Interpret the output report of a malware analysis tool such as AMP Threat Grid and Cuckoo Sandbox
Describe these terms as they are defined in the CVSS 3.0
Attack vector
Attack complexity
Privileges required
User interaction
Scope
Describe these terms as they are defined in the CVSS 3.0
Confidentiality
Integrity
Availability
Define these items as they pertain to the Microsoft Windows file system
FAT32
NTFS
Alternative data streams
MACE
EFI
Free space
Timestamps on a file system
Define these terms as they pertain to the Linux file system
EXT4
Journaling
MBR
Swap file system
MAC
Compare and contrast three types of evidence
Best evidence
Corroborative evidence
Indirect evidence
Compare and contrast two types of image
Altered disk image
Unaltered disk image
Describe the role of attribution in an investigation
Assets
Threat actor
Network Intrusion Analysis
Interpret basic regular expressions
Describe the fields in these protocol headers as they relate to intrusion analysis
Ethernet frame
IPv4
IPv6
TCP
UDP
ICMP
HTTP
Identify the elements from a NetFlow v5 record from a security event
Identify these key elements in an intrusion from a given PCAP file
Source address
Destination address
Source port
Destination port
Protocols
Payloads
Extract files from a TCP stream when given a PCAP file and Wireshark
Interpret common artifact elements from an event to identify an alert
IP address (source / destination)
Client and Server Port Identity
Process (file or registry)
System (API calls)
Hashes
URI / URL
Map the provided events to these source technologies
NetFlow
IDS / IPS
Firewall
Network application control
Proxy logs
Antivirus
Compare and contrast impact and no impact for these items
False Positive
False Negative
True Positive
True Negative
Interpret a provided intrusion event and host profile to calculate the impact flag generated by Firepower Management Center (FMC)
Incident Response
Describe the elements that should be included in an incident response plan as stated in NIST.SP800-61 r2
Map elements to these steps of analysis based on the NIST.SP800-61 r2
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident analysis (lessons learned)
Map the organization stakeholders against the NIST IR categories (C2M2, NIST.SP800-61 r2)
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident analysis (lessons learned)
Describe the goals of the given CSIRT
Internal CSIRT
National CSIRT
Coordination centers
Analysis centers
Vendor teams
Incident response providers (MSSP)
Identify these elements used for network profiling
Total throughput
Session duration
Ports used
Critical asset address space
Identify these elements used for server profiling
Listening ports
Logged in users/service accounts
Running processes
Running tasks
Applications
Map data types to these compliance frameworks
PCI
HIPPA (Health Insurance Portability and Accountability Act)
SOX
Identify data elements that must be protected with regards to a specific standard (PCI-DSS)
Data and Event Analysis
Describe the process of data normalization
Interpret common data values into a universal format
Describe 5-tuple correlation
Describe the 5-tuple approach to isolate a compromised host in a grouped set of logs
Describe the retrospective analysis method to find a malicious file, provided file analysis report
Identify potentially compromised hosts within the network based on a threat analysis report containing malicious IP address or domains
Map DNS logs and HTTP logs together to find a threat actor
Map DNS, HTTP, and threat intelligence data together
Identify a correlation rule to distinguish the most significant alert from a given set of events from multiple data sources using the firepower management console
Compare and contrast deterministic and probabilistic analysis
Incident Handling
Classify intrusion events into these categories as defined by the Cyber Kill Chain Model
Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command and control
Action on objectives
Apply the NIST.SP800-61 r2 incident handling process to an event
Define these activities as they relate to incident handling
Identification
Scoping
Containment
Remediation
Lesson-based hardening
Reporting
Describe these concepts as they are documented in NIST SP800-86
Evidence collection order
Data integrity
Data preservation
Volatile data collection
Apply the VERIS schema categories to a given incident
* The course content above may change at any time without notice in order to better reflect the contents of examinations.
