Matching Quiz #2

Match the following terms to the correct description

• Attack Vector

• A code, sequence of commands, or piece of software designed to take advantage of weakness in the system.

• Vulnerability

• A potential danger or harmful event that could negatively affect the CIA of the network or data

• Risk

• a specific method or pathway used by an attacker to gain unauthorized access to a computer system

• Threat

• A weakness or flaw in a system, application, or network that could be taken advantage of by an attacker

• Exploit

• The likelihood and potential impact of a harmful event happening to the network or data.

Match the following Cybersecurity principles to appropriate definition.

• Separation of Services

• Employing multiple layers of security controls, each designed to detect and prevent attacks at different stages

• Principle of Zero Trust

• users should only have access to the minimum resources necessary to perform their intended tasks

• Hardening

• Every access must be authenticated and authorized before being granted access to resources

• Principal of Least Privilege

• Assigning different jobs to different servers.

• Defense In Depth

• The process of reducing the attack surface of devices, systems or networks.

Match the following

• Mantrap

• Physical security measure that prevents unauthorized access by using an enclosed space with two interlocking doors

• Mobile Device Management

• Ensures that no party in a communication can later deny their participation or the authenticity of their actions

• Kensington Lock

• The process of identifying threats and vulnerabilities and then defining countermeasures to prevent them.

• Non-Repudiation

• Enables organizations to administer and maintain portable devices and drives and even wipe them, if stolen.

• Threat Modeling

• A physical security device designed to prevent theft or unauthorized removal of electronic devices like laptops, desktops

Match the following terms to the correct definition

• Accounting

• Ensuring that authorized users can access data and systems when they need them. Part of the CIA triad.

• Authorization

• The protection from unauthorized access. Part of the CIA triad.

• Availability

• Records user activity and resource usage. Part of the AAA framework

• Confidentiality

• Maintaining the accuracy and trustworthiness of data. Part of the CIA triad

• Integrity

• Determines which resources a user can access after successfully authentication. Part of the AAA framework

Match the following

• PIN

• Requires users to prove their identity using two or more distinct authentication factors before gaining access

• Biometrics

• A numeric code used for "what you know" factor of authentication and access control

• MFA

• Unique biological or behavioral characteristics based on the "what you are" authentication factor

• Token

• Physical device or software app, that generate unique codes for "what you have" factor of authentication

• Smart Card

• A physical card with an embedded chip that can be used for "what you have" factor of authentication

Match the following

• Buffer Overflow

• An injection of a bogus destination for an IP address

• Man-in-the-Browser

• An on-path attack where a Trojan horse installed on a victim's computer can modify web transactions.

• Lock Screen

• Uses specific database language statements run for the purpose of getting or changing information in a

  database

• DNS Poisoning

• Type of ransomware that prevents access to files.

• SQL Injection

• The overloading of a reserved space for data that can overwrite other parts of memory or grant unauthorized access

Match the following

• Airgapping

• having backup systems and processes in place to ensure continued operation and data integrity in the event of a failure or cyberattack.

• Redundancy

• Copies all changes made since the last full backup

• Differential Backup

• creates a complete copy of all data, including files, folders, and evvven the operating system, to a different location

• Incremental Backup

• isolates a computer or network from other networks, particularly the internet, to protect sensitive data

• Full Backup

• only backs up changes made since the previous backup

Match the following Social Engineering Tactics to the correct definition

• Tailgating

• an unauthorized individual following an authorized person through a secured door or area, often by holding the door open

• PreTexting

• an unauthorized person gains entry into a restricted area by following an authorized individual without their knowledge

• Piggybacking

• an attack where a person observes someone else's device (like a smartphone, laptop, or ATM) to steal sensitive information

• Shoulder Surfing

• attackers fabricate believable scenarios to gain a victim's trust and induce them to reveal sensitive information or perform actions that compromise security

• Dumpster Diving

• the act of retrieving sensitive or valuable information from discarded physical or digital materials

Match the following malware terms

• virus

• An imposter program that appears helpful but contains malicious code

• polymorphic

  virus

• A difficult to detect type of malicious code that is often written into the CPU or other hardware

• rootkit

• A type of malware that can change its code and appearance to avoid detection

• worm

• Self-replicating malicious code that affects system functionality

• Trojan virus

• A type of malware that must have a carrier to attach to before it can cause

  damage.

Match the following Tunneling protocols to the correct description

• L2TP

• Uses HTTPS over TCP port 443

• GRE

• doesn't provide its own encryption, so it's often paired with IPsec (Internet Protocol Security) for encryption and authentication

• PPTP

• a way to transport packets of one protocol over another, much like a VPN, but without encryption

• IKEv2

• Old technology and not recommended

• SSTP

• a modern protocol that uses IPsec for its core encryption and authentication, and is often considered more secure and stable, especially for mobile users