CYSA prep UPDATED ACTUAL Questions and CORRECT Answers
What port would be suspicious for a user to be sending
53 (DNS)
traflc over?
In active directory, what does having directory browsing
Exposure to directory structure and contents
enabled expose yourself to?
What protocol was created by Cisco and is used for au-
TACACS+
thentication, authorization, and accounting?
Where can you find a list of wireless networks that a
Windows registry
system has previously accessed?
What is the best method for conducting forensic analysis Suspend the VM and conduct analysis on the memory file
on a VM? written to the OS/Hard disk
OWASP Open Web Application Security Project
2 differences between reconnaissance on a wired vs wire-
Encryption (wireless is end-to-end) and physical access
less network
Which nmap command should be utilized to send a SYN
nmap -sT
packet when raw socket privileges are not available?
is used to identify endpoint's characteristics? NAC
logs all boot actions & stores
Measured boot
on TPM for later review and analysis by AV/AM
What TCP packet is best for probing firewalls? TCP ACK
Rogue devices on a network are able to be identified by
Router and switch-based MAC address reporting
referencing???
What does fast flux do? Rapidly changes the IP address associated with a DNS
In the Diamond Intrusion Model, what are the resources
Infrastructure
that the attacker uses categorized as?
Providing invalid, unexpected, or random data as inputs Fuzzing
UEFI Boot sequence Security (always first) -> Pre init boot
, What does SQL Injections exploit Web application
UEBA User Entity Behavior Analytics
What would FPGA classify as? Anti-tamper
Unencrypted 389
LDAP ports (unencrypted and encrypted)
Encrypted 636
System on a network used to access and manage devices
in a separate security zone. It is a hardened and monitored
Jumpbox
device that spans 2 dissimilar security zones and provides
a controlled means of access between them.
What OS ring are rootkits installed on? Ring 0
What kind of reconnaissance is banner grabbing and
Active; it requires a direct connection to the host
why?
What does Akamai provide? Content Delivery Network (CDN) services
What application is used to audit a multi-cloud environ-
Scoutsuite
ment
192.168.x.x
IP addresses for Privately routed 172.16-31.x.x
10.x.x.x
In a PCIDSS breach on your network, who is the first to be
Your credit card processor
notified
Capability in the diamond intrusion analysis framework
tools/techniques used
refers to what
Wannacry patch from MS MS17-010
GPO Group policy object
What is the value of output encoding Takes the < character to the < string
Credential Stuflng
2/5
What port would be suspicious for a user to be sending
53 (DNS)
traflc over?
In active directory, what does having directory browsing
Exposure to directory structure and contents
enabled expose yourself to?
What protocol was created by Cisco and is used for au-
TACACS+
thentication, authorization, and accounting?
Where can you find a list of wireless networks that a
Windows registry
system has previously accessed?
What is the best method for conducting forensic analysis Suspend the VM and conduct analysis on the memory file
on a VM? written to the OS/Hard disk
OWASP Open Web Application Security Project
2 differences between reconnaissance on a wired vs wire-
Encryption (wireless is end-to-end) and physical access
less network
Which nmap command should be utilized to send a SYN
nmap -sT
packet when raw socket privileges are not available?
is used to identify endpoint's characteristics? NAC
logs all boot actions & stores
Measured boot
on TPM for later review and analysis by AV/AM
What TCP packet is best for probing firewalls? TCP ACK
Rogue devices on a network are able to be identified by
Router and switch-based MAC address reporting
referencing???
What does fast flux do? Rapidly changes the IP address associated with a DNS
In the Diamond Intrusion Model, what are the resources
Infrastructure
that the attacker uses categorized as?
Providing invalid, unexpected, or random data as inputs Fuzzing
UEFI Boot sequence Security (always first) -> Pre init boot
, What does SQL Injections exploit Web application
UEBA User Entity Behavior Analytics
What would FPGA classify as? Anti-tamper
Unencrypted 389
LDAP ports (unencrypted and encrypted)
Encrypted 636
System on a network used to access and manage devices
in a separate security zone. It is a hardened and monitored
Jumpbox
device that spans 2 dissimilar security zones and provides
a controlled means of access between them.
What OS ring are rootkits installed on? Ring 0
What kind of reconnaissance is banner grabbing and
Active; it requires a direct connection to the host
why?
What does Akamai provide? Content Delivery Network (CDN) services
What application is used to audit a multi-cloud environ-
Scoutsuite
ment
192.168.x.x
IP addresses for Privately routed 172.16-31.x.x
10.x.x.x
In a PCIDSS breach on your network, who is the first to be
Your credit card processor
notified
Capability in the diamond intrusion analysis framework
tools/techniques used
refers to what
Wannacry patch from MS MS17-010
GPO Group policy object
What is the value of output encoding Takes the < character to the < string
Credential Stuflng
2/5
