Generic Security Concepts Review

1
Generic Security Concepts Review

• Q What is the CIA triad, what does each mean?
• Q What is non-repudiation?
• Q Define Layered Security
• Q What is the main security reasoning for
  mandatory vacations?

2
Generic Security Concepts Review

• Q What type of authentication system does the OS
  (Security Kernel) determined who is allowed
  access to a resource
• Q What access control model helps fight
  authorization creep
• Q Biometrics are an example of What you ____
• Q What is a better security model, network based
  or host based?

3
Chapter 2 Review Questions

• Q. What is the best countermeasure against
  phishing attacks?
• Q. Why is a hoax still a security concern?
• Q. Installing camera to read credit card numbers
  at gas pumps is what type of attack?
• Q. Does an Organization Security Policy Statement
  detail specifics such as how to properly encrypt
  data?

4
Chapter 2 Review Questions

• Q. What is the difference between Due Diligence
  and Due Care?
• Q. What is the term for a set of required steps
  to be taken when doing some action called?

5
Cryptography review

• Q. Which of the CIA triad does a hash provide?
• Q. An HMAC is used to try to prevent MiM attacks.
  Does a HMAC provide non-repudiation?
• Q. Why dont we just use Asymmetric Encryption
  for all encryption?
• Q. What is Diffie-Hellman primarily used for?

6
Cryptography review

• Q. What is AES meant to replace, what is the
  algorithm that was chosen to be AES?
• Q. True or false, If I encrypt a message with
  someone's public key, anyone with the public key
  can decrypt it.
• Q. What is the Asymmetric algorithm commonly used
  in PDAs and cell phones?
• Q. How many rounds does triple DES have?

7
PKI review questions

• Q. What is a digital certificate generally
  analogous to?
• Q. What are the two most important pieces of info
  in a digital certificate
• Q. Why would you use multiple certificates
• Q. If you have 100 users, in a 2 certificate
  model (encryption signing) how many total keys
  do you have?

8
PKI review

• Q. What is key escrow
• Q. How do I validate the identity of a
  certificate that someone has given me? When does
  the validation chain end?
• Q. What version of X.509 were extensions added?
• Q. My certificate has been revoked, how do I
  un-revoke it

9
Physical Security Review

• Q. What feature can allow a windows computer to
  automatically run a Trojan program on an inserted
  CD or USB drive
• Q. Which of the following water based automatic
  fire suppression systems would be best used for a
  data center.
• Q. Why is access to a network jack a risk?
• Q. What is the CER in terms of biometrics
• Q. What is a type 1 and type 2 error?

10
Physical Security Review

• Q. If providing access to a bank vault, would I
  prefer higher false positives or higher false
  negatives?
• Q. What type of fire rating is electrical fires?
• Q. What is the difference between smart cards and
  memory cards.
• Q. What type of motion sensor detects a human
  through emanated heat?

11
Chapter 8 - Review

• Q. What layer of the OSI model does a switch
  operate at, what addresses does it switch
• Q. What layer of the OSI model does a router look
  at, what addresses does it route
• Q. What is the purpose of MAC flooding?
• Q. What is a DNS poisoning attack.

12
Chapter 8 Review

• Q. What is a Bastion Host
• Q. What is the purpose of a DMZ
• Q. What is NAC/NAP?
• Q. What is the main purpose of a circuit layer
  proxy.
• Q. How is an application layer proxy different
  than a circuit layer proxy?

13
Chapter 9 Review Questions

• Q. Name the 3 AAA protocols we talked about
• Q. Which of the following items does Kerberos
  use.
• Shared keys
• Tickets
• Public keys
• Digital signatures
• Q. Does L2TP use TCP or UDP?
• Q. Explain the difference between CHAP and PAP

14
Chapter 9 Review Questions

• Q. What protocol (TCP/UDP) does Radius use, how
  about TACACS
• Q. Why is Telnet bad?
• Q. What is the purpose of a VPN?
• Q. What protocol does PPTP require for operation?

15
Chapter 10 Review Questions

• Q. What encryption protocol does WEP use
• Q. What 2 key lengths does WEP support
• Q. What encryption protocol does WPA2 use?
• Q. Why is MAC filtering or turning off SSID
  broadcasting not sufficient security?
• Q. What does WAP use for security?

16
Chapter 10 Review Questions

• Q. What is the WAP GAP
• Q. Define how to accomplish a MiM attack on a
  wireless network
• Q. What type of authentication concept would help
  against the attack above?
• Q. What is one way office users could use
  wireless to violate network security?
• Q. What is Bluetooth used for?
• Q. What is Bluesnarfing?

17
Chapter 11 - IDS

• Q. What is an IDS?
• Q. What is the difference between an HIDS and a
  NIDS
• Q. What is the difference between a IDS and an
  IPS?
• Q. What are two types of IDS detection, explain
  them?

18
Chapter 11 - IDS

• Q. What is the purpose of a honey pot?
• Q. If an IDS detects traffic coming in from the
  internet with internal IP addresses as the src
  addresses, why should I be concerned?
• Q. Which is the first version of Windows that
  Windows Defender is shipped with? What other
  Windows OSes is it available for?
• Q. Can signature based scanning detect 0days
  attacks?

19
Chapter 12

• Q. What is a security baseline?
• Q. What is a windows feature that you can use to
  push computer settings to all computer in a
  domain?
• Q. What is a windows security template
• Q. Does a hot fix generally add new functionality
  to an OS or application?
• Q. What is system hardening?

20
Chapter 12

• Q. What is a buffer overflow
• Q. What are TCP wrappers?
• Q. Describe Unix File Permissions?

21
Chapter 12

• Define the ports numbers that the following
  services run on
• HTTP
• HTTPS
• SMTP
• IMAP
• POP
• FTP
• DNS

22
Chapter 13

• Q. What are the steps in a 3 way handshake
• Q. What is the difference between a virus and a
  worm
• Q. What is a SYN flood
• Q. What is a Smurf attack

23
Chapter 13

• Q. What is the concept of stealing another
  persons live TCP communication stream called.
• Q. What is a replay attack?
• Q. What is a root kit?
• Q. What is a vishing attack? (not phishing)
• Q. What is the best defense for phishing?

24
Chapter 13

• Q. What is a logic bomb
• Q. What is DDos
• Q. How are DDoS attacks usually launched?

25
Chapter 14

• Q. What is a problem with POP
• Q. What is a problem with IMAP
• Q. Is SMTP encrypted? Does is provide user
  authentication?
• Q.What is a real-time Black Hole List?

26
Chapter 14

• Q. What is greylisting?
• Q. What is S/MIME, which symmetric encryptions
  methods does it support
• _ _ 2 _ _ _ S
• Q. What PKI model does PGP use?

27
Chapter 15

• Q. Why is SSL used for websites? What does SSL
  and a website provide?
• Q. What is Active X, what access to your
  computers does Active X have?
• Q. What is Java
• Q. What is application signing?

28
Chapter 15

• Q. What does application signing provide?
• Q. What restrictions does Java place on unsigned
  applications?
• Q. Is safe to run ANY signed java/active X app?
• Q. Briefly define Cross Site Scripting (XSS)
• Q. Where does a CGI program run.

29
Chapter 16

• Q. What is a Hot Site
• Q. What is a warm site.
• Q. What is a cold Site.
• Q. What is the difference between a Hot Site and
  a Mirror Site

30
Chapter 16

• Q. What is a Full Backup
• Q. What is an incremental Backup
• Q. What is a differential Backup?
• Q. What is a continuous Backup?

31
Chapter 16

• Q. What is RAID0
• Q. What is RAID1
• Q. What is RAID5
• Q. If I have 4 disks each 30G in a RAID 5, how
  much actually usable storage do I have?

32
Chapter 17

• Q. Define EF
• Q. Define SLE
• Q. Define ARO
• Q. Define ALE

33
Chapter 17

• Q. Any countermeasure you deploy should
  ultimately be ______ _______
• Q. If my ALE for a threat is 50K a year, and a
  countermeasure to eliminate the threat costs 30K
  a year, should I implement it?
• Q. If my ALE is 50K a year, a countermeasure
  will reduce the ALE by 50, and the
  countermeasure costs 30K a year, should I
  implement it?

34
Chapter r17

• Q. What is residual risk
• Q. What is risk transference
• Q. What is risk avoidance
• Q. What is risk acceptance

35
Chapter 17

• Q. What is quantitative vs. qualitative risk
  analysis?
• Q. Can you get automated tools for quantitative
  analysis, how about qualitative analysis.
• Q. What is due diligence, due care?

36
Chapter 18

• Change management nothing really here

37
Chapter 19

• Q. What is role based access control
• Q. What is MAC? Where is it usually used?
• Q. What is DAC? Where is it usually used?
• Q. What is rule based access control?

38
Chapter 19

• Q. What is single sign on, name one SSO
  technology.
• Q. What is a minimum password age
• Q. What is a password history
• Q. Name the main components of Kerberos. Does
  Kerberos every send passwords across the network?
• Q. What is a major gotcha when debugging
  Kerberos login failures?

39
Chapter 20 Review Questions

• Q. What is the concept of best evidence
• Q. When you want to do forensics on a computer,
  you should make a copy of the hard drive. What
  type of copy should you make?
• Q. What is the MINIMUM number of copies you
  should make of the original hard drive

40
Chapter 20 Review Questions

• Q. Put these step of analysis in the correct
  order
• Analyze the Drive
• Power down the system
• Dump Memory
• Image the hard drive
• Q. Why do you run checksums/hashes on the
  original files before analysis?
• Q. Why should someone witness you as you collect
  the evidence?
• Q. What is the difference between free space
  and slack space