Deck 9: Reacting to a Cyber Incident: Analyzing Common Symptoms

Question 1

_______________ occurs when infected devices attempt to contact a threat actor's external command and control (C&C) server.

Answer 1

Beaconing

Question 2

What is a sudden, unusual surge in network bandwidth use called?

A) Spike
B) Bolus
C) Peak
D) Apogee

Answer 2

A

Question 3

What is a named pipe?

Answer 3

A logical connection (like a TCP session) between a client and server that use Server Message Block.

Question 4

Which of the following is not a network symptom of an attack?

A) Stealth transmissions
B) Memory overflows
C) Scan sweeps
D) Unauthorized network devices

Question 5

What is the term for thousands of bot computers that are gathered into a logical computer network?

A) Botstorm
B) Botnique
C) Bot herd
D) Botnet

Question 6

Name a tool that can be used to determine if a cyber incident is taxing a processor's resources.

Question 7

Attackers have no reliable way to take advantage of a processor with multiple cores.

Question 8

What is the act of changing operating system settings or exploiting a software vulnerability to access resources that users normally would be restricted from accessing?

Question 9

What kind of attack occurs when a process attempts to store data in RAM beyond the boundaries of a fixed-length storage buffer?

A) Source overflow
B) Integer overflow
C) Buffer overflow
D) Address overflow

Question 10

In the context of cybersecurity, DLP is an abbreviation for which of the following?

A) data log propagation
B) data loss prevention
C) digital loss prevention
D) digital limit processing