

Question 27 of 37

1

Select from the dropdown lists to complete the text.

( CSIRT senior analyst(s), Incident response coordinator, Security operations center analyst, CSIRT analyst(s): ): Personnel with ( extensive, minimal ) training and experience in incident response, digital forensics, network data examination

Explanation

Question 28 of 37

1

CSIRT senior analyst(s):

Select one or more of the following:

Often take part in training junior personnel
Engage with other CSIRT members to acquire and analyze evidence, direct containment activities, and assist other personnel with remediation
Has overall responsibility for the security of the organization's information.

Explanation

Question 29 of 37

1

Select from the dropdown lists to complete the text.

( CSIRT analyst(s), Security operations center analyst, Legal ): Personnel with CSIRT responsibilities that have ( less, extensive ) exposure or experience in incident response activities

Explanation

Question 30 of 37

1

Select from the dropdown lists to complete the text.

( Security operations center analyst, CSIRT analyst(s), Chief Information Security Officer (CISO ): Analysts assigned to the 24/7 Security Operations Center (SOC) ( monitoring, reporting ) capability; serve as the point person when it comes to incident ( detection, isolation ) and alerting.

Explanation

Question 31 of 37

1

Select from the dropdown lists to complete the text.

( Organizational support personnel, Tech support personnel, IT security engineer(s) / analyst(s) ): Assist with a variety of ( non-technical, technical ) issues that fall outside those that are addressed by the CSIRT core and technical support personnel.

Explanation

Question 32 of 37

1

Organizational support personnel include:

Select one or more of the following:

Legal
Engineering
Human Resources
Marketing / Communications
Transportation
Facilities
Corporate Security
Finance

Explanation

Question 33 of 37

1

Devoting time and resources to implement security controls that are irrelevant to the threats the organization is trying to mitigate.

Select one or more of the following:

Mismatching Control to Threat
Alert Fatigue

Explanation

Question 34 of 37

1

Select from the dropdown lists to complete the text.

Stage 2: ( Establish Foothold, Gain Access, Move Laterally, Look, Learn, and Remain, Deepen Access )
Cybercriminals implant ( malware, anti virus ) that allows the creation of a network of ( backdoors, hardening ) and tunnels used to move around in systems ( undetected, detected ).
The malware often employs techniques like rewriting code to help hackers ( cover, expose ) their tracks.

Explanation

Question 35 of 37

1

Select from the dropdown lists to complete the text.

Stage 3: ( Deepen Access, Move Laterally, Gain Access, Look, Learn, and Remain, Establish Foothold )
Once inside, hackers use techniques such as password cracking to gain access to ( administrator, user ) rights so they can control more of the system and get even ( greater, lesser ) levels of access.

Explanation

Question 36 of 37

1

Select from the dropdown lists to complete the text.

Stage 4: ( Move Laterally, Deepen Access, Establish Foothold, Gain Access, Look, Learn, and Remain )
Deeper inside the system with ( administrator, user ) rights, hackers can move around at will. They can also attempt to access other servers and other secure parts of the network.

Explanation

Question 37 of 37

1

Select from the dropdown list to complete the text.

Stage 5: ( Look, Learn, and Remain, Move Laterally, Gain Access, Deepen Access, Establish Foothold )
From inside system, hackers understand how it works and its vulnerabilities
Harvest the information they want at will.
Hackers keep this process running indefinitely or withdraw once they accomplish a specific goal.
They often leave a back door open to access the system again in the future.

	Created by Marjorie Blanco about 3 years ago

This is quiz for midterm

ECE 6015 Digital Forensic Mid Term Study Quiz Chapter 1

Question 1 of 37

Ensuring that only those who are authorized have access to specific assets and that those who are unauthorized are actively prevented from obtaining access.

Drag the answer into the correct orange point.

Explanation

Question 2 of 37

Ensuring that data have not been tampered with and, therefore, can be trusted. It is correct, authentic, and reliable.

Drag the answer into the correct orange point.

Explanation

Question 3 of 37

Ensuring that authorized users have timely, reliable access to resources when they are needed - networks, systems, and applications are up and running.

Drag the answer into the correct orange point.

Explanation

Question 4 of 37

Patch your systems regularly

Select one of the following:

Explanation

Question 5 of 37

Only installed signed software updates

Select one of the following:

Explanation

Question 6 of 37

Source code changes virtually undetectable

Select one of the following:

Explanation

Question 7 of 37

What is it Governance?

Select one or more of the following:

Explanation

Question 8 of 37

What is the role of the CISO?

Select one or more of the following:

Explanation

Question 9 of 37

The principle that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

Select one of the following:

Explanation

Question 10 of 37

Requirement for multiple people to authenticate in order to perform certain administrative tasks.

Select one of the following:

Explanation

Question 11 of 37

Separation of network into separate mini-networks/segments with distinct security boundaries and protection profiles to limit ability to “pivot” from entry point.

Select one of the following:

Explanation

Question 12 of 37

A set of system resources that operate in the same security domain and that share the protection of a single, common, continuous security perimeter.

Select one of the following:

Explanation

Question 13 of 37

1-10-60 Challenge To effectively combat sophisticated cyberthreats:

Select one or more of the following:

Explanation

Question 14 of 37

The time an attack goes undetected (i.e., the delta between intrusion and detection).

Select one of the following:

Explanation

Question 15 of 37

Select from the dropdown list to complete the text.

Explanation

Question 16 of 37

Five Stages of an Evolving APT Attack

Select one or more of the following:

Explanation

Question 17 of 37

Select from the dropdown lists to complete the text.

Explanation

Question 18 of 37

Select from the dropdown lists to complete the text.

Explanation

Question 19 of 37

Select from the dropdown lists to complete the text.

Explanation

Question 20 of 37

Select from the dropdown list to complete the text.

Penetration Testing Performance/Load Testing Functional Testing( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

Explanation

Question 21 of 37

Identify the Incident Response in the MITRE Framework

1-10-60 Challenge
To effectively combat sophisticated cyberthreats:

( Penetration Testing, Performance/Load Testing, Functional Testing ): Test cases performed to simulate intrusion by an intentional or unintentional cyber threat actor – Confidentiality and Availability (perhaps some Integrity)

( Preparation, Panic, Trainning ): Without good preparation, any subsequent incident response is going to be disorganized and has the potential to make the incident worse.

( Detection, Preparation, Analysis ): Process where the organization first becomes aware of a set of events that possibly indicates malicious activity. Depending on the size, an org may receive >100 million events per day.

( CSIRT analyst(s), Security operations center analyst, Legal ): Personnel with CSIRT responsibilities that have ( less, extensive ) exposure or experience in incident response activities