Iceberg_TeamMode_Post

What is the ARP protocol?

• A communication protocol mapping IP addresses to MAC addresses
• A network-layer protocol, defining how data is exchanged between network components on the network layer
• A cryptographic protocol designed to provide communications security over a computer network
• A network protocol for operating network services securely over an unsecured network

What is a PLC (SPS)?

• A multi-purpose computer operated by an end user
• The processing unit of a computer
• An industrial computer control system, e.g. for controlling sensors
• The core of a computer's operating system

What is an ICS?

• The digital representation of a physical asset
• A user interface for interaction with physical maschines
• An industrial sensor
• A virtually connected physical system

What is the purpose of a SIEM system?

• Correlarting secruity-relevant data from across the entire network to detect incidents
• Reporting the status of the current tasks of the cybersecurity team
• Controlling incoming and outgoing network traffic based on predetermined security rules
• Performing integrated management of main business processes

What is a SIEM event?

• An attack identified by the SIEM system
• A seucrity-related log, transmitted to a SIEM system
• A conference for SIEM experts
• A potentially manipulated file, identified by the SIEM system

What is the difference between a SIEM system and an IDS?

• A SIEM is the technical component of an IDS
• A SIEM correlates security-related log data from various sources an IDS monitors a network for suspicious activities
• There is no difference
• A SIEM operates on a network, an IDS on an application layer

What is Incident Response mainly concerned with?

• Reacting to security incidents in a coherent and repeatable manner
• Secure SW development
• Implementing security controls such as anti malware software or access control
• Managment of security risks and policies

What is the first step of incident response?

• Analysis
• Investigation
• Reponse
• Preparation

What is an incident response playbook?

• A standard for incident categorization
• A software for incident management
• A list of actions how to react to a specific kind of incident
• A database for cyber threat intelligence

What is a Man In The Middle (MiTM) Attack?

• Intercepting the network traffic between to parties
• Exhausting the system resources of a server
• Phising for passwords via malicous email
• A malware attack targeting middleware