You may want to have Internet connectivity for some exercises or to update software packages. If you are reasonably certain you know what you are doing, using a NAT network can be very helpful. To do so, you will need to go to the File ➢ Preferences menu of VirtualBox, click on Network, and then set up a NAT network by clicking the network card with a + icon, as shown in Figure E.3.
FIGURE E.3 Adding the a NAT network
Warning: Dangerous Traffic!
If you are not comfortable with your virtual machines having outbound network access, think you might do something dangerous with them, or just want to avoid any other potential issues, you should set up both virtual machines to use Internal Network instead.
5. Once your NAT network exists, you can set both machines to use it by clicking on them, and then clicking the Settings gear icon in the VirtualBox interface. From there, click Network, and set the network adapter to be attached to the NAT network you just set up. (See Figure E.4.)
FIGURE E.4 Configuring VMs for the NAT network
6. Now you’re all set! You can start both machines and test to verify that they can see each other. To do this, simply log into the Metasploitable box and run ifconfig to find its IP address. Use ssh [ip address] ‐l msfadmin to SSH from the Kali Linux system to the Metasploitable system. If you connect and can log in, you’re ready to run exercises between the two systems!
Objectives Map for CompTIA Cybersecurity Analyst (CSA+) Exam CS0-001
The following objective map for the CompTIA Cybersecurity Analyst (CSA+) certification exam will enable you to find the chapter in this book, which covers each objective for the exam.
Objectives Map
Assessment Test
If you’re considering taking the Cybersecurity Analyst+ exam, you should have already taken and passed the CompTIA Security+ and Network+ exams and should have 3–4 years of experience in the field. You may also already hold other equivalent certifications. The following assessment test help to make sure that you have the knowledge that you should have before you tackle the Cybersecurity Analyst+ certification and will help you determine where you may want to spend the most time with this book.
1 After running an nmap scan of a system, you receive scan data that indicates the following three ports are open:
22/TCP
443/TCP
1521/TCP
What services commonly run on these ports?
A. SMTP, NetBIOS, MySQL
B. SSH, Microsoft DS, WINS
C. SSH, HTTPS, Oracle
D. FTP, HTTPS, MS-SQL
2 Which of the following tools is best suited to querying data provided by organizations like the American Registry for Internet Numbers (ARIN) as part of a footprinting or reconnaissance exercise?
A. nmap
B. traceroute
C. regmon
D. whois
3 What type of system allows attackers to believe they have succeeded with their attack, thus providing defenders with information about their attack methods and tools?
A. A honeypot
B. A sinkhole
C. A crackpot
D. A darknet
4 What cybersecurity objective could be achieved by running your organization’s web servers in redundant, geographically separate datacenters?
A. Confidentiality
B. Integrity
C. Immutability
D. Availability
5 Which of the following vulnerability scanning methods will provide the most accurate detail during a scan?
A. Black box
B. Authenticated
C. Internal view
D. External view
6 In early 2017, a flaw was discovered in the Chakra JavaScript scripting engine in Microsoft’s Edge browser that could allow remote execution or denial of service via a specifically crafted website. The CVSS 3.0 score for this reads
What is the attack vector and the impact to integrity based on this rating?
A. System, 9, 8
B. Browser, High
C. Network, High
D. None, High
7 Alice is a security engineer tasked with performing vulnerability scans for her organization. She encounters a false positive error in one of her scans. What should she do about this?
A. Verify that it is a false positive, and then document the exception
B. Implement a workaround
C. Update the vulnerability scanner
D. Use an authenticated scan, and then document the vulnerability
8 Which phase of the incident response process is most likely to include gathering additional evidence such as information that would support legal action?
A. Preparation
B. Detection and Analysis
C. Containment, Eradication, and Recovery
D. Post-Incident Activity and Reporting
9 Which of the following descriptions explains an integrity loss?
A. Systems were taken offline, resulting in a loss of business income.
B. Sensitive or proprietary information was changed or deleted.
C. Protected information was accessed or exfiltrated.
D. Sensitive personally identifiable information was accessed or exfiltrated.
10 Which of the following techniques is an example of active monitoring?
A. Ping
B. RMON
C. Netflows
D. A network tap
11 Ben’s monitoring detects regular traffic sent from a system that is suspected to be compromised and participating in a botnet to a set of remote IP addresses. What is this called?
A. Anomalous pings
B. Probing
C. Zombie chatter
D. Beaconing
12 Which of the following tools is not useful for monitoring memory usage in Linux?
A. df
B. top
C. ps
D.