CySA+ topics: log analysis, packet capture, network indicators, endpoint indicators, threat intelligence sharing and basic scripting.
34 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the primary purpose of log analysis in security operations?
Show answer
To detect and investigate security events, anomalies, and potential threats by examining system and application records.- Name three common sources of security logs in an enterprise environment.
Show answer
Firewalls, authentication systems (Active Directory), and web servers.- What does CEF stand for?
Show answer
Common Event Format.- What is log correlation?
Show answer
Combining logs from multiple sources to identify patterns, timelines, and relationships between events.- Which command is used to perform real-time packet capture on Linux?
Show answer
tcpdump.- What is Wireshark primarily used for?
Show answer
Capturing and analyzing network packets with a graphical interface.- What file format do packet capture tools like tcpdump and Wireshark use by default?
Show answer
PCAP (Packet Capture) or PCAPNG.- What is a network indicator of compromise?
Show answer
Observable network traffic patterns or artifacts that suggest malicious activity, such as connections to known C2 servers.- What is C2 communication?
Show answer
Command and Control communication, where malware contacts a remote server to receive commands or exfiltrate data.- What is DNS tunneling?
Show answer
A technique where attackers encode data in DNS queries and responses to bypass network controls or establish covert channels.- What is HTTP beaconing?
Show answer
Malware regularly contacting a remote server over HTTP/HTTPS at set intervals to check for commands or send status.- What is an endpoint indicator of compromise?
Show answer
Observable artifacts on a host system that suggest malicious activity, such as suspicious files, registry keys, or running processes.- What is the significance of file hashes in threat intelligence?
Show answer
They uniquely identify files and allow analysts to quickly match malware across systems and correlate with known threats.- Name a common Windows registry location where malware persists at startup.
Show answer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Run or HKEY_CURRENT_USER\Software\Microsoft\Windows\Run.- What is DLL injection?
Show answer
A technique where malware forces a running process to load a malicious DLL, gaining code execution within that process's context.
FlashKeepers