NEW
Font size
WorksheetsNIST Cybersecurity Framework Quiz
Total questions: 25
Worksheet time: 13mins
According to the NIST Cybersecurity Framework, which function comes FIRST?
Protect
Detect
Identify
Respond
Vulnerability scanning mainly supports which NIST function?
Identify
Protect
Recover
Respond
OWASP Top 10 focuses primarily on:
Network attacks
Operating system vulnerabilities
Web application security risks
Physical security
Internet security statistics are useful mainly for:
Tool selection
Risk prioritization
Firewall tuning only
IDS signatures
A honeypot is best described as:
Production server
Monitoring system
Decoy system to attract attackers
Firewall replacement
A distributed honeynet improves:
Performance
Logging speed
Attack visibility and realism
Encryption strength
Honeypots are mainly used for:
Prevention
Detection and research
Authentication
Encryption
Tcpdump captures packets using:
GUI-based filters
Netfilter rules
libpcap
Syslog
Correct tcpdump command to capture traffic on eth0:
tcpdump eth0
tcpdump -i eth0
tcpdump --eth0
tcpdump -e eth0
To capture only ICMP traffic using tcpdump:
tcpdump icmp
tcpdump -p icmp
tcpdump proto icmp
tcpdump -i icmp
Which intruder type has authorized access?
Masquerader
External attacker
Insider
Script kiddie
A masquerader is:
Legitimate user
Insider
External attacker pretending to be authorized
Automated bot
Unusual CPU spikes and network latency indicate:
Integrity attack
Confidentiality breach
Availability attack
Authentication failure
A three-tier architecture improves security by:
Increasing latency
Separating responsibilities
Reducing firewall rules
Eliminating IDS
Network-based IDS sensors are usually placed:
On endpoints
On switch SPAN ports
Inside applications
On routers only
Host-based IDS agents monitor:
Network packets
System logs and files
Router tables
Switch CAM tables
IDS agents primarily report to:
Firewall
Proxy server
IDS Manager
VPN concentrator
DoS attacks mainly violate:
Confidentiality
Integrity
Availability
Authentication
LOIC generates attacks using:
Slow HTTP requests
Distributed reflection
High-volume traffic floods
DNS poisoning
Effective DDoS mitigation includes:
Single firewall
Rate limiting + blacklisting
Antivirus
Encryption
SIEM log correlation means:
Storing logs
Filtering logs
Linking events across sources
Encrypting logs
Correct SIEM log flow:
SIEM → Device → Alert
Device → SIEM → Correlation → Alert
IDS → Firewall → SIEM
Proxy → SIEM → Router
ELK stack components mapping is:
Elastic–Storage, Logstash–UI, Kibana–Parser
Elasticsearch–Storage, Logstash–Ingest, Kibana–Visualization
Elasticsearch–Parser, Kibana–Storage, Logstash–UI
ELK is IDS only
Nagios is mainly used for:
Intrusion detection
Log correlation
System and service monitoring
Packet filtering
IDS evasion often exploits:
Strong encryption
Packet fragmentation and timing
VPN tunneling
NAT translation
