1. Interviewer: Tell me what is a BootKit?
-A Boot Kit is where Malware injects code into the MBR
2. Interviewer: What is the difference between a Disk Level Encryption and a Block Level Encryption?
–
3. Interviewer: What is a White List in Malware?
4. Interviewer: What is PII (Personable Identifiable Information) and how that relates to PCI?
5. Tell me how you would run a new project to start a Whitelist of new Malware computer infestation. Describe what you would do from Start to Finish.
–
6. When would you use Block Level Encryption as opposed to Full Disk Encryption? Tell me on a hard drive.
7. Can you tell me what corporate departments you may use Full Disk Encryption?
Good to K now:
Bit 9 = malware and advanced threats:locks advanced:
-White List
-Immediate visibility, detection and protection
-Time based detection and forensics
-Lowest admin effort and user impact
-Proven reliability and scalability
Bit 9 blocks advanced Malware:
-Continous monitors every file that tries to execute
-Monitor all this through a web interface
Symantec Endpoint Encryption:
-encrypts storage devices, desktops, and laptops
Tripwire:
-File Integrity Monitor – Monitors File Changes
HP Security Tools:
ArcSight Logger – Collects machine data logs and unifys that data for searching, analyzing, etc. (SIEM=Security Information and Event Management)
Fortify
Tipping Point
Steganography – Embedding a file within a file
Harddrive Encryption – encrypts data stored on a hard drive using sophisticated mathematical functions
-data cannot be read by anyone who does not have access to the appropriate key or password
8. What is a Phishing attack?
A “phishing attack” typically is an e-mail masquerading as a message from a trusted sourceis an e-mail masquerading as a message from a trusted source
9. What’s an example of two factor authentication?
password
finger print
10. What’s an example of three factor authentication?
password
finger print
RSA Token
11. What’s the difference between NTFS and Share permissions?
-It depends on how the file is accessed and it. Logging on locally and accessing the file through the local filesystem in this case the share permissions won’t matter. However if you’re accessing the files (not logged on locally) through a share, then the share permissions apply first, then the NTFS permissions apply, so it’s cumulative.
12. What are GPO Permissions?
–
13. SQL injection explain this concept
14. Give an example of something you discovered and what did you do to handle it
15. Name a Policy or detailed procedure you implemented and the result of it effectiveness
Rafomac Rafomac.com is a Personal Blog towards my knowledge in IT and related things
