🔒 Cybersecurity Study Guide — 23 Question Type Variants

IAAA = Identity, Authentication, Authorization, Auditing/Accounting. CIA is the Confidentiality-Integrity-Availability triad. AAA is a subset (Authentication, Authorization, Accounting). DAC is Discretionary Access Control.

The order matters: you must first claim who you are, prove it, receive permissions, then have actions logged.

This is a real-world walkthrough of the entire IAAA pipeline.

Integrity belongs to the CIA triad, not IAAA. The four As in IAAA are Identity, Authentication, Authorization, and Auditing/Accounting.

You cannot authenticate without first identifying; you cannot authorize without first authenticating; and auditing records the results of all prior steps.

A fingerprint is a Type 3 authentication factor (something you are), not an identity claim. Identities are public claims like usernames, email addresses, and employee IDs.

Entering her email address is claiming her identity. Authentication comes next when she provides her password/MFA token.

A password is an authentication factor (Type 1 — something you know). Identity is the public claim (username, email). Passwords are secret and used to prove that identity, not state it.

Smart Cards are "something you have" (authentication). PIN Codes are "something you know" (authentication). The remaining three are public identity claims.

Retinal scans and all biometrics are Type 3 factors because they rely on your unique physical characteristics.

A smart card is a physical token the user possesses.

An OTP is Type 2 (something you have) because it depends on possession of the device receiving the code, not on memorized knowledge. The code itself is ephemeral and device-bound.

Type 4 authentication uses geolocation technology (GPS, IP geolocation) to verify a user's physical location as a factor. Per Lecture 5.3, this is the fourth valid authentication type.

Lecture 5.3 defines four types: Type 1 (Something you know), Type 2 (Something you have), Type 3 (Something you are), and Type 4 (Somewhere you are — Geolocation Technology).

Only option C combines two different factor types: Type 1 (password — know) + Type 3 (fingerprint — are). All other options combine two Type 1 factors.

A PIN is Type 1 (something you know) and a chip card is Type 2 (something you have). Two different factor types = MFA.

Both a password and a security question are Type 1 (something you know). MFA requires at LEAST two different types.

(a) Type 1 + Type 2 ✓ | (b) Type 3 + Type 3 ✗ (same type) | (c) Type 2 + Type 3 ✓ | (d) Type 1 + Type 1 ✗ | (e) Type 1 + Type 2 + Type 3 ✓ (three-factor)

RBAC assigns permissions to roles. Moving a user to a different role automatically updates their permissions without individually editing access rights.

In RBAC, permissions are assigned to roles, not individual users. Users are then assigned to roles, inheriting the permissions associated with that role.

Rule-based applies global conditions (time-of-day, IP range, etc.) uniformly. RBAC is specifically about job roles/functions. This is a common distractor pairing on exams.

In MAC, access decisions are made by the system based on security labels (e.g., Top Secret, Secret, Confidential) — not by the individual data owner. In DAC, the owner of the resource decides who gets access.

Per Lecture 5.4: An ACL lists all subjects that can access a given object. A Capability List lists all objects a given subject can access. Both are derived from the Access Control Matrix to solve the sparse table problem.

DAC allows the data owner to control access. This is flexible but less secure than MAC because users may grant access carelessly. Most consumer operating systems (Windows, macOS) use DAC by default.

As user and resource counts grow, the matrix becomes enormous with most cells empty (no access), making it wasteful and hard to manage.

It is among the LEAST efficient for large-scale environments due to the sparse table problem. ACLs or RBAC are preferred.

A Capability List is created by dividing the Access Control Matrix row-wise (by subject). It records what each subject can access. An ACL is column-wise (by object) — it records who can access each object.

Reviewing logs after the fact to establish who did what and when is the core function of auditing.

Auditing depends on comprehensive logs that record who accessed what, when, and from where.

Auditing is a continuous process. Logs are generated in real-time during normal operations and are reviewed both routinely (for compliance) and reactively (after incidents).

/16 = 16 host bits → 2^16 = 65,536 total − 2 (network + broadcast) = 65,534 usable.

192.168.1.255 is the broadcast address for the 192.168.1.0/24 subnet and cannot be assigned to any host.

Where 32 is the total bits in an IPv4 address, n is the prefix length, and you subtract 2 for the network and broadcast addresses.

Port 22 is SSH (Secure Shell), which is encrypted. Telnet runs on port 23 and is unencrypted.

LDAP (Lightweight Directory Access Protocol) on port 389 is used for directory services like Active Directory. SNMP (161) monitors network devices, POP3 (110) retrieves email, and NTP (123) synchronizes clocks.

Port 161 is used for SNMP queries (polling devices), and port 162 is used for SNMP Traps (devices sending alerts to a management station).

Nmap is a port/network scanner. Wireshark is a packet analyzer. Netcat is a networking utility. Nessus is specifically designed for vulnerability assessment.

Modern vulnerability scanners (especially web application scanners like OWASP ZAP, Burp Suite, Nessus WAS) can detect web app flaws including XSS, SQL Injection, and path traversal.

Even with good intentions, scanning networks or systems without explicit, documented authorization violates computer fraud and abuse laws (e.g., the CFAA in the US). Always obtain written permission before testing.

Without documented permission defining scope, timing, and methods, any scanning or testing is unauthorized and potentially illegal. (NDAs are also important but authorization comes first.)

You have the legal right to scan and test systems you own. However, best practice is to still document the scope and ensure you don't accidentally scan systems outside your ownership (e.g., ISP or cloud infrastructure not covered by your agreement).

-sn = "ping scan" or "no port scan." It only determines which hosts on the network are alive, without checking for open ports.

This is the fastest way to enumerate live hosts without scanning ports.

A Ping Scan only identifies if a host is alive. To determine running services, you need a port scan (e.g., TCP SYN scan) and optionally a service/version detection scan (-sV).

The ACK scan doesn’t determine if ports are open/closed. Instead, it determines whether ports are filtered (blocked by a firewall) or unfiltered (reachable). It is primarily used for firewall rule mapping.

The XMAS scan sets FIN, URG, and PSH flags. If a port is closed, the target responds with RST. If open, there is no response. It can evade some simple firewalls and IDS that only look for SYN packets.

Because UDP is connectionless, an open port may simply accept the packet silently without responding. The scanner cannot distinguish between "open" and "filtered" without waiting for a timeout, which dramatically slows the scan.

No response could mean the port is open (accepting traffic silently) OR filtered (a firewall dropped the packet). Only an ICMP "port unreachable" response definitively indicates a closed port.

Automated scanners excel at detecting technical vulnerabilities (injection, XSS, traversal) by sending test payloads. Business logic flaws (like allowing a user to apply a discount code twice) require understanding of intended application behavior and typically need manual testing.

Modern vulnerability scanners are equipped to test for both by injecting test payloads and analyzing responses.

Integrity ensures data is only modified by authorized parties. Hashing algorithms (SHA-256, MD5) are commonly used to verify integrity.

The data still exists and hasn't been stolen or modified, but it cannot be accessed when needed. UPS systems, redundancy, and failover clusters mitigate availability risks.

Encryption primarily ensures Confidentiality (only authorized parties can read it). While some encryption modes (like AES-GCM) provide integrity checks, standard encryption alone does not guarantee integrity. A separate hash or MAC is needed to verify data hasn't been modified.

NIST publishes the CSF as well as SP 800-series publications covering topics from risk management to cryptographic standards.

The IETF (Internet Engineering Task Force) manages TCP/IP and internet protocol standards through RFCs. IEEE focuses on hardware, networking standards (802.3 Ethernet, 802.11 Wi-Fi), and electrical engineering.

S/MIME (Secure/Multipurpose Internet Mail Extensions) is an IETF standard for securing email with encryption and digital signatures. PKCS (Public Key Cryptography Standards) was developed by RSA Laboratories for general cryptographic operations. PGP is an alternative email encryption method. TLS secures transport-layer connections, not specifically email content.

PKCS was developed by RSA Laboratories (not IEEE) to standardize public-key cryptographic operations such as key exchange, digital signatures, and certificate requests. IEEE develops networking standards like 802.11 (Wi-Fi).

Trojans masquerade as useful programs. Worms self-replicate automatically. Viruses attach to files and require user action to spread.

Social engineering manipulates humans into divulging sensitive information by exploiting trust and authority.

Worms self-replicate and spread automatically without user interaction, often exploiting network vulnerabilities. Viruses and Trojans typically require user action.

The Morris Worm (1988) was one of the first internet worms. Code Red exploited a buffer overflow in IIS. SQL Slammer exploited default blank admin passwords and propagated at record speed. Michelangelo was a date-triggered boot-sector virus.

SQL Slammer was a worm because it self-replicated without user interaction, exploiting a known vulnerability (blank SA passwords) in Microsoft SQL Server.

Hacktivists are politically or ideologically motivated, using hacking to promote their cause or protest organizations they oppose.

Cyber Terrorism is motivated by a desire to cause fear, panic, or damage based on political, religious, or ideological objectives—not financial gain. Financial motivation characterizes Cyber Criminals.

Whois queries domain registration databases to reveal ownership, registrar, creation/expiration dates, and often contact information.

Traceroute shows each hop (router) along the path to the destination and the latency at each hop, helping you identify where delays occur.

All five tools gather information about targets—live hosts, DNS records, domain ownership, network paths, and open ports.

PTR (Pointer) records map IP addresses back to domain names. A records do the opposite (domain → IP). CNAME is an alias. MX is for mail servers.

Simply passing an IP address to nslookup triggers a reverse DNS lookup, querying PTR records to return the associated hostname.

An A Record maps a domain name to an IPv4 address (forward lookup). A PTR Record maps an IP address back to a domain name (reverse lookup).

MX (Mail Exchange) records specify which server(s) should receive email for a given domain. NS records identify the authoritative DNS server, not the mail server.

An A record maps domain → IPv4. An AAAA record maps domain → IPv6. The "AAAA" name reflects that IPv6 addresses are four times as long as IPv4.

Named A through M. While there are hundreds of physical servers worldwide, they share only 13 IP addresses via Anycast routing.

The 13 root servers are managed by 12 different organizations including Verisign, ICANN, NASA, US Army, and various universities and research institutions.

Stagers are intentionally tiny so they fit within exploit buffer constraints. Their sole purpose is to open a connection, then download the larger Stage payload.

That describes a Stager, not a Stage. Stages are the larger payloads that get downloaded after the stager has already established a connection. Stages don't have the same size constraints because they're sent over the established channel.

Meterpreter is designed to reside entirely in memory through DLL injection, never touching the disk, which is a key reason it evades many traditional antivirus solutions.

Meterpreter resides entirely in memory using DLL injection. This "fileless" approach helps it avoid detection by file-based antivirus scanners.

These are all Meterpreter-specific commands. A basic shell would not have these capabilities without additional tools.

The KDC is the central trusted authority that contains both the AS and TGS. A Certificate Authority (CA) is part of PKI, not Kerberos.

Kerberos provides Single Sign-On (SSO). After the initial authentication, the user receives a TGT that can be presented to the TGS to obtain service tickets for different resources without re-entering credentials.

In a ring topology, each node connects to exactly two others forming a circle. Data passes sequentially. A break at any point disrupts the loop (unless a dual-ring/FDDI configuration is used).

In a bus topology, all devices share a single cable (backbone). CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is used to manage collisions when multiple devices transmit simultaneously.

Virus attacks and prolonged outages are medium-level. High-level is reserved for events causing physical destruction or posing existential threats (natural disasters, terrorism, fires).

A single server failure is a Low-level disaster. High-level disasters involve widespread physical destruction or threats such as earthquakes, fires, or terrorism.

The Transport Layer handles end-to-end communication. TCP provides reliable, connection-oriented delivery. UDP provides fast, connectionless delivery.

Similarly, OSI layers 1 (Physical) and 2 (Data Link) combine into the TCP/IP Network Access layer.

ICMP operates at the Internet (Network) layer alongside IP. It is used for error reporting and network diagnostics (ping, traceroute), not for transporting application data.

DNS is an Application layer protocol. While it does use UDP (port 53) for standard queries and TCP (port 53) for zone transfers, DNS itself operates at the Application layer. TCP and UDP are the Transport layer protocols it relies on.