Thor Hard #2

Question 1

38 What is parity check?

Answer 1

Involves 0 and 1. a method for detecting errors in data communications or within a computer system by counting the number of ones or zeros per byte or per word, including a special check bit (parity bit), to see if the value is even or odd.

Question 2

44 What does directive control mean?

Answer 2

you want a specific outcome.

Question 3

45 what is a data controller?

Answer 3

data owner>data controller>data steward.
The data controller decides how and why personal data is processed

Question 4

5-75 Hard#2 47 Which is more secure? 2 factor or Biometric?

Answer 4

2FA

Question 5

57 what is a squatting attack?

Answer 5

known as cybersquatting or domain squatting, is the act of registering, trafficking in, or using a domain name that is confusingly similar to a trademark or personal name with the intention to profit from the goodwill associated with that trademark or name. This can involve registering variations of a popular website’s domain name, often with minor misspellings or subtle changes, and then using those domains for malicious purposes.

Question 6

57 what is Time of Check/ Time of Use (TOCTOU) attack?

Answer 6

TOCTOU attacks exploit the time gap between when a system checks a condition (the time of check) and when it uses the results of that check (the time of use). By making the transaction atomic, the system ensures that the state of the system cannot change between the check and the use, thus preventing this type of race condition attack.

Question 7

58 Which is more important in data storage and retrieval? a) condition of the harddrive or b) how often you need to back up the data

Answer 7

b) how often you need to back up the data
While the age of backup tapes can affect their reliability, the frequency of backup usage and testing is a higher priority to ensure that data can be restored when needed

Question 8

61 What is more management work ? a) verify accuracy of data or b) categorize data

Answer 8

B. categorize data. Data Owners are responsible for determining the sensitivity and classification of the data to ensure that it is handled according to the appropriate security protocols. the verification of data accuracy is a day-to-day operational task that is often the responsibility of the individuals who enter or manage the data on a regular basis, such as data entry personnel or data custodians.

Question 9

62 How do you provide authentication for hashing data?

Answer 9

You use HMAC or digital signatures which combine hashing with secret keys. Hashing provides integrity. No confidentialy since it is one way. You should use encryption of confidentity but it doesn’t provide integrity or authentication

Question 10

68 chmod commands?

Answer 10

owner, group, others. read=4, write=2, execute=1. so 777 is all available.

Question 11

70 what is difference between ldap and ad?

Answer 11

LDAP is a protocol, while Active Directory is a specific implementation of a directory service that uses LDAP as one of its communication protocols. port 389 for unsecure and port 636 for secure ssl

Question 12

71 If you have logging or verify accuracy, then what is most likely to be the answer?

Answer 12

classification and categorization is the answer

Question 13

72 If the question that ask for requirements, then what is most likely the answer?

Answer 13

policy

Question 14

76 If the question involves staffs, what kind of access control is it?

Answer 14

it will be role based. RBAC.

Question 15

79 What is DHCP?

Answer 15

DHCP, or Dynamic Host Configuration Protocol, is a network protocol that automatically assigns IP addresses and other network configuration information to devices connected to a network. This process eliminates the need for manual configuration of each device, making network management much easier, especially on large networks.

Question 16

79 How many host per network are there for the se ipv4 configurations? a) /8 b) /16 c) /24

Answer 16

a) 16,777,214 b) 65,534 c) 254

Question 17

79 What is a PAT? How is a NAT? Difference between PAT and NAT?

Answer 17

PAT technique used to translate private IP addresses to public IP addresses, allowing multiple devices on a private network to share a single public IP address for internet access

NAT translates the private IP addresses of devices on a local network to a public IP address when communicating with the internet.

PAT can be considered an extension of NAT, as it uses similar translation principles but with the addition of port number translation. Used to have more IP addresses

Question 18

89 What is weakness of RDP? What is VDI (virtual desktop infastructure)

Answer 18

RDP is vulernable to MitM attacks. VDI is cheaper, secure. zero client>thin client

Question 19

92 How many tapes do you need for a differential backup?

Answer 19

only 2. The full one and the last differential one.

Question 20

93 What is difference between ssh and sftp? and what port do they use?

Answer 20

sftp is a subset of ssh and used port 22. ssh is general, it might use port 22 or something else

Question 21

98 What port is 50 and 51? Port 1? Port 6?

Answer 21

port 50 is ESP and port 51 is AH
Port 1 is ICMP. Port 6 is TCP

Question 22

101 What is a smurf attack? What is a salami attack?

Answer 22

Smurf send IP and ICMP packets to overwhelm (DDOS). source IP address is victims. Salami attack, small amounts are stolen from victim before they notice

Question 23

104 What scrum?

Answer 23

Framework built on principles of transparency, inspection, and adaptation, allowing teams to learn and adjust based on experience

Question 24

109 internal IP addresses in the range 192.168.0.0-192.168.7.255 means you can use ipv6 or ipv4? And which one should you use?

Answer 24

Eventhough the internal ip address is ipv4, you can use ipv6 to route the internet. ipv6 is better since it is more cost effective. ipv4 is expensive.

Question 25

116 if you get a question about how effective metrics are, what is the best criteria? what is not a good criteria?

Answer 25

control objectives is a good metric. Not compliance effectiveness of security policies because you can be compliant but that doens't mean it is effective.

Question 26

117 What does throughput mean?

Answer 26

the amount of material or items passing through a system or process.

Question 27

119 What does critical path mean?

Answer 27

It represents the shortest possible time to complete the project, and any delay in a critical path task will directly delay the entire project.

Question 28

120 What is a tiger team?

Answer 28

they work on specialized problems. very high stakes. small team and it gets disbanded later. cross functional.