Chapter 4 Review (Cyber)

An indicator that malicious activity is occurring but is still in the early stages

• Indicator of compromise

• key risk indicators

Anything that could be freely used without restrictions

• closed source

• open source

• public information sharing centers

• technical exchange

While going through the network log, Sarah, a network security administrator, noticed substantial outbound network traffic. Which activity did Sarah perform?

• STIX

• IOC

• Telnet

• HTTP

A company monitors the network activity of the organization and stores the logs in a database. You have been asked to identify whether there are any malicious activities in the network. Which of the following can denote the upper and lower bounds of their various network activities?

• KRI

• TTP

• OSI Model

• Threat maps

A company has its network compromised. As an expert professional, the organization has hired you to identify the probable cause of the attack and fix it. As a security professional, you have noticed the pattern of compromise is unlike anything previously seen. You are looking to find new information on vulnerabilities like the attack that occurred.

Which of the following actions would help achieve this objective?

• Checking the green web

• Checking the dark web

• Checking the surface web

• Implementing TCP/IP protocol across the network

Which HTTP response header should be used to prevent attackers from displaying their content on a website

• HSTS

• CSP

• X-XSS

• X-Frame-Option

An organization is planning a revamp of the existing computer hardware with new ones. The IT manager has informed department heads that some computers have faced BIOS attacks in the past. He has requested help in preventing future BIOS attacks.

• implement BIOS supplemented with CMOS

• Use computers with flash memory for booting instead of BIOS

• Implement a Norton Antivirus solution

• Implement measured boot with UEFI

What additional measure should be enacted to increase the security on a computer network after secure boot, protective measures from attacks like antimalware, and intrusion detection systems are implemented in all the computers on the network?

• Implement an antivirus solution in all systems and servers

• Implement hardening at endpoints with patch management and operating system safeguards

• Disable operating system patch updates to prevents malicious attacks

• Disable connections on the Wi-Fi network

What is meant by "the chain of trust" in boot security?

• Each step in the boot sequence relies on the confirmation of the hardware root of trust

• Each step in the boot sequence relies on the confirmation from the previous boot sequence step.

• Each step in the boot sequence relies on the operating system logs of the previous boot sequence for boot security

• Each step in the boot sequence follows its own process independently, trusting the previous sequence step

Which of the following is a disadvantage of the secure boot process?

• It does not validate the boot process

• It requires an operating system like Microsoft OS to ensure secure boot

• It slows down considerably, affecting the performance of the computer

• It makes third party non vendor approved software difficult to implement.