GSEC CORE MAIN QUESTIONS AND ANSWERS SET
A+
✔✔application-level virtual machine - ✔✔run an app on its own VM so if compromised
cannot compromise other systems
✔✔OS virtual machine - ✔✔multiple operating systems run independently on the same
hardware
✔✔virtualization - ✔✔emulation software for virtualization| allows a single computing
device to run multiple operating systems through hardware emulation | accesses
virtualized hardware, not physical
✔✔hypervisor - ✔✔emulation software for virtualization; allows a single computing
device to run multiple operating systems through hardware emulation
✔✔VM escapes - ✔✔attack to escape guest OS compromise hypervisor
✔✔virtual machine introspection - ✔✔monitor hypervisor and all VMs
✔✔virtual sprawl - ✔✔number of VMs / guest systems too big to manage
✔✔air gap - ✔✔physical separation of hardware (servers)
✔✔DMA - ✔✔Direct memory access (DMA) is a feature which allows for the accessing
of memory and controllers (video and network cards), without utilizing the CPU such
✔✔hyperjacking - ✔✔compromise the hypervisor to gain access to the VMs and their
data typically launched against type 2 hypervisors that run over a host OS
✔✔hyperjumping - ✔✔attacker compromises one guest OS and jumps to another |
lateral compromise
,✔✔rowhammer - ✔✔hardware exploit; escalate privileges, escape VM, flipping bits in
memory
✔✔blue pill - ✔✔logical exploit; create false hypervisor with root access
✔✔type 1 hypervisor - ✔✔bare metal hypervisor it is a software program that acts as an
operating system and also provides the ability to perform virtualization of other
operating systems using the same computer (e.g. Hyper V)
✔✔type 2 hypervisor - ✔✔Software to manage virtual machines that is installed as an
application in an operating system. (e.g. Virtual Box)
✔✔content discovery - ✔✔monitor data for restricted info
✔✔Volume Storage - ✔✔virtual hard drive; data dispersion and/or encryption
✔✔object storage - ✔✔Objects (files) are stored with additional metadata (content type,
redundancy required, creation date, etc.). These objects are accessible through APIs
and potentially through a web user interface. (e.g. Dropbox)
✔✔Volume Storage Encryption - ✔✔encryption of virtual hard drives in cloud
environment
✔✔VPS - ✔✔A Virtual Private Server is a part of a physical machine that is used as a
server, many may exist on the same computer.
✔✔DLP - ✔✔Data Loss Prevention; Systems that monitor the contents of systems
(workstations, servers, and networks) to make sure that key content is not deleted or
removed
✔✔database activity monitoring - ✔✔all SQL transactions and policy violations
✔✔file activity monitoring - ✔✔policy violations
✔✔data dispersion - ✔✔protects data without encryption through fragmentation
✔✔data fragmentation - ✔✔DDBMS can divide and manage a logical object among
various locations under its control
✔✔cloud resistance - ✔✔compliance; multi tenancy; vendor lock; logging
,✔✔Private cloud (internal or corporate cloud) - ✔✔IT infrastructures that can be
accessed only by a single entity or by an exclusive group of related entities that share
the same purpose
✔✔Public Cloud Infrastructure - ✔✔Provisioned for open use by the general public. It
may be owned, managed, and operated by a business, academic, or government
organization, or some combination of them. It exists on the premises of the cloud
provider.
✔✔Hybrid Cloud Infrastructure - ✔✔A composition of two or more distinct cloud
infrastructures (private, community, or public) that remain unique entities but are bound
together by standardized or proprietary technology that enables data and application
portability.
✔✔IaaS - ✔✔Infrastructure as a Service. A cloud computing technology useful for
heavily utilized systems and networks. Organizations can limit their hardware footprint
and personnel costs by renting access to hardware such as servers. Compare to PaaS
and SaaS.
✔✔hub - ✔✔A device that uses its ports to connect devices (computers, printers, etc.)
together and broadcasts all data on all channels
✔✔bridge - ✔✔aggregates two physical networks or segments together contrast with
routing of independent networks
✔✔ARP - ✔✔Address Resolution Protocol. An Internet protocol used to map an IP
address to a MAC address. Defined in RFC 826.
✔✔ARP Poisoning Attack - ✔✔ARP poisoning attack, some Ethernet switches flood the
directed traffic to all ports of the switch, which could allow an attacker to monitor traffic
not normally visible to the port where the attacker was connected, and thereby
eavesdrop on VOIP traffic.
✔✔sniffer - ✔✔a type of eavesdropping program that monitors information traveling
over a network; puts NIC in promiscuous mode; usually software
✔✔Ettercap - ✔✔Sniffers. A suite for man in the middle attacks on LAN. It features
sniffing of live connections, content filtering on the fly and many other interesting tricks.
It supports active and passive dissection of many protocols (even ciphered ones) and
includes many feature for network and host analysis.
✔✔Port Mirroring/Spanning - ✔✔Copies the traffic from one, a group, or all ports to a
single port and disallows bidirectional traffic on that port. Used to view traffic on other
ports in a switched environment.
, ✔✔MAC address - ✔✔A hardware address of 48 bits, unique identifier similar to a serial
number assigned to networking equipment at the time of manufacture; Media Access
Control; aka ethernet address; .5 vendor / .5 NIC; L2
✔✔IP address - ✔✔A software address, Internet Protocol; a unique string of numbers
separated by periods that identifies each computer on a network; 32 bits / 4 bytes;
NET_ID / HOST_ID
✔✔IOS - ✔✔Cisco Internetwork Operating System Software that provides the majority
of a router's or switch's features, with the hardware providing the remaining features.
✔✔telnet - ✔✔plain text; port 23
✔✔SSH - ✔✔secure shell; port 22; user certs, preshared keys
✔✔VLAN - ✔✔Virtual LAN split network on a switch into multiple networks software-split
networks; control visibility, access
✔✔NAC - ✔✔Network access control. Inspects clients for health and can restrict
network access to unhealthy clients to a remediation network. Clients run agents and
these agents report status to a NAC server. NAC is used for VPN and internal clients.
MAC filtering is a form of NAC.
✔✔802.1x - ✔✔The IEEE standard that defines port-based security for wireless network
access control
✔✔port forwarding - ✔✔The process of redirecting traffic from its normally assigned port
to a different port, either on the client or server. In the case of using SSH, port
forwarding can send data exchanges that are normally insecure through encrypted
tunnels.
✔✔protocol - ✔✔A set of rules governing the exchange or transmission of data between
devices Standardize comms format specify order and timing and determining meaning
✔✔OSI model - ✔✔Open System Interconnection: Application, Presentation, Session,
Transport, Network, Data Link, Physical
✔✔Physical Layer - ✔✔Layer 1 of the OSI model. Protocols in this layer generate and
detect signals so as to transmit and receive data over a network medium. These
protocols also set the data transmission rate and monitor data error rates, but do not
provide error correction.
A+
✔✔application-level virtual machine - ✔✔run an app on its own VM so if compromised
cannot compromise other systems
✔✔OS virtual machine - ✔✔multiple operating systems run independently on the same
hardware
✔✔virtualization - ✔✔emulation software for virtualization| allows a single computing
device to run multiple operating systems through hardware emulation | accesses
virtualized hardware, not physical
✔✔hypervisor - ✔✔emulation software for virtualization; allows a single computing
device to run multiple operating systems through hardware emulation
✔✔VM escapes - ✔✔attack to escape guest OS compromise hypervisor
✔✔virtual machine introspection - ✔✔monitor hypervisor and all VMs
✔✔virtual sprawl - ✔✔number of VMs / guest systems too big to manage
✔✔air gap - ✔✔physical separation of hardware (servers)
✔✔DMA - ✔✔Direct memory access (DMA) is a feature which allows for the accessing
of memory and controllers (video and network cards), without utilizing the CPU such
✔✔hyperjacking - ✔✔compromise the hypervisor to gain access to the VMs and their
data typically launched against type 2 hypervisors that run over a host OS
✔✔hyperjumping - ✔✔attacker compromises one guest OS and jumps to another |
lateral compromise
,✔✔rowhammer - ✔✔hardware exploit; escalate privileges, escape VM, flipping bits in
memory
✔✔blue pill - ✔✔logical exploit; create false hypervisor with root access
✔✔type 1 hypervisor - ✔✔bare metal hypervisor it is a software program that acts as an
operating system and also provides the ability to perform virtualization of other
operating systems using the same computer (e.g. Hyper V)
✔✔type 2 hypervisor - ✔✔Software to manage virtual machines that is installed as an
application in an operating system. (e.g. Virtual Box)
✔✔content discovery - ✔✔monitor data for restricted info
✔✔Volume Storage - ✔✔virtual hard drive; data dispersion and/or encryption
✔✔object storage - ✔✔Objects (files) are stored with additional metadata (content type,
redundancy required, creation date, etc.). These objects are accessible through APIs
and potentially through a web user interface. (e.g. Dropbox)
✔✔Volume Storage Encryption - ✔✔encryption of virtual hard drives in cloud
environment
✔✔VPS - ✔✔A Virtual Private Server is a part of a physical machine that is used as a
server, many may exist on the same computer.
✔✔DLP - ✔✔Data Loss Prevention; Systems that monitor the contents of systems
(workstations, servers, and networks) to make sure that key content is not deleted or
removed
✔✔database activity monitoring - ✔✔all SQL transactions and policy violations
✔✔file activity monitoring - ✔✔policy violations
✔✔data dispersion - ✔✔protects data without encryption through fragmentation
✔✔data fragmentation - ✔✔DDBMS can divide and manage a logical object among
various locations under its control
✔✔cloud resistance - ✔✔compliance; multi tenancy; vendor lock; logging
,✔✔Private cloud (internal or corporate cloud) - ✔✔IT infrastructures that can be
accessed only by a single entity or by an exclusive group of related entities that share
the same purpose
✔✔Public Cloud Infrastructure - ✔✔Provisioned for open use by the general public. It
may be owned, managed, and operated by a business, academic, or government
organization, or some combination of them. It exists on the premises of the cloud
provider.
✔✔Hybrid Cloud Infrastructure - ✔✔A composition of two or more distinct cloud
infrastructures (private, community, or public) that remain unique entities but are bound
together by standardized or proprietary technology that enables data and application
portability.
✔✔IaaS - ✔✔Infrastructure as a Service. A cloud computing technology useful for
heavily utilized systems and networks. Organizations can limit their hardware footprint
and personnel costs by renting access to hardware such as servers. Compare to PaaS
and SaaS.
✔✔hub - ✔✔A device that uses its ports to connect devices (computers, printers, etc.)
together and broadcasts all data on all channels
✔✔bridge - ✔✔aggregates two physical networks or segments together contrast with
routing of independent networks
✔✔ARP - ✔✔Address Resolution Protocol. An Internet protocol used to map an IP
address to a MAC address. Defined in RFC 826.
✔✔ARP Poisoning Attack - ✔✔ARP poisoning attack, some Ethernet switches flood the
directed traffic to all ports of the switch, which could allow an attacker to monitor traffic
not normally visible to the port where the attacker was connected, and thereby
eavesdrop on VOIP traffic.
✔✔sniffer - ✔✔a type of eavesdropping program that monitors information traveling
over a network; puts NIC in promiscuous mode; usually software
✔✔Ettercap - ✔✔Sniffers. A suite for man in the middle attacks on LAN. It features
sniffing of live connections, content filtering on the fly and many other interesting tricks.
It supports active and passive dissection of many protocols (even ciphered ones) and
includes many feature for network and host analysis.
✔✔Port Mirroring/Spanning - ✔✔Copies the traffic from one, a group, or all ports to a
single port and disallows bidirectional traffic on that port. Used to view traffic on other
ports in a switched environment.
, ✔✔MAC address - ✔✔A hardware address of 48 bits, unique identifier similar to a serial
number assigned to networking equipment at the time of manufacture; Media Access
Control; aka ethernet address; .5 vendor / .5 NIC; L2
✔✔IP address - ✔✔A software address, Internet Protocol; a unique string of numbers
separated by periods that identifies each computer on a network; 32 bits / 4 bytes;
NET_ID / HOST_ID
✔✔IOS - ✔✔Cisco Internetwork Operating System Software that provides the majority
of a router's or switch's features, with the hardware providing the remaining features.
✔✔telnet - ✔✔plain text; port 23
✔✔SSH - ✔✔secure shell; port 22; user certs, preshared keys
✔✔VLAN - ✔✔Virtual LAN split network on a switch into multiple networks software-split
networks; control visibility, access
✔✔NAC - ✔✔Network access control. Inspects clients for health and can restrict
network access to unhealthy clients to a remediation network. Clients run agents and
these agents report status to a NAC server. NAC is used for VPN and internal clients.
MAC filtering is a form of NAC.
✔✔802.1x - ✔✔The IEEE standard that defines port-based security for wireless network
access control
✔✔port forwarding - ✔✔The process of redirecting traffic from its normally assigned port
to a different port, either on the client or server. In the case of using SSH, port
forwarding can send data exchanges that are normally insecure through encrypted
tunnels.
✔✔protocol - ✔✔A set of rules governing the exchange or transmission of data between
devices Standardize comms format specify order and timing and determining meaning
✔✔OSI model - ✔✔Open System Interconnection: Application, Presentation, Session,
Transport, Network, Data Link, Physical
✔✔Physical Layer - ✔✔Layer 1 of the OSI model. Protocols in this layer generate and
detect signals so as to transmit and receive data over a network medium. These
protocols also set the data transmission rate and monitor data error rates, but do not
provide error correction.
