AP®︎ Cybersecurity: Topic 5.6 Flashcards

Evidence consistent with malicious activity; it may show an attempt without proving that the attack succeeded

A control that reveals an attempted or completed attack rather than necessarily preventing it

The process of recording and monitoring user activities, including who accessed data, when, and what operation was attempted or completed

Reviewing recorded events for suspicious operations or deviations from normal time, location, device, file, or application access patterns

A monitored file containing fake valuable-looking data; attempted access triggers a high-confidence alert because no legitimate user should access it

A repeatable function that converts data into a hash or digest; the same input and algorithm produce the same output

Record a file’s hash as a baseline, hash the same file later with the same algorithm, and compare the full digests; a difference means the file was altered

Get-FileHash testfile -Algorithm SHA256

Sha256sum testfile

Shasum -a 256 testfile

Monitoring of users’ data access, use, copying, and transmission across an organization to detect suspicious activity, with strong coverage at a higher cost

Choose controls according to cost, data or application sensitivity and criticality, and data classification or regulatory requirements

Sensitivity concerns the nature, value, or potential harm of information; criticality concerns how essential data or an application is to operations

The category and handling requirements formally assigned to data, such as private, educational, healthcare, or financial, which may require specific monitoring

Real-time detection alerts while activity is occurring and enables prompt response; retrospective detection discovers an attack or change after it occurred

A real attack that a detection method fails to identify, such as unchanged data being stolen or an adversary avoiding a honeypot

SQL syntax in logged user input, especially quotes, OR 1=1, the comment marker --, or capitalized control words such as WHERE, IN, and FROM.

Suspicious HTML or JavaScript in logged user input, particularly <script>...</script> tags

Unusually long URL, cookie, query string, or total request lengths in a web request

Sequences of ../ in an HTTP GET path, especially repeated sequences leading to files outside the intended web directory

Report the timestamp, source, affected account, field, application, or resource; exact indicator; likely attack type; and whether the evidence shows success, failure, or an undetermined outcome

Using software to compare log events with rules or normal patterns and quickly alert defenders to suspicious activity