How can you move from the Protection platform into the Response platform (within the Protection console).
What is Reports --> Events --> Visibility + Carbon Black --> Process Name Column --> Click on CB Icon
100
Define what the following icons stand for:
* SHIELD *
* HEARTBEAT *
What is Shield: Cb Defense applied a policy and blocked the execution; Heartbeat: Indicates that something ran.
100
BIOS
What is Basic Input Output System
100
Name the attack that is created with malicious intent that will attempt to steal data or destroy the computer
What is Malware.
100
What is Port 443?
What is SECURE HTTP access - default port.
200
This customer utilizes Big Fix, during the demo what is one of the big selling points?
What is auto patching of outdated applications.
< Response - Adobe >
200
What are the two methods of deployment?
(Attempt to identify the clicks necessary to navigate through UI)
What is
Manual Deployment (EMAIL): Enrollment --> Add User(s) --> List email addresses --> Download via email attachment
Automated Deployment (UPDATER): Enrollment --> Company Code --> Manage Sensor --> Install via Updater or MSI
200
HIPS
What is Host Intrusion Protection System
200
Name the attack that attempts to disrupt connection to a network through overloading the network with high volumes of data.
What is a DoS attack (Denial of Service).
200
Define port 80.
What is non-secure HTTP connection.
300
Define the difference between a trusted path, and a trusted directory... Be specific.
What is Trusted Path is defined off of a name so that the hash value can change over time; Trusted Directory is defined by a hash value.
300
If a customer asks to log "the most" amount of information possible to SIEM how would they be able to do so with CbD?
What is lower notification "threat priority score" to 1, check both Threat and Monitored, and log to connector "Splunk".
300
RAID
What is a redundant array of independent disks
300
Name the type of attack that was used in the movie Office Space.
What is salami attack.
300
Define port 23.
What is telnet connection.
400
Name the oldest version of Windows that we support and the service pack version.
What is XP Service Pack 3 ; 2003 Service Pack 0.
400
If customer wanted to identify exact clicks that an admin is taking with in the console - would they be able to get this information? If so how?
What is the audit log tab with "Verbose" turned ON.
400
Define SCADA.
What is Supervisory Control and Data Acquisition.
400
Define a Man-in-the-Middle Attack.
What is MITM gains access through a non-encrypted wireless access point. They then have access to all of the information being transferred between both parties
400
What is googles desktop search port?
What is port 4664.
500
What are the three values that can be returned from the detonation of a file to Cb Inspection?
What is malicious, suspicious, no signs of malware.
500
Define how CbD could accommodate a developer environment.
What is create a new policy group, define an UPLOAD RULE: path/directory/application and select NO UPLOAD.
500
Define and describe NIST.
What is National Institute of Standards in Technology which definitions involving threats and threat sources.
500
Name the attack that is an old DOS Trojan that when runs deletes files, renames folders, and creates many empty folders.
What is Acid Rain.
500
Define port 1701.
What is a tunneling and encryption standard used to connect two private businesses together via VPN.