GSEC ACTUAL FINALS QUESTIONS AND ANSWERS
SET A+
✔✔SSL/TLS - ✔✔port 443 | encryption protects confidentiality and integrity, verification
of server id | client/server agree on best encryption; uses symmetric keys; RSA/Diffie;
new key for each request
✔✔Secure Coding - ✔✔initialize vars; input validation; error management; least priv;
vuln notifications; check 3rd party code; no secrets in code; no admin for server, db
access | includes performance and load testing
✔✔HTTP authN - ✔✔in headers; basic (base 64 encode)
digest: MD5
✔✔Form-Based Authentication - ✔✔cleartext unless SSL; authN errors minimal; acct
lockouts
✔✔password - ✔✔Private combination of characters associated with a user name that
allows access to certain computer resources.
✔✔Certificate-Based Authentication - ✔✔An authentication method that uses a
certificate instead of a password to establish an entity's identity.
✔✔token-based authentication - ✔✔Requires a computer user to physically hold a
device called a token.
✔✔one time password - ✔✔Password generated by a security token, which expires as
soon as it is used.
✔✔footprinting (authN) - ✔✔IP, software / signature / system config to ascertain id of
user or device requesting access
,✔✔Signature Analysis - ✔✔most common method of identifying EOI on network uses a
series of rules and pattern matching to detect and alert
✔✔anomaly analysis based IDS - ✔✔Anomaly analysis-based IDS looks for changes to
the normal patterns of traffic using inclusive analysis which means the IDS vendor
identifies and defines anomalous behavior
✔✔biometric authentication - ✔✔Technology for authenticating system users that
compares a person's unique characteristics such as fingerprints, face, or retinal image,
against a stored set profile of these characteristics.
✔✔Directory Traversal - ✔✔An attack that takes advantage of a vulnerability in the Web
application program or the Web server software so that a user can move from the root
directory to other restricted directories.
✔✔session ID - ✔✔makes stateful; inclues: form element; URL; cookie
long and random
sign / hash IDs
new issued on authN
expire / timeout
✔✔ROI - ✔✔Return of investment or return on investment. A performance measure
used to identify when an investment provides a positive benefit to the investor. It is
sometimes considered when evaluating the purchase of new security controls.
ROI(%) = (gain - expenditure)/(expenditure) x 100
✔✔threat - ✔✔activities that represent danger to info or operations | agent of risk
✔✔danger - ✔✔anything that can negatively impact to CIA of systems and services
✔✔vulnerability - ✔✔A flaw or weakness that allows a threat agent to bypass security.
✔✔0-day - ✔✔exploit that is not publicly know or available
✔✔security controls (types) - ✔✔detective corrective and preventive
✔✔network mapping - ✔✔enumerating hosts responding on a network. NMAP
✔✔port scanning - ✔✔Using a program to remotely determine which ports on a system
are open (e.g., whether systems allow connections through those ports).
✔✔vulnerability scanning - ✔✔look for vulnerabilities associated with discovered
systems ports and services
,✔✔Red Team - ✔✔A group of people authorized and organized to emulate a potential
adversary's attack or exploitation capabilities against an enterprise's security posture.
The Red Team's objective is to improve enterprise Information Assurance by
demonstrating the impacts of successful attacks and by demonstrating what works for
the defenders (i.e., the Blue Team) in an operational environment.
✔✔Blue Team - ✔✔The network defenders in a blind (or black box) penetration test.
Don't have knowledge of the attack.
✔✔Penetration Testing - ✔✔active analysis of a system through simulated attacks and
may involve exploit of live vulns | does not include maintaining access and covering
tracks
✔✔Penetration Testing Techniques - ✔✔war dialing war driving sniffing eavesdropping
dumpster diving social engineering
✔✔network security devices (3) - ✔✔firewalls prevention NIDS detection NIPS
prevention
✔✔Ingress Filtering - ✔✔sniffing incoming packets and discarding those with source IP
addresses outside a given range
✔✔Egress filtering - ✔✔firewall filters packets when they are leaving the network,
prevents replies to probe packets from leaving the network and prevents a firm's
infected hosts from attacking other firms
✔✔tarpit - ✔✔A honeypot that answers connection requests in such a way that the
attacking computer is "stuck" for a period of time. Considered 'aggressive' defense
using TCP flow control to set window size low to 0 to keep conn open and consume
resources
✔✔Artillery - ✔✔Python-based cross platform tool for honeypot file system monitoring
threat intelligence mainly event warning
✔✔BearTrap - ✔✔Ruby-based tool contained in ADHD opens up ports to deceive
attackers and actively block their IPs
✔✔Active Defense Harbinger Distribution (ADHD) - ✔✔Ubuntu-based Linux distro
focused on active defense and offensive countermeasures and has many tools for
deception and attack-back
✔✔Honey Badger - ✔✔attack back tool determines physical location of system with
geolocation wifi and IP address
, ✔✔Decloak - ✔✔discover attacker IP even if through proxy
✔✔Nova - ✔✔Network Obfuscation and Virtualized Anti-Recon can launch VMs called
haystacks (honeypots)
✔✔TCP flow control - ✔✔TCP provides flow control by having the sender maintain a
variable called the
receive window. The size of this window is important. Set low to 0 in tarpit to keep
attacker connections open and consume system resources
✔✔bogus DNS - ✔✔descriptive but deceptive DNS domain names redirect attackers to
jailed env or honeypot
✔✔decoy ports - ✔✔lead attacker to believe many ports open. more scanning needed.
deploy on network device
✔✔honeycreds - ✔✔deploy decoy usually privileged accounts
✔✔jailed environment - ✔✔configured to look like real environment no real data all
traffic permitted
✔✔false headers - ✔✔leave blank or include incorrect information to deceive attackers
about systems
✔✔decoy IP - ✔✔visible but unused IP appear active with open port and vulnerable
service appear as real systems to attackers
✔✔honeytoken - ✔✔files and folders set up to deceive attacker and allow for detection
of the attack
✔✔honeynet - ✔✔a group of honeypots used to more accurately portray an actual
network intended to slow down attacker make the attack more expensive and risky
✔✔honeypot - ✔✔Single, hardened and secure system with no legitimate purpose. A
computer system that's set up to attract unauthorized users by appearing to be a key
part of a network or a system that contains something of great value.
focus on what attacker does to discover new vulns
✔✔attribution - ✔✔id attacker; block country? legal concerns. attacker can defeat with
relay attacks and spoofed IPs
✔✔attack back - ✔✔AKA active defense (retaliation). legal concerns great. AKA
'offensive countermeasures'. must have attribution.
SET A+
✔✔SSL/TLS - ✔✔port 443 | encryption protects confidentiality and integrity, verification
of server id | client/server agree on best encryption; uses symmetric keys; RSA/Diffie;
new key for each request
✔✔Secure Coding - ✔✔initialize vars; input validation; error management; least priv;
vuln notifications; check 3rd party code; no secrets in code; no admin for server, db
access | includes performance and load testing
✔✔HTTP authN - ✔✔in headers; basic (base 64 encode)
digest: MD5
✔✔Form-Based Authentication - ✔✔cleartext unless SSL; authN errors minimal; acct
lockouts
✔✔password - ✔✔Private combination of characters associated with a user name that
allows access to certain computer resources.
✔✔Certificate-Based Authentication - ✔✔An authentication method that uses a
certificate instead of a password to establish an entity's identity.
✔✔token-based authentication - ✔✔Requires a computer user to physically hold a
device called a token.
✔✔one time password - ✔✔Password generated by a security token, which expires as
soon as it is used.
✔✔footprinting (authN) - ✔✔IP, software / signature / system config to ascertain id of
user or device requesting access
,✔✔Signature Analysis - ✔✔most common method of identifying EOI on network uses a
series of rules and pattern matching to detect and alert
✔✔anomaly analysis based IDS - ✔✔Anomaly analysis-based IDS looks for changes to
the normal patterns of traffic using inclusive analysis which means the IDS vendor
identifies and defines anomalous behavior
✔✔biometric authentication - ✔✔Technology for authenticating system users that
compares a person's unique characteristics such as fingerprints, face, or retinal image,
against a stored set profile of these characteristics.
✔✔Directory Traversal - ✔✔An attack that takes advantage of a vulnerability in the Web
application program or the Web server software so that a user can move from the root
directory to other restricted directories.
✔✔session ID - ✔✔makes stateful; inclues: form element; URL; cookie
long and random
sign / hash IDs
new issued on authN
expire / timeout
✔✔ROI - ✔✔Return of investment or return on investment. A performance measure
used to identify when an investment provides a positive benefit to the investor. It is
sometimes considered when evaluating the purchase of new security controls.
ROI(%) = (gain - expenditure)/(expenditure) x 100
✔✔threat - ✔✔activities that represent danger to info or operations | agent of risk
✔✔danger - ✔✔anything that can negatively impact to CIA of systems and services
✔✔vulnerability - ✔✔A flaw or weakness that allows a threat agent to bypass security.
✔✔0-day - ✔✔exploit that is not publicly know or available
✔✔security controls (types) - ✔✔detective corrective and preventive
✔✔network mapping - ✔✔enumerating hosts responding on a network. NMAP
✔✔port scanning - ✔✔Using a program to remotely determine which ports on a system
are open (e.g., whether systems allow connections through those ports).
✔✔vulnerability scanning - ✔✔look for vulnerabilities associated with discovered
systems ports and services
,✔✔Red Team - ✔✔A group of people authorized and organized to emulate a potential
adversary's attack or exploitation capabilities against an enterprise's security posture.
The Red Team's objective is to improve enterprise Information Assurance by
demonstrating the impacts of successful attacks and by demonstrating what works for
the defenders (i.e., the Blue Team) in an operational environment.
✔✔Blue Team - ✔✔The network defenders in a blind (or black box) penetration test.
Don't have knowledge of the attack.
✔✔Penetration Testing - ✔✔active analysis of a system through simulated attacks and
may involve exploit of live vulns | does not include maintaining access and covering
tracks
✔✔Penetration Testing Techniques - ✔✔war dialing war driving sniffing eavesdropping
dumpster diving social engineering
✔✔network security devices (3) - ✔✔firewalls prevention NIDS detection NIPS
prevention
✔✔Ingress Filtering - ✔✔sniffing incoming packets and discarding those with source IP
addresses outside a given range
✔✔Egress filtering - ✔✔firewall filters packets when they are leaving the network,
prevents replies to probe packets from leaving the network and prevents a firm's
infected hosts from attacking other firms
✔✔tarpit - ✔✔A honeypot that answers connection requests in such a way that the
attacking computer is "stuck" for a period of time. Considered 'aggressive' defense
using TCP flow control to set window size low to 0 to keep conn open and consume
resources
✔✔Artillery - ✔✔Python-based cross platform tool for honeypot file system monitoring
threat intelligence mainly event warning
✔✔BearTrap - ✔✔Ruby-based tool contained in ADHD opens up ports to deceive
attackers and actively block their IPs
✔✔Active Defense Harbinger Distribution (ADHD) - ✔✔Ubuntu-based Linux distro
focused on active defense and offensive countermeasures and has many tools for
deception and attack-back
✔✔Honey Badger - ✔✔attack back tool determines physical location of system with
geolocation wifi and IP address
, ✔✔Decloak - ✔✔discover attacker IP even if through proxy
✔✔Nova - ✔✔Network Obfuscation and Virtualized Anti-Recon can launch VMs called
haystacks (honeypots)
✔✔TCP flow control - ✔✔TCP provides flow control by having the sender maintain a
variable called the
receive window. The size of this window is important. Set low to 0 in tarpit to keep
attacker connections open and consume system resources
✔✔bogus DNS - ✔✔descriptive but deceptive DNS domain names redirect attackers to
jailed env or honeypot
✔✔decoy ports - ✔✔lead attacker to believe many ports open. more scanning needed.
deploy on network device
✔✔honeycreds - ✔✔deploy decoy usually privileged accounts
✔✔jailed environment - ✔✔configured to look like real environment no real data all
traffic permitted
✔✔false headers - ✔✔leave blank or include incorrect information to deceive attackers
about systems
✔✔decoy IP - ✔✔visible but unused IP appear active with open port and vulnerable
service appear as real systems to attackers
✔✔honeytoken - ✔✔files and folders set up to deceive attacker and allow for detection
of the attack
✔✔honeynet - ✔✔a group of honeypots used to more accurately portray an actual
network intended to slow down attacker make the attack more expensive and risky
✔✔honeypot - ✔✔Single, hardened and secure system with no legitimate purpose. A
computer system that's set up to attract unauthorized users by appearing to be a key
part of a network or a system that contains something of great value.
focus on what attacker does to discover new vulns
✔✔attribution - ✔✔id attacker; block country? legal concerns. attacker can defeat with
relay attacks and spoofed IPs
✔✔attack back - ✔✔AKA active defense (retaliation). legal concerns great. AKA
'offensive countermeasures'. must have attribution.
