Cyber Warrior Quiz 1

Which of the followings can be attacked by virus or scams?

• Computer

• Mobile phone

• Anyone

• Servers

Which of the followings is(are) typical network devices?

• Computer

• Server

• Router

• IP phone

• Cloud Service

Which of the followings show(s) your computer might be attacked by virus?

• Computer freezes frequently

• Files are suddenly missing

• C drive space is small due to games installed

• Computer beeps with no display

Select the good practice(s) that help to prevent Virus, Worms or Trojan

• Avoid clicking links in emails or text messages from unknown senders

• Install security updates and patches for software

• Run antivirus software to scan the computers

• Do not plug in USB device from strangers to your computer

What Firewall can do to protect your network?

• Firewall can set policy to allow or deny access

• Firewall can block social engineering

• Firewall can collect information on use or misuse of the network

• Firewall can prevent internal network intrusion

Which of the followings is a strong password?

• WeiJie123

• 20050608

• WJ@tc1_#

• dkitdTKs

What is the standard Port number for connecting to a web server?

• 20

• 40

• 60

• 80

Summarise the key information about this incident below for reporting to your management:

You are a member of the Incident Response Team at a bank. The bank has over 300 thousand hosts, ATMs, card processing and SWIFT. The bank's services are used by a wide range of clients from students to large industrial organisations. Most of the bank's infrastructure runs on Windows, the smaller part on UNIX machines. You discovered that an advertisement for the sale of your bank's customer information has been published on the darknet, and you need to pay a ransom fee in order to access your remote network. The bank cannot be disconnected from the Internet; it is necessary to minimize the impact of the attack on business processes. Your task as a group is to identify what has happened to your system and take actions to save the situation.

• Bank's customer data published on darknet

• Bank's network system is shut down by darknet

• Bank's infrastructure system on Windows and Unix is down

• Bank's incident response team found an advertisement on darknet

What are the first level actions you can take for the incident mentioned above in order to contain the damage of the attack?

• Buy the stolen data from the hacker

• Change all passwords of user access to servers

• Scan Windows and UNIX hosts with antivirus software

• Identify workstations that are allowed to access the Internet and shut them down

• Block all remote management software of the bank to prevent unauthorised access

For the incident mentioned above, how do you trace and check which server/systems have been attacked?

• Run antivirus scan on servers and check the results

• Check new user accounts with elevated privileges to access the systems and their logs for any suspicious activities

• Check the workstations that are allowed to access the Internet bypassing security systems

• Check the most recent pentest report that listed down vulnerable servers in the bank system