Sec + 6

Question 1

Kerberos port?

Answer 1

88

Question 2

Ipsec port?

Answer 2

500

Question 3

Rdp port?

Answer 3

3389

Question 4

What does dns protect against?

Answer 4

1. Blocks access to malicious sites
2. Content filtering
3. Enhancing privacy by blocking sites that may collect user data
4. Security reinforcement.

Question 5

How to secure email?

Answer 5

1. S/MIME-uses PKI to either encrypt emails or digitally sign them. Does not scale well due to key exchanges.
2. Pretty good privacy (PGP)- end to end encryption. Like PKI but not using PKI
3. Domain based message authentication reporting and conformance (DMARC) - let’s users decide what to do with detected emails
4. Domainkeys identified Mail (DKIM)- Uses digital signatures. Which can be read only by the recipient.
5. Sender policy framework (SPF)-
6. Gateway

Question 6

What is File integrity Monitoring (FIM)?

Answer 6

Establishes a baseline of normal file and system configurations. Alerts when it changes.

Question 7

What ensures that every remote device is fully patched and uses agents carried out by the health authority (HAuth)?

Answer 7

Network access control (NAC)

Question 8

What is XDR?

Answer 8

Extended detection and response.

Question 9

How does EDR work?

Answer 9

Data collection
Detection-signature based and behavior analysis
Alerting
Response - tools that the cyber team can use to resolve

Question 10

XDR components?

Answer 10

1. Geta data from various sources including the EDR, Network detection and response (NDR) and cloud
2. Enhanced analytics
3. Automation and orchestration
4. Scalability

Question 11

What is the active directory and its protocol?

Answer 11

Microsoft provisioning tool

Lightweight directory access protocol (LDAP)

Question 12

What is a SID?

Answer 12

Security identifier.

Object identifier in active directory

Question 13

What language is used for federation services?

Answer 13

Security assertion markup language (SAML)

Question 14

What does kerberos use to obtain service tickets?

Answer 14

TGT
Ticket granting ticket
Token

Question 15

3 sso options

Answer 15

1. Kerberos
2. OAuth- like signing into Google to get into a different website. Uses tokens
3. SAML

Question 16

Attestation methods for system interoperability?

Answer 16

1. Certificates
2. Tokens
3. Federation
4. Microsoft active directory

Question 17

What is mandatory access control (MAC) and what are the management roles?

Answer 17

Mandatory access control

1. Owner - writes data and determines initial classification ( top secret, secret..
   )
2. Steward - ensures data accuracy, consistency, and reliability over time.
3. Custodian- handles technical and physical data management. Data storage and encryption
4. Security Administrator - provides auth

Question 18

What is RBAC?

Answer 18

Role based access control

Question 19

What is ABAC?

Answer 19

Attribute based access control.

Location, job title, access time etc…

Question 20

What is discretionary based accessed control (DAC)?

Answer 20

Owner gives access. Uses ACL’s

Question 21

What is soft authentication? Give examples.

Answer 21

Leverages intangible assets like passwords, pins, or mobile authentication. Only something they know. Can be intercepted

1. One time password sent to phone
2. Biometrics
3. Knowledge based auth (KBA) - Like security questions.

Question 22

What is two-factor auth?

Answer 22

Having a token (phone), something you have with a password

Question 23

What is multi factor auth?

Answer 23

Something you have
Something you do
Something you know

Question 24

What is NIST?

Answer 24

National Institute of standards and technonlogy.

Question 25

Password best practices

Answer 25

1. Length 2. Complexity 3. Password reuse 4. Expiry 5. Max, min age 6. Lockout

Question 26

What is PAM?

Answer 26

Privileged access management. For administration rights. One time use access and has a time limit. Tracks users as well

Question 27

PAM tools

Answer 27

1. Jit permissions 2. Password vaulting - admin accounts removed from regular system to a password vault (software). Tickets are released from there. 3. Ephemeral credentials - one time use