NEW
Font size
WorksheetsICEBERG_Assessment_Pre
Total questions: 23
Worksheet time: 12mins
Have you worked with a terminal/shell before?
Yes
No
Have you worked with Linux before?
Yes
No
Have you worked with a SIEM system before?
Yes
No
Have you heard about Incident Response before?
Yes
No
Have you attended a Cyber Range/Capture the Flag training before?
Yes
No
What is an IP address?
The network address of a device
The hardware address of a device
The domain name of a service
The address for telephonic transmission of scanned printed material
What is a MAC address?
The domain name of a service
The network address of a device
The unique address of subscriber identity modules (SIM)
The hardware address of a device
What is the TCP protocol?
An internet-layer protocol for exchange of information and error messages when communicating with another IP address
A network-layer protocol, defining how data is exchanged between network components on the network layer
A cryptographic protocol designed to provide communications security over a computer network
An application-layer Internet standard protocol used by e-mail clients
What is the ARP protocol?
A cryptographic protocol designed to provide communications security over a computer network
A network protocol for operating network services securely over an unsecured network
A communication protocol mapping IP addresses to MAC addresses
A network-layer protocol, defining how data is exchanged between network components on the network layer
What is a PLC (SPS)?
A multi-purpose computer operated by an end user
The processing unit of a computer
The core of a computer's operating system
An industrial computer control system, e.g. for controlling sensors
What is an Industrial Control System (ICS)?
A digitally connected physical system
An industrial sensor
The digital representation of a physical asset
A user interface for interaction with physical machines
What is the purpose of a SIEM system?
Controlling incoming and outgoing network traffic based on predetermined security rules
Reporting the status of the current tasks of the cybersecurity team
Performing integrated management of main business processes
Correlating security-relevant data from across the entire network to detect incidents
What is a SIEM event?
An attack identified by a SIEM system
A security-related log, transmitted to a SIEM system
A conference for SIEM experts
A potentially manipulated file, identified by the SIEM system
What is the difference between a SIEM system and an Intrusion Detection System (IDS)?
A SIEM is the technical component of an IDS
A SIEM correlates security-related log data from various sources an IDS monitors a network for suspicious activities
A SIEM operates on a network, an IDS on an application layer
There is no difference
What is a Man-In-The-Middle (MiTM) attack?
Exhausting the system resources of a server
A malware attack targeting middleware
Phishing for passwords via malicious email
Intercepting the network traffic between to parties
What effect does MitM attack possibly have on an industrial system?
Inability of the ICS to read the sensor values, resulting in an interruption of the physical process
Replication of malware code on other devices in the network
Temporary inaccessibility of the ICS because it is flooded with requests
Escalation of privilege on an HMI
How does ARP spoofing work?
Poisoning the DNS cache of a client
Linking the attacker’s MAC address with the IP of the victim
Changing a factory-assigned IP address of a network interface
Replacing the IP address of a network packet
What is Incident Response mainly concerned with?
Implementing security controls such as anti malware software or access control
Management of security risks and policies
Reacting to security incidents in a coherent and repeatable manner
Secure software development
What is the first step of Incident Response?
Investigation
Analysis
Preparation
Response
What is an incident response playbook?
A software for incident management
A database for cyber threat intelligence
A standard for incident categorization
A list of actions how to react to a specific kind of incident
How can you identify the attacking host during an ARP-based MiTM attack?
Identifying the network host which sends an unusual high amount of requests
Identifying which MAC address is falsely assigned to another network host
Identifying who modified the file /etc./shadow
Identifying the network host opening a VPN connection
How can you make an ARP cache static
arp -a <MAC1> <MAC2>
more /etc/hosts --static
vi /etc./sysconfig/network
arp -s <IP> <MAC>
How can you take down the interface of a network device?
ip link set dev <INTERFACE> down
ifconfig <INTERFACE>
service network stop
ip route list <INTERFACE>
