CyberOps Chapter 24-25 Review

What three types of ICMP traffic should be allowed to access an internal network from the internet (Select Three)

• Squelch

• Destination Unreachable

• Request

• Reply

• Time Exceeded

Answer explanation

ACLs should only permit special types of ICMP messages to enter an internal network. Allowed ICMP traffic includes an ICMP reply, source quench, and any ICMP unreachable messages. All other ICMP traffic types should be denied.

Alert Data consists of which two (Select Two)

• Intrusion Detection System (IDS)

• Network Intrusion Detection Syestem (NIDS)

• Host-Based Intrusion Detection System (HIDS)

• Intrusion Prevention System (IPS)

Answer explanation

Alert data consists of messages generated by intrusion prevention systems (IPSs) or intrusion detection systems (IDSs) in response to traffic that violates a rule or matches the signature of a known exploit. A network IDS (NIDS), such as Snort, comes configured with rules for known exploits.

In which way does the use of HTTPS increase the security monitoring challenges within enterprise networks

• HTTPS traffic can carry a much larger payload than HTTP can carry

• HTTPS traffic enabled end-to-end encryption

• HTTPS does not require authentication

• HTTPS traffic is much faster than HTTP traffic

Answer explanation

HTTPS enables end-to-end encrypted network communication, which adds further challenges for network administrators to monitor the content of packets to catch malicious attacks.

What type of server can threat actors use DNS to communicate with?

Answer explanation

Some malware uses DNS to communicate with command-and-control (CnC) servers to exfiltrate data in traffic that is disguised as normal DNS query traffic.

What uses a server deamon that accepts messages and creates a collection of logs

• AAA

• SSH

• WIndows Host Log Events

• syslog

Answer explanation

Syslog is important to security monitoring because network devices send periodic messages to the syslog server. These logs can be examined to detect inconsistencies and issues within the network.

How are iFrames used by cybercriminals

• The iFrame allows multiple DNS subdomains to be used

• The iFrame allows the browser to load a webpage from another source

• To become invincible for a moment then demolish the enemy

• The attacker embeds malicous content in business apropriate files

• the attacker redirects traffic to an incorrect DNS server

Answer explanation

An inline frame or iFrame is an HTML element that allows the browser to load a different web page from another source.

How can NAT/PAT complicate network security monitoring if NetFlow is being used?

• Disguises the application initiated by a user by manipulating port numbers.

• It hides internal IP addresses by allowing them to share one or a few outside IP addresses.

• It conceals the contents of a packet by encrypting the data payload.

• It changes the source and destination MAC addresses.

Answer explanation

NAT/PAT maps multiple internal IP addresses with only a single or a few outside IP addresses breaking end-to-end flows. The result makes it difficult to log the inside device that is requesting and receiving the traffic. This is especially a problem with a NetFlow application because NetFlow flows are unidirectional and are defined by the addresses and ports that they share.

What Port number would be used by a threat actor if they were using NTP for directing DDoS attacks

• 443

• 123

• 69

• 25

• 474

Answer explanation

NTP uses UDP port number 123. Threat actors could use port 123 on NTP systems in order to direct DDoS attacks through vulnerabilities in client or server software.

device capable of managing load balancing so that traffic will be distributed between their servers. What could be a potential problem using the new device on the network?

• It will cause extra traffic going to a server resource that is not available

• It will require the purchase of more servers so that existing servers are not overwhelmed

• The LBM probe messages may appear as suspicious traffic

• The traffic will require more bandwidth to send to multiple servers

• All links to redundant servers will require encrypted tunneling protocols

Answer explanation

Load balancing manager (LBM) devices distribute traffic between devices or network paths to prevent overwhelming network resources. LBM devices may send probes to different servers to detect that the servers are operating. These probes can appear to be suspicious traffic.

Which type of attack involves an adversary attempting to gather information about a network to identify vulnerabilities?

• Reconnaissance attack

• Man-In-the-middle attack

• Eavesdropping attack

• Routing attack