ISAC Cyber Threats and Vulnerabilities 5 — Questions and Answers
Question 1: What is a 'honeypot' in cybersecurity defense?
- A secure vault for storing encryption keys
- A decoy system designed to attract and detect attackers (Correct answer)
- A type of firewall that filters sweet-spot traffic
- A patch management system that prioritizes critical vulnerabilities
Correct answer: A decoy system designed to attract and detect attackers
A honeypot is a deliberately vulnerable decoy system set up to lure attackers, allowing defenders to study their techniques without risk to real assets.
Question 2: Which social engineering technique specifically targets high-profile individuals like executives?
- Phishing
- Whaling (Correct answer)
- Vishing
- Smishing
Correct answer: Whaling
Whaling is a targeted phishing attack specifically aimed at high-value individuals such as C-suite executives, board members, or senior officials.
Question 3: What is 'eavesdropping' in network security?
- Listening to employee conversations in the office
- Passively intercepting network traffic to capture sensitive data without the sender's knowledge (Correct answer)
- Monitoring system logs for suspicious activity
- Recording keystrokes using a hardware keylogger
Correct answer: Passively intercepting network traffic to capture sensitive data without the sender's knowledge
Network eavesdropping involves passively capturing data packets in transit, often using packet sniffers, without altering or disrupting the communication.
Question 4: In cybersecurity, what does 'CVE' stand for?
- Cyber Vulnerability Evaluation
- Common Vulnerabilities and Exposures (Correct answer)
- Critical Virus Enumeration
- Certified Vulnerability Expert
Correct answer: Common Vulnerabilities and Exposures
CVE (Common Vulnerabilities and Exposures) is a publicly maintained list of known cybersecurity vulnerabilities, each assigned a unique identifier.
Question 5: What is the purpose of a 'rootkit'?
- To gain initial access to a system through the root login
- To hide malicious software and attacker activity at the deepest system level (Correct answer)
- To encrypt the root directory of a file system
- To automatically root Android devices for unauthorized app installation
Correct answer: To hide malicious software and attacker activity at the deepest system level
Rootkits conceal malware and attacker presence by modifying the operating system at a low level, making detection extremely difficult.
Question 6: What is 'reconnaissance' in the context of a cyber attack lifecycle?
- The phase where an attacker deploys malware to compromised systems
- The information-gathering phase where attackers profile the target before launching an attack (Correct answer)
- The process of covering tracks after a successful breach
- The stage where vulnerabilities are actively exploited
Correct answer: The information-gathering phase where attackers profile the target before launching an attack
Reconnaissance is the first phase of an attack where adversaries collect information about the target — network topology, employees, technologies — to plan the assault.
Question 7: Which type of attack involves overwhelming a web application with requests designed to exploit its processing logic rather than flood its bandwidth?
- Volumetric DDoS
- Application layer (Layer 7) DDoS (Correct answer)
- SYN flood attack
- Smurf attack
Correct answer: Application layer (Layer 7) DDoS
Layer 7 DDoS attacks target the application layer with seemingly legitimate requests that exhaust server resources through complex processing rather than sheer volume.
ISAC Cyber Threats and Vulnerabilities 5
What is a 'honeypot' in cybersecurity defense?