Mixed Deck — All CSX Topics Flashcards

Certificate Transparency (CT) logs are useful for reconnaissance because they:

Answer: Publicly record all TLS certificates issued, exposing subdomains and internal hostnames

CT logs require CAs to publicly log every issued certificate, enabling attackers and defenders alike to discover subdomains and infrastructure that organizations may not have intended to expose.

Which type of audience requires the most technical detail in a cybersecurity report?

Answer: Security operations team

The security operations team needs full technical detail including payloads, log excerpts, and tool output to investigate and remediate findings.

Which backup rotation scheme ensures that backups are retained across daily, weekly, and monthly intervals using a minimal number of media sets?

Answer: Grandfather-Father-Son (GFS)

The Grandfather-Father-Son (GFS) scheme uses daily (Son), weekly (Father), and monthly (Grandfather) backup sets to balance retention coverage with media efficiency.

What is the primary goal of tokenization in payment card security (PCI DSS)?

Answer: To replace sensitive card data with a non-sensitive token, reducing PCI scope

Tokenization replaces primary account numbers (PANs) with tokens that have no exploitable value, reducing systems in PCI DSS scope.

What is the primary purpose of 'chaos engineering' in the context of operational resilience?

Answer: To intentionally introduce failures to test system resilience and identify weaknesses

Chaos engineering deliberately injects failures into systems to discover weaknesses before real failures occur, improving resilience.

What is the primary purpose of an incident report in CSX operations?

Answer: To create an official record of events for investigation, legal proceedings, and organizational learning

Incident reports serve as official, factual records of events that support investigations, legal proceedings, and organizational learning. They must be accurate, objective, timely, and thorough.

In CSX practice, what is the chain of custody and why is it important?

Answer: A documented record of evidence handling from collection to court presentation, ensuring admissibility

Chain of custody is the chronological documentation of evidence collection, transfer, analysis, and storage. Any break in the chain can make evidence inadmissible in court by creating doubt about its integrity.

Which attack technique involves an adversary intercepting communications between two parties without either party being aware?

Answer: Man-in-the-Middle (MitM) attack

A Man-in-the-Middle attack allows an adversary to secretly intercept and potentially alter communications between two parties who believe they are communicating directly.

What does the Fourth Amendment protect against in CSX operations?

Answer: Unreasonable searches and seizures by requiring probable cause or warrants

The Fourth Amendment protects individuals from unreasonable searches and seizures by the government, generally requiring probable cause and a warrant issued by a neutral judge before searches can be conducted.

In CSX risk assessment, what does threat vulnerability analysis involve?

Answer: Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents

Threat vulnerability analysis systematically identifies potential threats (natural, human, technological), evaluates existing vulnerabilities, assesses the probability and potential impact of each threat, and prioritizes mitigation measures.

A security team's use-of-force policy requires a 'Legal Hold' be placed on all evidence before any active response. What is the PRIMARY purpose of this requirement?

Answer: To preserve evidence integrity for potential litigation or law enforcement referral

A legal hold ensures that digital evidence is preserved in an unmodified, admissible state for potential criminal prosecution, civil litigation, or regulatory proceedings.

In CSX risk assessment, what does threat vulnerability analysis involve?

Answer: Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents

Threat vulnerability analysis systematically identifies potential threats (natural, human, technological), evaluates existing vulnerabilities, assesses the probability and potential impact of each threat, and prioritizes mitigation measures.

What is the key difference between an Indicator of Compromise (IOC) and an Indicator of Attack (IOA)?

Answer: IOCs identify artifacts of past compromises while IOAs identify attacker behaviors in progress

IOCs (file hashes, IPs, domains) indicate a compromise has already occurred, whereas IOAs focus on real-time behaviors and TTPs that indicate an attack is actively underway.

Why is asset classification important in threat assessment?

Answer: It identifies critical systems to secure first

Asset classification involves categorizing an organization's assets based on their value, sensitivity, and criticality to business operations. This process is crucial in threat assessment because it allows security teams to prioritize protection efforts. By identifying critical systems first, resources can be allocated effectively to secure the most vital components, maximizing security posture.

An analyst discovers that an attacker used a legitimate administrative tool already present on the system to move laterally. This technique is known as:

Answer: Living off the land (LotL)

Living off the land (LotL) techniques use legitimate built-in tools like PowerShell or WMI to conduct attacks, making detection harder since no foreign binaries are introduced.

Which document provides step-by-step procedural guidance for SOC analysts responding to a specific incident type?

Answer: Runbook or playbook

Runbooks and playbooks are pre-written procedural guides that walk analysts through the exact steps to take when responding to specific incident scenarios.

Which provision of the USA PATRIOT Act significantly expanded law enforcement's ability to conduct roving wiretaps in cybercrime investigations?

Answer: Section 206

Section 206 of the PATRIOT Act authorized 'roving' wiretaps that follow a specific target across multiple devices and communication services, rather than being tied to a single device.

A company's threat intelligence team identifies that their industry sector is being actively targeted by a nation-state group. What type of threat intelligence is this?

Answer: Strategic intelligence

Strategic intelligence provides high-level information about threat actors, their motivations, and targeting trends to inform executive decision-making and long-term planning.

In the context of email forensics, what does the 'Received' header field reveal?

Answer: The hop-by-hop path the email traveled through mail servers

Each 'Received' header is appended by every mail server that handles the email, creating a traceable path from sender to recipient that can reveal the message's origin.

What is the first phase of the incident response lifecycle according to NIST SP 800-61?

Answer: Preparation

NIST SP 800-61 defines Preparation as the first phase, focusing on building incident response capabilities before any incident occurs.