CYSA+ > Chapter 13 Cybersecurity Toolkit > Flashcards

Chapter 13 Cybersecurity Toolkit Flashcards

(48 cards)

Study These Flashcards
1
Q
  • Set of security mitigation capabilities bundled together to help prevent malware from exploiting vulnerabilities and other attacks
  • Includes: Data execution prevention (DEP) and Address space layout randomization (ASLR)
A

Enhanced Mitigation Experience Toolkit (EMET)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Feature to prevent the execution of malware loaded into data space in memory

A

Data execution prevention (DEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Helps prevent buffer overflows attacks and others that rely on specific acknowledge of memory locations

A

Address Space Layout Randomization (ASLR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Name the tools in the Windows Sysinternals Suite

A
  • AccessEnum
  • AutoRuns
  • Process Explorer
  • PsTools
  • SDelete
  • ShareEnum
  • Sysmon
  • ProcDump
  • TCPView
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Enumerates the access on a system
  • Provides a good view of who has permissions to files, directories, and other objects
  • Part of Windows Sysinternals Suite
A

AccessEnum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q
  • A utility that shows what programs start at login or system boot
  • Part of Windows Sysinternals Suite
A

AutoRuns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q
  • Tool that shows the files, DLLs, registry keys and other objects in use by each process
  • Part of Windows Sysinternals Suite
A

Process Explorer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q
  • Set of command line utilities with a broad range of functions, including process information and start/stop capabilities, event log dumping, password changes, and many others
  • Part of Windows Sysinternals Suite
A

PsTools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
  • Secure file deletion utility

- Part of Windows Sysinternals Suite

A

SDelete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q
  • Tool that analyzes shares and their permissions

- Part of Windows Sysinternals Suite

A

ShareEnum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • Often used for intrusion detection and forensic analysis for its ability to monitor processes and their activity in a searchable and easily viewable manner
  • Part of Windows Sysinternals Suite
A

Sysmon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Provides process dumping for memory and error analysis

- Part of Windows Sysinternals Suite

A

ProcDump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Tool for stock at level visibility for analyzing network connected services
  • Part of Windows Sysinternals Suite
A

TCPView

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Standard for logging and is designed to allow logs to be created for an endpoint server, system, or device, and then be stored locally or sent to essential server or storage system

A

Syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SIEM tool designed to provide large-scale data collection and analysis capabilities for broad range of data types

A

Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Provides SIEM functionality as well as asset discovery, vulnerability scanning and assessment, behavior (heuristic) analysis capabilities, and IDS capabilities

A

AlienVault’s Universal Security Manager (USM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An open source SIEM that integrates a number of Open Source tools to provide security information and event capabilities

A

AlienVault offers OSSIM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A network graphing tool that runs on top of RRDtool (a data logging and graphing system) to allow recurring, time-based data collection and analysis

A

Cacti

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A network monitoring tool that leverages SNMP to monitor traffic on network connections

A

Multi Router Traffic Grapher (MRTG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Well-known and widely respected network vulnerability scanning product

Study These Flashcards
A

Tenable Nessus

21
Q

A vulnerability scanner that uses Software-as-a-Service (SaaS) management console to run scans using appliances located both in on premise datacenters and in the cloud

Study These Flashcards
A

Qualys’s QualysGuard

22
Q

Another commercial vulnerability scanner that offers similar capabilities to Nessus and QualysGuard

Study These Flashcards
A

Rapid7’s Nexpose

23
Q

An open source vulnerability scanner

Study These Flashcards
A

open source OpenVAS

24
Q
  • Test for web specific vulnerabilities, such as SQL injections, cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities
  • i.e. Nikto
Study These Flashcards
A

Web application scanners

25
Tools designed to help with acquisition of passwords
- fgdump - pwdump - SAMdump2
26
Open source tool designed to crack passwords and hashes, including Linux, Windows, Kerberos and other frequently use password hashing methods
John the Ripper
27
Open source password cracking tool that relies on rainbow tables to quickly look up hashes to return their original value
Ophcrack
28
- Perform similar actions to their Network counterparts, seeking to identify and block potentially malicious network traffic - Not used a lot in production
Host intrusion prevention systems (HIPS)
29
- Build a table of hash values for all files resident on a protected computer system and then monitors files for unexpected changes in those hash values - ie Tripwire - Mandated by PCI DSS
File Integrity Monitoring software
30
- Has replaced nslookup for Mac OS and Linux | - Provides a little more detail than nslookup
Dig
31
- Acts as a middleman between end-user systems and web servers - All web requests are sent to the server rather than direct connection between web server and end user clients
Proxy servers
32
What are the benefits of using a proxy server over direct connections?
1. Proxy servers provide an opportunity to perform content filtering 2. Proxy servers may perform caching of frequently requested content - improve response time for users and decreases bandwidth consumption
33
The majority of servers implementing TLS and SSL do so by using what open source library?
OpenSSL
34
- Provide content and protocol-aware firewall and technical protections for web applications - Can be used to provide protection against zero-day attacks that are not patched but have known attack profiles by building custom rules that address the exploit
Web application firewall
35
Name a couple of interception proxies
Burp Suite proxy | Zed attack proxy (ZAP)
36
Name some popular Fuzzer tools
- Peach fuzzer - Untidy fuzzer - Microsoft security development lifecycle (SDL) includes: MiniFuzz file fuzzer and the SDL Regex Fuzzer
37
The three major forensic image formats or what?
1. RAW 2. AFF 3. E01
38
- Forensic image format | - Bit by bit copies of the original format. Metadata is sometimes acquired along with this image and stored separately
RAW
39
- Forensic image format | - An open extensible forensic format for disk images and metadata
AFF Advanced Forensic Format
40
- Forensic image format - Commonly used for law enforcement investigations ENCase file format
E01
41
What are some stand-alone imaging utilities available?
- dd - OSFColone - FTK Image
42
Guidance Software commercial forensic suite, provides a GUI driven full forensics week
EnCase
43
Complete commercial forensic suite provided by access data
FTK, the Forensic Toolkit
44
- Toolkit built using open-source tools and it's based on Ubuntu Linux - Popular forensic suite
SANS SIFT
45
- Command line based toolkit for image analysis and file recovery - Popular forensic Suite
Sleuth Kit
46
GUI-based program that provides forensic image analysis capabilities
Autopsy
47
Pair of commercial forensic tools
Helix 3 Enterprise and Pro
48
Provides dedicated mobile forensic features designed to capture, analyze, and report on data from phones and other mobile devices
Cellebrite’s UFED
CYSA+
flashcards
Decks in class (14)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions