After detecting and verifying an incident, what is the next step that should be taken? Show Contain it. This limits the effect or scope of an incident. Organizations report the incident based on policies and governing laws, but this is not the first step. Root cause analysis would be performed during which stage of the incident response process? Remediation. This attempts to discover the source of the problem. True or False: Teardrop, Smurf, and Ping of Death are all DoS attacks True What is the most common method for distributing malware? Drive-by downloads ________ is a form of nonstatistical sampling that reduces the amount of logged data based on a threshold Clipping. Sampling is a statistical method on the other hand. True or False: Traffic analysis focuses more on patterns and trends of data rather than the actual content True A _________ can detect when users have more privileges than necessary User Entitlement Audit True or False: Before performing recovery (e.g - rebooting a system), the incident should be contained and evidence should be gathered True What are the 7 steps in the incident response process? DRM-RRRL (1) Detection, (2) Response [collecting evidence], (3) Mitigation [containment], (4) Reporting, (5) Recovery [reboot], (6) Remediation [root cause analysis], (7) Lessons Learned True or False - The primary goal of incident response is to minimize the impact on the organization True A __________ is any event that has a negative effect on the CIA of an organization's assets incident In contrast, a computer security incident [sometimes called just security incident] commonly refers to an incident that is the result of an attack, or the result of malicious or intentional actions on the part of the users. True or False: Computers should not be turned off when containing an incident. True Multiple bots in a network form a _________ and will do whatever attackers instruct them to do Botnet Bots are also called zombies. This is commonly used to launch a wide range of attacks (including DoS), send spam and phishing emails, or rent the botnets out to other criminals. Use defense in depth and update anti-malware software. Educating users is also very important. Also keep web browsers updated. True or False: A distributed denial of service attack occurs when multiple systems attack a single system at the same time True. Reflected is another variant, where the network traffic is manipulated so that the attacks are reflected back at the victim from other sources. DoS attacks are typically aimed at internet-facing systems. I.E if attackers can access a system via the internet, it is highly susceptible to a DoS attack. DoS attacks are not common for internal systems that are not directly accessible via the internet. True or False: A SYN Flood attack is a common DoS attack. It dsirupts the standard three-way handshake used by the TCP protocol to initiate communication sessions. True The attacker keeps sending SYN flagged packets and never responds to the ACK packet from the client, effectively crashing their system with SYN packets (since the server reserves system resources for the SYN request - consumes memory and processing power). Using SYN cookies is one way to block this attack. True or False: A Smurf attack is another type of flood attack (DoS attack), but it floods the victims with Internet Control Message Protocol (ICMP) echo packets instead of with the TCP SYN packets. True. In a Smurf attack, Ping uses ICMP to check connectivity with remote systems. The attacker sends an echo request out as a broadcast to all systems on the network and spoofs the source IP address. All these systems respond with echo replies to the spoofed IP address, flooding the victim with traffic. Disabling ICMP will prevent this attack. True or False: Fraggle attacks are similar to Smurf attacks, however instead of using ICMP, a fraggle attack uses UDP packets over UDP ports 7 and 19. True. The fraggle attack will broadcast a UDP packet using the spoofed IP address of the victim. All systems on the network will then send traffic to the victim. True or False: A ping flood attack floods a victim with pin requests. A common way to handle this today is by blocking ICMP traffic True. IDS's can also detect a ping flood and modify they environment to block IMP traffic during the attack. True or False: A ping of death attack employs an oversized ping packet True True or False: In a teardrop attack, an attacker fragments traffic in such a way that a system is unable to put data packets back together True Larger packets are normally divided into smaller fragments when sent over a network, and the receiving system then puts the packet fragments back together in their original state. This attack mangles these packets in such a way that the system cannot put them back together. IDS' can check for malformed packets. True or False: A land attack occurs when the attacker sends spoofed SYN packets to a victim using the victim's IP address as both the source and destination IP address. True. This tricks the system into constantly replying to itself and can cause it to freeze, crash, or reboot. Keeping a system up to date and filtering traffic to detect traffic with identical source and destination addresses helps to protect against LAND attacks. True or False: Malicious codes can take many forms, including viruses, worms, trojan horses, documents with destructive macros, and logic bombs True True or False: A man in the middle attack can be someone either sniffing communication between to parties, or someone that has positioned themselves in the line of communication where they can act as a store-and-forward or proxy mechanism. True. An attacker can collect logon credentials and other sensitive data as well as change the content of messages exchanged between the two systems. An IDS cannot usually detect man in the middle or hijack attacks. Man users often use VPNs to avoid these attacks. Employee _________ is a criminal act of destruction or disruption committed against an organization by an employee Sabotage __________ is the malicious act of gathering proprietary, secret, private, sensitive, or confidential information about an organization Espionage True or False: IDSs are an effective method of detecting many DoS and DDoS attacks. True. An IPS includes all the capabilites of an IDS but can also take additional steps to stop or prevent intrusions. The most common method of detection is ____________: (1) Knowledge-based, or (2) Behavior based (1) Knowledge-based [also called signature-based] It uses a database of known attacks developed by the IDS vendor. The only negative is that it is only effective against known attack methods. Behavior-based systems do not use signatures, and instead compares activity against a baseline of normal performance to detect abnormal behavior. Many IDSs use a combination of both methods. True or False: With regards to behavior-based IDSs, the baseline of normal activities and events needs to be updated if the network is modified True True or False: A significant benefit of behavior-based IDS is it can detect newer attacks that have no signatures and are not detectable with the signature-based method. True However, behavior-based systems often raise a high number of false alarms. True: IDSs can be host-based and/or network based True HIDs are more costly to manage. Many HIDs include anti-malware capabilities. Notifications being sent to administrators via email, text, or pop up messages is an example of which type of IDS response: (1) Passive, or (2) Active (1) Passive An active response can modify the environment using several methods, including modifying ACLs to block traffic and disabling communications. True or False: As much as 75 percent of internet traffic is encrypted using Transport Layer Security (TLS) with Hypertext Transfer Protocol Secure (HTTPS) True True or False: A distinguishing difference between an IDS and an IPS is that the IPS is placed in line with traffic. True. In other words, all traffic must pass through the IPS and the IPS can choose what to forward and what traffic to block after analyzing it. ___________ are individual computers created as a trap for intruders. Honeypot. They look and act like legitimate systems, but they do not host data of any real value for an attacker. A __________ is two or more networked honeypots used together to simulate a network. Honeynet. They look and act like legitimate systems, but they do not host data of any real value for an attacker. ______________ are false vulnerabilities or apparent loopholes intentionally implanted in a system in an attempt to tempt attackers Psuedo flaws They are often used on honeypot systems to emulate well-known operating systems vulnerabilities. True or False: A padded cell system is similar to a honeypot, but it performs intrusion isolation using a different approach. When an IDPS detects an intruder, that intruder is automatically transferred to a padded cell. The padded cell has the look and feel of an actual network, but the attacker is unable to perform any malicious activities or access any confidential data from within the padded cell.
True True or False: Sandboxing provides a security boundary for applications and prevents the application from interacting with other applications True Which attack involves using IP spoofing and the ICMP to saturate a target network with traffic?An Internet Control Message Protocol (ICMP) flood DDoS attack, also known as a Ping flood attack, is a common Denial-of-Service (DoS) attack in which an attacker attempts to overwhelm a targeted device with ICMP echo-requests (pings).
What happens in smurf attack?An ICMP for smurf attack is a form of DDoS attack that overloads network resources by broadcasting ICMP echo requests to devices across the network. Devices that receive the request respond with echo replies, which creates a botnet situation that generates a high ICMP traffic rate.
What is ICMP spoofing?Ping spoofing works by changing the IP address of your network packets so that they appear to come from another IP address. This is often done by sending out spoofed ICMP echo requests, which are commonly used with the ping command and other tools that send out ICMP packets.
In which attack the attacker floods the broadcast address with the ICMP echo packets?Ping flood, also known as ICMP flood, is a common Denial of Service (DoS) attack in which an attacker takes down a victim's computer by overwhelming it with ICMP echo requests, also known as pings.
|
