Programming for Cybersecurity - Study Guide
Table of Contents
1. Topic Summaries
2. Key Definitions
3. Academic Test - Set 1
4. Academic Test - Set 2
5. Python Practical Challenge
Programming for Cybersecurity - Study Guide
1. Topic Summaries
Networking Fundamentals: Communication requires sender, receiver, message, transmission medium, and
protocol. Modes: simplex, half-duplex, full-duplex.
Network Devices & Media: Describes computers, routers, switches, modems, and transmission media
(wired/wireless, networks, internet).
TCP/IP Protocol Suite: A layered model for internet communication. Each layer handles specific functions for
reliable data exchange.
Cybersecurity: Protects systems and data from attacks. Based on the CIA Triad: Confidentiality, Integrity,
Availability.
Threats: Includes malware, phishing, DDoS, and hacking.
Python in Cybersecurity: Python is widely used due to simplicity and available libraries (scapy, paramiko,
psutil).
Python Basics: Variables, I/O, conditionals, loops, lists, functions.
MITRE ATT&CK: Framework for attacker behavior. Tactics include Reconnaissance, Initial Access,
Persistence, etc.
Scanning: SYN and DNS scans using Scapy. Detect open ports and subdomains.
Honeypots: Deception tools to detect and confuse attackers. HoneyScan.py example.
Initial Access: Valid Accounts and USB attacks. Scripts include TestDefaultCredentials.py and
AutorunDetection.py.
Programming for Cybersecurity - Study Guide
2. Key Definitions
Protocol: Set of rules for communication between systems.
TCP/IP: Hierarchical protocol suite used for internet communication.
Reconnaissance: Gathering information about the target before an attack.
Honeypot: A trap system to detect or study attacker behavior.
SYN Packet: Initiates a TCP handshake; used in scanning.
Autorun.inf: File on USB used to trigger automatic execution.
Default Credentials: Factory-set usernames/passwords often left unchanged.
Programming for Cybersecurity - Study Guide
3. Academic Test - Set 1
Section A: Essay Questions
1. Explain the role of the MITRE ATT&CK framework in modern cybersecurity defense strategies.
2. Discuss the dangers of using default credentials on systems and how attackers exploit them.
Section B: Multiple Choice
1. Which is not part of CIA Triad?
2. SYN scan is used to?
3. Port for HTTPS?
4. What does paramiko help with?
5. Tactic used to gather emails?
Section C: True or False
1. Python is case-insensitive
2. IP identifies specific application
3. TCP uses 3-way handshake
4. Honeypots store backups
5. Event ID 4625 = Failed login
Programming for Cybersecurity - Study Guide
4. Academic Test - Set 2
Section A: Essay Questions (10 marks each)
1. How can Python be used in cybersecurity?
2. Explain the 3-way handshake.
3. Compare Reconnaissance vs Resource Development.
4. Risks of USB attacks and defense.
Section B: MCQs
1. Library for packet manipulation?
2. Port for DNS?
3. Credential Access means?
4. Passive recon example?
5. Event ID 4624?
Section C: True/False
1. Python must be compiled
2. IPv6 shorter than IPv4
3. Honeypots identify attackers
4. Default accounts always active
5. DNS uses TCP
Section D: Fill in the Blank
1. SSH protocol = ____
2. USB file = ____
3. SSH lib = ____
4. HTTP port = ____
5. Info gathering tactic = ____
Programming for Cybersecurity - Study Guide
Section E: Short Answer
1. What is a MAC address?
2. Why is SYN scan 'half-open'?
3. How does HoneyScan deceive?
4. Defender reaction to logins?
5. IPv4 vs IPv6 differences?
Programming for Cybersecurity - Study Guide
5. Python Practical Challenge
Objective: Build a DNS Subdomain Scanner using Python.
Steps:
- Input a domain
- Test common subdomains
- Use dns.resolver
- Output existing subdomains
Bonus:
- Log to file
- Add timestamp
- Use delay with time.sleep()
