Final Exam: Security Threat Intelligence

WHAT YOU WILL LEARN

• 

  Use the for, while, and until loops in a bash script
  

  use the for and while loops in a python script
  

  recognize the importance of identifying and preserving forensic artifacts and list common errors when dealing with digital evidence
  

  describe common security vulnerabilities in code that can lead to exploits
  

  identify the phases of the cyber operations cycle
  

  identify the roles and responsibilities of oco team members and how they interact within the cyber operations cycle
  

  identify bash scripts based on their features
  

  describe the common features and properties of command line environments
  

  create, modify, and delete user accounts in a linux system
  

  set variables in a bash script
  

  describe the command processing capabilities and environment of the bash shell
  

  connect to a remote server securely using ssh
  

  create custom functions in a python script
  

  compare and use conditionals in c and c++
  

  use loops in c and c++
  

  implement the for and while loops in a python script
  

  identify different types of malware attacks
  

  use and set variables in a bash script
  

  use the for, while, and until loops in a bash script
  

  identify different types of powershell cmdlets and objects
  

  change file and folder permissions from a bash script
  

  create loops in powershell
  

  describe how siems are used to detect threat activity
  

  describe symptoms of an infected system
  

  identify key steps when responding to malware incidents
  

  recognize different tools used for network scanning
  

  discuss common techniques to secure the file system
  

  demonstrate the use of packet capturing to gain intelligence from an attack
  

  demonstrate techniques to harden windows dns servers
  

  install elk stack in preparation for it to serve as a siem for suricata
• 

  perform dns host discovery
  

  describe the open systems interconnection (osi) model for network communications
  

  recognize the use of various baselines for network management
  

  inspect the static properties of malware
  

  navigate elk stack's kibana dashboards for siem use when connected to suricata
  

  outline how to gather digital evidence, including identification, collection, acquisition, and preservation
  

  differentiation between attribution types such as machine, human, adversary
  

  recognize why intrusion detection is the heart of threat intelligence and outline the kill chain and diamond models of analysis
  

  describe malware cyber threats and how reverse engineering malware can lead to attribution
  

  define what is involved in risk analysis and risk modeling as they relate to threat intelligence and outline the fair risk model and framework
  

  describe when and how to use threat intelligence, including before, during, and after an attack
  

  describe how machine learning can improve threat intelligence
  

  provide an overview of malware cyber threats and how reverse engineering malware can lead to attribution
  

  describe and compare the different types of dco missions
  

  discuss common bios/uefi settings that are used to help secure the system
  

  demonstrate how to create a password policy on a windows workstation to prevent dictionary attacks
  

  recognize common malware characteristics at the windows api level (registry manipulation, keylogging, http communications, droppers)
  

  describe how to gather digital evidence, including identification, collection, acquisition, and preservation
  

  capture and examine http traffic using wireshark
  

  demonstrate how to implement an account lockout policy to stop brute force attacks
  

  recognize best practices for removing malware
  

  describe the function and characteristics of the netflow and ipfix network flow protocols
  

  perform requests with netcat and other tools to pull banner information from services
  

  demonstrate how to implement full disk encryption with bitlocker
  

  describe the operations of dco in terms of missions, actions, and forces
  

  perform arp scans to find hidden hosts on a network
  

  outline the open systems interconnection (osi) model for network communications
  

  apply dns filters and examine dns queries in wireshark
  

  identify network endpoints from captured network traffic using wireshark
  

  recognize the importance of audit logs for security