Cyber Exam 1

Confidentiality, Integrity, Availability

To keep data private and secret.

To ensure data is accurate and untampered with.

To ensure systems and data are accessible when needed.

Authentication, Authorization, Accounting

To prove who you are.

To determine what you are allowed to do.

To track user actions through logging and auditing.

Anything that can exploit a vulnerability (e.g., a hacker).

A weakness in a system (e.g., unpatched software).

The potential for loss or damage (Risk = Threat x Vulnerability).

A safeguard to reduce risk (can be physical, technical, or administrative).

Malware that attaches to a legitimate program and spreads.

Self-replicating malware that spreads without user intervention.

Malware disguised as legitimate software.

Malware that locks systems or data until a ransom is paid.

Malware that secretly gathers information.

A Distributed Denial-of-Service attack that overwhelms a system with traffic from multiple sources.

An attack that intercepts and potentially alters communication between two parties.

Sending fake ARP messages to link an attacker's MAC address to a legitimate IP.

Corrupting the DNS cache to redirect traffic to a malicious site.

Injecting malicious SQL code to manipulate a database.

Injecting malicious scripts into webpages viewed by others.

Tricking a user into executing unwanted actions on a web app they're authenticated to.

Fraudulent emails or messages attempting to steal information.

Targeted phishing at a specific individual or organization.

Phishing conducted over the phone (voice phishing).

Physically following someone into a secure area.

Encryption that uses one key for both encryption and decryption.

Secure key distribution.

Encryption that uses two keys (Public and Private).

A one-way function that creates a unique, fixed-size fingerprint of data, used for integrity.

A method to prove integrity and non-repudiation, created by hashing a message and encrypting the hash with a private key.

Non-repudiation.

To control traffic between networks based on a set of rules.

A stateful firewall understands connection states, while a stateless firewall only looks at individual packets.

A system that monitors and alerts on suspicious activity (Passive).

A system that monitors and actively blocks suspicious activity (Active).

A technology that creates a secure, encrypted tunnel over a public network.

Secure Shell, used for encrypted remote access.

Because it transmits data, including passwords, unencrypted.

The Domain Name System, which translates domain names to IP addresses.

HTTPS is encrypted, HTTP is not.

Preparation.

Identifying and understanding the incident.

Containment, Eradication, & Recovery.

Post-Incident Activity.

The host received the packet and replied with an ICMP "port unreachable" packet, meaning no application is listening.

The packet was sent, but no reply was received, typically because a firewall dropped it.

The host sent a reply, suggesting an application is listening on that port.

The port is accessible, but Nmap cannot determine if it is open or closed.

Nmap cannot determine if the port is open or filtered (no response was received).

Nmap cannot determine if the port is closed or filtered.

A network attack where an attacker sends fake ARP messages to associate their MAC address with a legitimate IP address on the network.

To redirect network traffic through the attacker's machine for interception or manipulation.

In the /etc/shadow file, which is only readable by root.

For enhanced security - the shadow file has restricted access while /etc/passwd is world-readable.

Radio-Frequency Identification, technology that uses electromagnetic fields to automatically identify and track tags attached to objects.

Near Field Communication, a subset of RFID that enables short-range communication between devices (typically < 10cm).

RFID can work over longer distances (up to 100m), while NFC is limited to very short range (< 10cm).

Encryption that uses the same key for both encryption and decryption (e.g., AES, DES).

Encryption that uses a pair of keys - public key for encryption and private key for decryption (e.g., RSA, ECC).

It solves the key distribution problem - public keys can be freely shared.

A command-line utility for searching plain-text data sets for lines that match a regular expression.

Searching through log files for specific patterns, IP addresses, or error messages.

The process of extracting information about network resources, shares, users, groups, and other network details.

User names, group names, network shares, services, and other system details.

Scanning discovers live hosts and open ports, while enumeration extracts detailed information about the discovered resources.

grep "Failed password" /var/log/auth.log

Nmap (with scripts like nbtstat, smb-enum-shares, etc.)

Because it stores password hashes with additional security features like salting and is only accessible by privileged users.