What is the main goal of an APT?

To remain undetected and steal sensitive information

To deface websites and social media accounts

To spread malware to as many systems as possible

To disrupt the targeted organization's operations

What is an insider threat?

A threat that originates from within an organization

A threat that originates from outside an organization

A threat that originates from natural disasters

A threat that originates from alien beings

What is an example of an insider threat?

An employee stealing confidential company data

A competitor launching a cyber-attack

A random person hacking the company's network

A software bug causing data loss

How can organizations mitigate the risk of insider threats?

Implementing strict access controls and monitoring systems

Installing firewalls and antivirus software

What is an example of an unintentional insider threat?

Accidentally emailing sensitive information to the wrong recipient

Intentionally leaking confidential company data

Physically stealing company assets

What is social engineering in the context of insider threats?

Manipulating individuals to gain unauthorized access to systems or information

Exploiting software vulnerabilities to gain access

Using physical force to breach security barriers

Performing regular security audits

What is the concept of 'need to know' in relation to insider threats?

Limiting access to sensitive information to only those who require it for their job

Allowing employees to access any information they want

Not implementing any access controls or restrictions

Sharing sensitive information with everyone in the organization

What is a hacktivist?

An individual who uses hacking techniques to promote political or social causes

A type of software used for hacking

A person who hacks for personal gain

A group of hackers who target governments

What is one characteristic of script kiddies?

Expert understanding of network infrastructure

What is a common target for script kiddie attacks?

Websites with known vulnerabilities

Banking and financial institutions

What is a script kiddie?

A person who uses pre-written hacking scripts without understanding them

A person who invents new hacking techniques

A person who uses their own custom hacking tools

A person who only targets websites

What is a white hat hacker?

An ethical hacker who uses their skills to protect systems and identify vulnerabilities

A hacker who uses their skills for personal gain

A hacker who spreads malware and viruses

A hacker who steals sensitive information

What is the primary difference between a white hat hacker and a black hat hacker?

White hat hackers follow ethical guidelines, while black hat hackers engage in illegal activities

White hat hackers are employed by the government, while black hat hackers operate independently

White hat hackers only target individuals, while black hat hackers target organizations

White hat hackers use social engineering techniques, while black hat hackers use technical exploits

Which of the following is an example of a white hat hacker activity?

Performing a security audit for a company

Spreading malware to disrupt a network

Launching a DDoS attack on a website

Stealing personal information for financial gain

What is the primary motivation behind grey hat hacking?

Curiosity and a desire to expose vulnerabilities

What differentiates a grey hat hacker from a black hat hacker?

Grey hat hackers do not have malicious intent

Black hat hackers often get legal authorization

Black hat hackers operate within the boundaries of the law

Grey hat hackers work for government agencies

Grey hat hackers are skilled in social engineering

What is the primary difference between a grey hat hacker and a white hat hacker?

Grey hat hackers may operate without legal authorization

White hat hackers engage in illegal activities

White hat hackers have malicious intent

Grey hat hackers work for government agencies

Grey hat hackers only operate within the boundaries of the law

What is the main goal of a black hat hacker?

To exploit vulnerabilities for personal gain

To educate and raise awareness about cyber threats

To defend computer systems from attacks

To use their skills for ethical hacking

What is a common tool used by black hat hackers to gain unauthorized access to remote computer systems?

Intrusion Detection System (IDS)

Unauthorized technology used within an organization

Officially sanctioned technology used within an organization

Legacy technology used within an organization

Open source technology used within an organization

What is the main risk associated with Shadow IT?

Data security and privacy breaches

What is the primary concern associated with Shadow IT?

Improved efficiency and productivity

Enhanced collaboration among teams

What is attack surface?

The sum of all points in a software system that are vulnerable to potential attacks

The number of successful attacks on a software system

The process of defending a software system against attacks

The number of security measures protecting a software system

What is the purpose of reducing attack surface?

To minimize potential vulnerabilities and entry points for attackers

To increase the number of successful attacks on a system

To implement more security measures in a software system

To enhance the process of defending against attacks

What is the term used to describe a threat actor who is part of an organized group and acts on behalf of a nation-state?

Advanced Persistent Threat (APT)

Security + Domain 1 Lesson 10

Security + Domain 1 Lesson 9 DNS and DDos Attacks

Advanced Cybersecurity - Security + Domain 1 Lesson 8 - Wireless and Layer 2 Attacks

Land warfare is a complex domain that involves the application of military power on the ground to achieve political and strategic objectives. Modern military doctrine, such as that used by the U.S. Army and the Indian Army, categorizes these elements into Combat Power and the Principles of War. 1. The 8 Elements of Combat Power Combat power is the total means of destructive, constructive, and information capabilities that a military unit can apply. It is typically broken down into eight key elements: ElementDescriptionLeadershipThe "multiplier" of all other elements. It provides purpose, direction, and motivation to soldiers.InformationEnables commanders to make informed decisions and creates opportunities to achieve results.Mission CommandThe system used to integrate the other elements. It focuses on decentralized execution based on the commander's intent.Movement & ManeuverThe movement of forces to gain a positional advantage over the enemy to deliver lethal or non-lethal effects.IntelligenceThe understanding of the enemy, terrain, weather, and civil considerations.FiresThe use of weapon systems (artillery, mortars, air support) to create specific lethal or non-lethal effects.SustainmentThe logistics required to maintain operations, including ammunition, fuel, food, and medical support.ProtectionThe preservation of the force so that the commander can apply maximum combat power.2. The Principles of War These are the enduring "rules of thumb" that guide how land forces are employed strategically and tactically: Objective: Direct every operation toward a clearly defined and attainable goal. Offensive: Seize, retain, and exploit the initiative. You cannot win by defending alone. Mass: Concentrate the effects of combat power at the most advantageous place and time. Economy of Force: Allocate the minimum essential combat power to secondary efforts so you can "mass" elsewhere. Maneuver: Place the enemy in a position of disadvantage through flexible movement. Unity of Command: Ensure all forces operate under a single responsible commander toward a common objective. Security: Prevent the enemy from gaining an unexpected advantage. Surprise: Strike the enemy at a time, place, or in a manner for which they are unprepared. Simplicity: Prepare clear, uncomplicated plans to minimize confusion in the "fog of war." 3. The Modern Legal Framework Land warfare is also governed by the Law of Land Warfare (International Humanitarian Law), which rests on four pillars: Military Necessity: Actions must be necessary to achieve a legitimate military goal. Distinction: Forces must distinguish between combatants and non-combatants (civilians). Proportionality: The anticipated harm to civilians must not be excessive in relation to the concrete military advantage gained. Unnecessary Suffering: Weapons and methods must not cause gratuitous or superfluous injury. Note: Contemporary land warfare is increasingly "Multi-Domain," meaning land forces must now integrate with cyber, space, and electronic warfare to be effective. , While land warfare uses many tools, the two primary "philosophies" of how to win a war are Attrition and Maneuver. Most modern conflicts are a spectrum of both, but understanding the pure form of each helps explain military strategy. 1. Attrition Warfare: The "Sledgehammer" Attrition warfare is a strategy where one side attempts to win by wearing down the enemy to the point of collapse through continuous losses in personnel, equipment, and supplies. Core Logic: "I have more than you." It assumes that if you can destroy the enemy’s resources faster than they can replace them, you will eventually win. Focus: Firepower and mass. Success is measured by "body counts," equipment destroyed, and the steady seizing of terrain. Command Style: Usually centralized and methodical. It requires strict synchronization of massive resources (artillery, logistics, manpower). Historical Example: The Battle of Verdun (WWI). German Chief of Staff Erich von Falkenhayn famously stated his goal was to "bleed France white" by forcing them to defend a position they could not afford to lose, regardless of the cost in lives. 2. Maneuver Warfare: The "Scalpel" Maneuver warfare seeks to shatter the enemy’s moral and physical cohesion—their ability to act as a unified force—rather than simply destroying every soldier. Core Logic: "I am faster and more unpredictable than you." It aims to create a state of chaos where the enemy's leadership can no longer make effective decisions. Focus: Speed, surprise, and dislocation (forcing the enemy to be in the wrong place at the wrong time). The OODA Loop: Developed by Col. John Boyd, this is the heart of maneuver theory. It stands for Observe, Orient, Decide, Act. The goal is to cycle through these steps faster than the enemy, essentially "getting inside" their decision-making process until they collapse from confusion. Historical Example: The 1940 Invasion of France (Blitzkrieg). Instead of fighting a line-by-line battle of attrition, German forces used speed and concentrated armor to bypass strongpoints, cut communication lines, and cause a total systemic collapse of the French military in weeks. 3. Key Differences at a Glance FeatureAttrition WarfareManeuver WarfareObjectivePhysical destruction of the enemy army.Functional/Psychological collapse of the enemy.TargetThe enemy's strength (mass).The enemy's weakness (vulnerability).Primary ToolMassed Firepower.Movement and Tempo.Command"Command Push" (Top-down, rigid)."Recon Pull" (Decentralized, flexible).Success MetricExchange ratios (Kill counts).Disruption and loss of enemy control.4. The Modern Synthesis: "Schwerpunkt" In practice, no army is purely "maneuver" or "attrition." To maneuver successfully, you often need a period of attrition to punch a hole in the enemy's line. A critical concept here is the Schwerpunkt (Center of Gravity/Focus of Effort). A commander identifies the single most important place to strike and concentrates all available "elements of power" there. While the rest of the front might look like attrition, the Schwerpunkt is where the maneuver happens to achieve a breakthrough. Modern Reality: In high-intensity conflicts today (like the war in Ukraine), we see a "return to attrition" because modern sensors (drones, satellites) make it very difficult to achieve the surprise needed for pure maneuver warfare. When you can see everything, it's hard to be "unexpected."

Reading Passage: The Anatomy of a Kill Chain In the lexicon of modern warfare, the term "kill chain" describes the end-to-end process of a military attack, from the initial identification of a target to its eventual destruction and the subsequent evaluation of the strike's effectiveness. Conceptually, the kill chain is a structural model used to understand and optimize the speed and precision of military operations. The fundamental principle of this model is that an attack functions as a sequence of interdependent stages; if any single link in the chain is broken, the entire operation fails. For strategic planners, this creates a dual objective: to accelerate one's own kill chain while simultaneously finding ways to disrupt the adversary's. Strategic Concept: The Kinetic Model (F2T2EA) The traditional military kill chain is often summarized by the acronym F2T2EA, representing a continuous cycle of find, fix, track, target, engage, and assess. The kinetic kill chain begins with Find, the reconnaissance phase where intelligence assets identify a potential target within a theater of operations. Once found, the process moves to Fix, which involves pinning down the target's specific location and ensuring it can be distinguished from friendly forces or non-combatants. Track follows, maintaining a persistent watch on the target's movements to prevent its escape. In the Target phase, commanders select the appropriate weapon system and verify the legality and strategic value of the strike. Engage is the kinetic moment—the actual deployment of ordnance against the objective. Finally, Assess involves battle damage assessment (BDA) to determine if the desired effects were achieved or if further engagement is required. This model emphasizes "compressing the sensor-to-shooter timeline," meaning the faster a military can move through these steps, the more lethal it becomes. The Evolution: The Cyber Kill Chain® As warfare expanded into the digital domain, Lockheed Martin adapted the kinetic model into the Cyber Kill Chain. This framework assists defenders in identifying and stopping Advanced Persistent Threats (APTs). Unlike a physical missile, a cyberattack often unfolds over weeks or months, but the sequential logic remains the same. The model consists of seven distinct stages: Stage Description of Attacker Activity 1. Reconnaissance The harvesting of information. Attackers research targets via social media, public records, and technical scanning to find vulnerabilities. 2. Weaponization Coupling a remote access trojan with an exploit into a deliverable payload (e.g., a malicious PDF or Microsoft Office document). 3. Delivery Transmission of the weapon to the target environment. Common vectors include email attachments, malicious websites, or USB drives. 4. Exploitation The weapon triggers. The code executes on the victim's system, typically by taking advantage of a software or operating system vulnerability. 5. Installation The attacker installs a persistent backdoor or malware on the victim's system, allowing them to maintain access even after a reboot. 6. Command & Control (C2) The compromised system opens a communication channel back to the attacker's server, allowing the intruder to give manual instructions. 7. Actions on Objective The final stage where the attacker achieves their goal, such as data exfiltration, encryption for ransom, or destruction of critical infrastructure. Strategic Implications for Defense The strategic value of the Cyber Kill Chain lies in its ability to provide a roadmap for "proactive defense." By understanding the sequence, security professionals can implement controls at every stage. For instance, robust email filtering can break the chain at the Delivery stage, while endpoint detection can stop the Installation phase. Crucially, the earlier a defender breaks the chain, the lower the cost of mitigation and the lower the risk of damage. If an attacker is stopped during Reconnaissance, they have gained nothing. If they are stopped during Actions on Objective, the damage may already be catastrophic. In both kinetic and cyber environments, the goal is the same: to create a "defensive depth" that makes the cost of a successful attack prohibitively high for the adversary.

How is personal data collected? There are several ways that an unauthorised person can try and collect your data. These include: •phishing •smishing •vishing •pharming. Phishing Phishing is when a person sends a legitimate looking email to a user. The email contains a link to a website that also looks legitimate. The user is encouraged to click the link and to input personal data into a form on the website. The email could also simply ask the user to reply to the email with their personal data. The user is tricked into giving their personal data to a source that they believe is legitimate. However, both the email and the linked website are from a fake unauthorised source. The personal data that is input is then collected by an unauthorised person. This person can then use this data for criminal acts, for example, to commit fraud or steal the person's identity. Intimidation has become a common feature of phishing emails, threatening the user that they must click the link and rectify a situation immediately, or there will be a further issue. The aim of a phishing attack is to steal the user's personal data. Figure 5.1: Phishing. A real-life example of phishing PayPal have been the subject of several different phishing emails. Users receive an email that looks as though it has been sent from PayPal, as it has the PayPal branding. The email normally warns of an issue such as unexpected activity on their account, or that some kind of verification of their account is required. The user is then asked to click a link to log into their account and resolve the issue. The link takes them to a webpage that looks like the PayPal login page. If the user inputs their login details into this page, they will not be taken to their account. It is often at this stage that the user may realise that the email and webpage are fake. However, they have already given the unauthorised person their PayPal login details. Figure 5.2: An example of a phishing email claiming to be from PayPal. How to recognise phishing There are several guidelines to be aware of regarding emails to avoid being subjected to phishing. These include: •Don't even open an email that is not from a sender that you recognise or a trusted source. •Legitimate companies will never ask you for your personal data using email. Be immediately suspicious of any email that requests your personal data. •Legitimate companies will normally address you by your name. Be suspicious of any email that addresses you as ‘Dear Member' or ‘Dear Customer'. •Legitimate companies will send an email that uses their domain name. If you hover your mouse over the sender's name, it will show the email address that the email is sent from. If this does not look legitimate, for example, does not contain the correct domain name, then it is probably fake. For example, if the sender's email is user@paypal1.com rather than user@paypal.com, this is from an incorrect domain name. •Legitimate companies are protective of their professional reputation and thoroughly check any communications. They will make sure that all information given is grammatically and correctly spelt. Be suspicious of any email that contains bad grammar or spelling mistakes. •A link in an email from a legitimate company will also normally contain the domain name of the company. You can sometimes hover over the link, or right click and inspect the link, to see the address of the URL that is attached. If the URL does not contain the domain name, or also contains typical errors such as spelling mistakes, then be suspicious of this. PRACTICAL ACTIVITY 5.02 Ask a friend or a member of your family if they have ever received an email that they believed was a phishing email. Ask them how they identified it was phishing. Ask them if they know all of the given guidelines for identifying phishing emails. Smishing Smishing (or SMS phishing) is a variant of phishing that uses SMS text messages to lure the user into providing their personal details. The user is sent an SMS text message that either contains a link to a website, in the same way that phishing does, or it will ask the user to call a telephone number to resolve an urgent issue. The same advice can be followed for smishing as given for phishing. The user must question at all times any links that are sent from an unknown or suspicious user. It is advisable that if a user believes the message may be legitimate, to type in the domain name for the legitimate company website into their web browser, rather than following the link in the message. Users should block any numbers that they believe are suspicious to prevent any further risk of smishing from that number. Figure 5.3: Smishing. Vishing Vishing (or voice phishing) has the same aim as phishing, to obtain a user's personal details. The user receives a telephone call that could either be an automated system or could be a real person. An automated voice could speak to the user and advise them that an issue has occurred, such as there has been suspicious activity regarding their bank account. The user may then be asked to call another number, or just to simply press a digit and be directed to another automated system. This system will ask them to provide their bank account details to resolve the issue. The bank account details have then been obtained by the unauthorised user and can be used to commit a crime against the user. The automated system could be replaced by a real person who will try to do the same thing. They will try to convince the user that there has been an issue with an account they have and to provide the log-in details or PIN for the account to verify who they are so the issue can be resolved. The precaution to take for vishing is that no company will ever call you and ask you to provide any log-in details or PIN details over the telephone. They may ask you to provide other personal information, and if you are in doubt that the person on the other end of the phone is legitimate, it is always advisable to put the phone down and call the company back on a legitimate number that you may already know or can obtain. Figure 5.4: Vishing. Pharming Pharming is when an unauthorised user installs malicious code on a person's hard drive or server. The malicious code is designed to redirect a user to a fake website when they type in the address of a legitimate one. The fake website is designed to look like the legitimate one, to trick the user and make sure they are not aware that their request has been redirected. The user will then enter their personal details into the fake website, believing it is the legitimate one, and the unauthorised person will now have their personal data. A common technique used in pharming is called domain name server (DNS) cache poisoning. This technique exploits vulnerabilities in the DNS and diverts the internet traffic intended for a legitimate server toward a fake one instead. The unauthorised user needs to find a way to install the malicious code on the computer. They often hide the malicious code in an email attachment or link. When the user opens the email attachment or clicks the link, the malicious code is downloaded also. Figure 5.5: Pharming. The aim of a pharming attack is also to steal a user's personal data. A real-life example of pharming In 2007 50 different companies all over the world were subject to a pharming attack, these included PayPal, eBay, Barclays bank and American Express. Over a three-day period, hackers managed to infect over 1000 PCs a day with a malicious pharming code. When users who had been infected visited the websites of the different companies, they were redirected to a legitimate-looking version of the site that was designed to steal their personal data. The original email, containing the malicious code, was set up to look like a shocking news story. Users were encouraged to click a link in the email to find out more information. The code was downloaded when the user clicked the link. This was quite a sophisticated attack that required legitimate looking websites to be set up for a large number of companies. It is not known how much money the hackers were able to retrieve as a result. How to prevent pharming All of the guidelines to avoid being subjected to phishing are also relevant for recognising pharming. There are also several other precautions that can be taken to check for pharming attacks. These include: •Have a firewall installed and operational. A firewall monitors incoming and outgoing traffic from your computer. It checks this traffic against set criteria and will flag and stop any traffic that does not meet the criteria. A firewall could detect and block suspicious traffic, such as a malicious code trying to enter your system. •Have an anti-virus program installed that is designed to detect malicious pharming code. You need to scan your computer on a regular basis to check for any malicious code. It is advisable to set up an automatic scan on a daily basis at a time when your computer will normally be switched on. •Be aware when using public Wi-Fi connections. A hacker could look to directly access your computer and install the malicious code if you are connected to a public Wi-Fi connection. It is often advisable to use a VPN when using public Wi-Fi. This will help shield your internet activity and personal details from a hacker, making it more difficult for them to access your computer. Smishing can also be used as a form of pharming. A user is sent a link, that when they click is designed to download malware onto their mobile device. Therefore, it is advisable to have security software installed on your mobile and also scan it regularly to detect any presence of malware.

Act as a Microsoft Certified Azure trainer and create 25 AZ-900 scenario-based questions from basic to intermediate level. Cover domains: - Cloud Concepts - Core Azure Services - Azure Architecture & Components - Identity, Governance & Security - Azure Management & Cost Management Requirements: - Use real-world scenarios from healthcare, banking, e-commerce, startups, education, and manufacturing - Mix multiple-choice and case-based questions - Include 4 options - Mention correct answer - Provide detailed explanation - Difficulty progression: Beginner → Intermediate

security

Related quizzes

Related quizzes