English
Menu

Cyber Attacks and Defense in Practice

Learn with multiple-choice questions, including calculations: the Cyber Kill Chain and MITRE ATT&CK, initial access, C2 traffic, privilege escalation, lateral movement, living-off-the-land attacks, zero trust and NIST SP 800-207, ZTNA versus VPN, EDR, SIEM, SOAR and the SOC, IDS and IPS, WAFs, detection with decoys, the phases of incident response, evidence collection and chain of custody, IoCs and IoAs, CSIRTs and PSIRTs, clock synchronization of logs, prioritizing vulnerability fixes, penetration testing and red team exercises, coordinated vulnerability disclosure, SBOMs and supply chain attacks, cloud misconfiguration, MFA fatigue and passkeys, session hijacking and privileged access management.

Practice 10 questionsRandom questions from this topic · about 5 minutes Practice this topicAll questions in this topic, in random order Weak questionsRetry only the questions you last got wrong

Cyber Attacks and Defense in Practice: key points

A cyber attack does not end with exploiting a single weakness; it proceeds in stages: intrusion, establishing a foothold, expanding privileges, moving inside and acting on objectives. Defenders, too, are expected not only to think about stopping attacks at the entrance but also, on the assumption that intrusions will happen, to have organizational mechanisms for finding them quickly, stopping their spread, preserving evidence, removing the cause and learning for next time. This topic looks, from the defender's point of view, at how organizations are actually attacked and how they defend themselves.

It starts by organizing the flow of attacks with the Cyber Kill Chain and MITRE ATT&CK, covering initial access methods, clues to C2 traffic, privilege escalation, lateral movement and living-off-the-land attacks that abuse legitimate tools. It then turns to defensive mechanisms: the principles of zero trust and the policy decision and enforcement points of NIST SP 800-207, the difference between VPN and ZTNA, EDR, the roles of SIEM, SOAR and the SOC, IDS and IPS, signature-based and anomaly-based detection, WAFs and detection with decoys. For incident response it covers the phases of NIST SP 800-61, the order of volatility and chain of custody, IoCs and IoAs, CSIRTs and PSIRTs, and correcting clock offsets in logs. The second half covers prioritizing fixes by combining CVSS with exploitation status, penetration testing and red team exercises, coordinated vulnerability disclosure, SBOMs, and supply chain attacks such as dependency confusion and abuse of legitimate updates, and, for cloud and identity, public-access misconfiguration of storage, overly broad permissions, MFA fatigue attacks, why passkeys resist phishing, theft of session cookies, privileged access management and secrets committed to repositories. Finally, it checks by calculation the mean time to detect, the return on security investment (ROSI), the proportion of IDS alerts that are real attacks and the number of analysts needed. It helps with the security sections of IT certification exams such as Japan's Registered Information Security Specialist Examination and Applied Information Technology Engineer Examination. The values in the calculation questions, including those of the wrong choices, have been checked by computing them in Python. Standards and events given with a year or revision reflect the information as of that time. The three elements of information security, risk treatment, malware and phishing, web application vulnerabilities, the basics of CVE and CVSS and the first response to a ransomware infection are covered in "Information Security Basics"; cryptography and certificates in "Applied Cryptography"; defense in depth for hardware and secure boot in "Hardware Security"; the basics of firewalls and VPNs in "Computer Networking Basics"; the shared responsibility model in "Cloud and Container Basics"; and ITIL incident management in "IT Service Management and Systems Audit".

All Cyber Attacks and Defense in Practice questions (40)
  1. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  2. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  3. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  4. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  5. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?
  6. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  7. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  8. Which of the following correctly describes access control based on the idea of zero trust?
  9. The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?
  10. Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?
  11. Which of the following correctly describes EDR (endpoint detection and response) compared with traditional antivirus software?
  12. Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?
  13. Which of the following correctly describes the difference between an IDS (intrusion detection system) and an IPS (intrusion prevention system)?
  14. Which of the following correctly compares signature-based (misuse) detection and anomaly-based detection as IDS detection methods?
  15. Which of the following correctly describes a WAF (web application firewall)?
  16. An organization places "decoy" files that nobody uses for work, and a decoy administrator account that no system uses, on an internal file server, and monitors access to them. Which of the following is the main advantage of this measure?
  17. The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?
  18. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?
  19. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?
  20. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?
  21. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?
  22. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?
  23. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?
  24. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?
  25. An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?
  26. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?
  27. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?
  28. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?
  29. It was found that files containing customer information in cloud object storage could be read by anyone on the internet. Which of the following is an appropriate combination of a typical cause of this kind of leak and a measure to prevent recurrence?
  30. An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?
  31. An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?
  32. Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?
  33. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?
  34. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?
  35. Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?
  36. A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?
  37. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?
  38. For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?
  39. An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?
  40. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

Other topics in Computer systems