CCNA CyberOps Chapter 13 Exam Online

Hint

The incident description top-level element uses the 4A model (actors, actions, assets, and attributes). Each section has subsections to further document the incident.

Hint

One tactic of weaponization used by a threat actor after the vulnerability is identified is to obtain an automated tool to deliver the malware payload through the vulnerability.

Hint

Vocabulary for Event Recording and Incident Sharing (VERIS) is a set of metrics designed to create a way to describe security incidents in a structured or repeatable way. A Computer Security Incident response Team (CSIRT) is an internal organizational group that provides services and functions to secure assets. Cyber Kill Chain contains seven steps which help analysts understand the techniques, tools, and procedures of threat actors. The Diamond Model of intrusion has four parts that represent a security incident.

Hint

There are many different types of CSIRTs and related information security organizations. Vendor CSIRT teams provide remediation for vulnerabilities in the software or hardware of an organization and often handle customer reports concerning security vulnerabilities.

Hint

A Computer Emergency Response Team (CERT) provides security awareness, best practices, and security vulnerability information to populations. A CERT does not respond directly to security incidents.

Hint

NIST recommends creating policies, plans, and procedures for establishing and maintaining a CSIRC. A purpose of the policy element is to detail how incidents should be handled based on the mission and functions of an organization.

Hint

NIST recommends creating policies, plans, and procedures for establishing and maintaining a CSIRC. A purpose of the plan element is to develop metrics for measuring the incident response capability and its effectiveness.

Hint

A CSIRC will include standard operating procedures (SOPs) that are followed during an incident response. Procedures include following technical processes, filling out forms, and following checklists.

Hint

Threat actors may use port scanning toward a web server of an organization and identify vulnerabilities on the server. They may visit the web server to collect information about the organization. The web server logging should be enabled and the logging data should be analyzed to identify possible reconnaissance threats. Building playbooks by filtering and combining related web activities by visitors can sometimes reveal the intentions of threat actors.

Hint

The most common exploit targets, once a weapon is delivered, are applications, operating system vulnerabilities, and user accounts. Among other measures, conducting employee awareness training and email testing and auditing endpoints to forensically determine the origin of an exploit can help block future exploitations of systems.

Hint

In the installation phase of the Cyber Kill Chain, the threat actor establishes a back door into the system to allow for continued access to the target.

Hint

In the command and control phase of the Cyber Kill Chain, the threat actor establishes command and control (CnC) with the target system. With the two-way communication channel, the threat actor is able to issue commands to the malware software installed on the target.

Hint

The Diamond Model of intrusion contains four parts:

• Adversary – the parties responsible for the intrusion
• Capability – a tool or technique that the adversary uses to attack the victim
• Infrastructure – the network path or paths that the adversaries use to establish and maintain command and control over their capabilities
• Victim – the target of the attack

Hint

The VERIS community database is free. It can be used as a tool for risk management, to document security incidents, to discover over incidents, and to compare how other organizations dealt with a particular type of security incident.

Hint

It is in the post-incident phase of the NIST incident response life cycle phase that the CSIRT documents how incidents are handled. Recommended changes for future response are also made to avoid reoccurrences.

Hint

The scoping activity performed by the CSIRT after an incident determines which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring.

Hint

Once an attack is contained, the next step is to identify all hosts that will need remediation so that the effects of the attack can be eliminated.

Hint

A chain of custody refers to the proper accounting of evidence collected about an incident that is used as part of an investigation. The chain of custody should include the location of all evidence, the identifying information of all evidence such as serial numbers and hostnames, identifying information about all persons handing the evidence, and the time and date that the evidence was collected.

Hint

The meta-feature element results are used to delineate what the adversary gained from the intrusion event.

Hint

After the weapon has been delivered, the threat actor uses it to break the vulnerability and gain control of the target. The threat actor will use an exploit that gains the effect desired, does it quietly, and avoids detections. Establishing a back door in the target system is the phase of installation.

Hint

According to the Cyber Kill Chain model, in the reconnaissance phase the threat actor performs research, gathers intelligence, and selects targets.

Hint

When security professionals are alerted about the system compromises, forensic analysis of endpoints should be performed immediately for rapid triage. In addition, detection efforts for further attacking activities such as data exfiltration, lateral movement, and unauthorized credential usage should be enhanced to reduce damage to the minimum.

Hint

During the installation step, the threat actor installed a server backdoor in order to install the malware (installation step), and an outside server command channel was created to manipulate the target (CnC step). The final step is used to access the server to achieve the objective of the attack.
The Cyber Kill Chain has seven steps:

1. reconnaissance
2. weaponization
3. delivery
4. exploitation
5. installation
6. command and control (CnC)
7. actions on objectives

Hint

Information provided in the IIS access log includes the date, time, client IP address, username, port number, requested action, bytes sent, bytes received, and content of the cookie sent or received.

Hint

A positive alert of any type means that the system generated a system alert. A true positive indicates the incident occurred. A false positive is that no incident occurred (the system alerted, but there was no problem). A negative alert of any type means there was no alert generated. A true negative indicates that there wasn’t any incident (thus no alert). A false negative indicates that there was an incident, but an alert was not generated.

Hint

Three classifications of hackers are black hat, gray hat, and white hat. White hat hackers use their security skills for good, ethical, legal purposes. Gray hat hackers do not compromise the network for personal gain or to cause damage such as when users leave their computers logged into the corporate network and walk away. Black hat hackers penetrate computers or servers for malicious reasons, such as to slow down system performance.