Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Sec+ 701 > 1.0 General Security Concepts > Flashcards

1.0 General Security Concepts Flashcards

1
Q

Which type of control would a firewall be classified as?

A

a) Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Security awareness training for employees is an example of which control type?

A

b) Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which control type is most likely to be automated?

A

a) Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which control type is most focused on day-to-day security activities?

A

c) Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A company’s disaster recovery plan would be considered what type of control?

A

b) Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Biometric access systems are an example of which control type?

A

d) Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which control type is most likely to be implemented through written policies and procedures?

A

b) Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Log review and monitoring would typically be classified as what type of control?

A

c) Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which control type is most focused on overall security strategy and governance?

A

b) Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A security guard conducting patrols is an example of which control type?

A

c) Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which control type is most likely to require regular software updates or patches?

A

a) Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Risk assessments are typically considered what type of control?

A

b) Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which control type is most prone to human error or inconsistency?

A

c) Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Encryption of data at rest is an example of which control type?

A

a) Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which control type is most likely to be visible to employees and visitors?

A

d) Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which type of control is designed to discourage potential attackers from attempting a security breach?

A

b) Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An intrusion detection system (IDS) is an example of which type of control?

A

c) Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When a primary control cannot be implemented due to technical limitations, what type of control would be most appropriate?

A

a) Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which control type is most closely associated with security policies and procedures?

A

c) Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A firewall is primarily an example of which type of control?

A

c) Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Incident response plans are best categorized as which type of control?

A

c) Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which control type aims to limit damage and restore systems to normal after a security incident?

A

c) Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Security awareness training programs are primarily examples of which two types of controls?

A

a) Preventive and Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which control type is most likely to involve psychological elements to influence potential attackers?

A

b) Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A SIEM system that alerts security personnel to potential threats is an example of which control type?

A

c) Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which control type is most closely associated with providing alternative security measures?

A

b) Compensating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Encryption is primarily an example of which type of control?

A

a) Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which control type is most likely to be implemented after a security incident has occurred?

A

d) Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Access control systems are primarily examples of which type of control?

A

a) Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which control type is most closely associated with ensuring compliance with security policies?

A

c) Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the three components of the CIA triad?

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which principle ensures that data remains unaltered and trustworthy throughout its lifecycle?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the primary purpose of non-repudiation in information security?

A

To ensure that a user cannot deny performing a specific action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

In the AAA framework, what does the first “A” stand for?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which authentication method might use fingerprints or retinal scans?

A

Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the main difference between authentication and authorization?

A

Authentication verifies identity, while authorization determines access rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which authorization model assigns permissions based on a user’s job function or title?

A

Role-Based Access Control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In ABAC, what are four types of attributes that might be considered for access decisions?

A

User
Resource
Action
Environmental Attributes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Who typically controls access rights in a Discretionary Access Control (DAC) model?

A

The resource owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which access control model is most commonly used in high-security government environments?

A

Mandatory Access Control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the primary goal of a gap analysis in security?

A

To identify differences between current and desired security states

42
Q

In the Zero Trust model, what does “adaptive identity” refer to?

A

Continuous evaluation and adaptation to user behavior and context

43
Q

What is the role of the Policy Engine in the Zero Trust Control Plane?

A

To evaluate access requests against policies and make decisions

44
Q

What is an “implicit trust zone” in the context of Zero Trust architecture?

A

An area within the network where some level of trust is assumed

45
Q

Which physical security measure is designed to control vehicle access?

A

Bollards

46
Q

What type of sensor detects heat signatures?

A

Infrared sensors

47
Q

What is the primary purpose of a honeypot?

A

To attract and detect attacks

48
Q

How does a honeytoken differ from a honeyfile?

A

A honeytoken is false data
A honey file is a fake file

49
Q

In the Zero Trust model, what is the function of the Policy Enforcement Point?

A

To enforce access decisions made by the Policy Engine

50
Q

What is the main difference between the Control Plane and Data Plane in Zero Trust architecture?

A

The Control Plane makes decisions

The Data Plane enforces them and handles data flow

51
Q

What is the primary purpose of a backout plan in change management?

A

b) To revert changes if problems occur

52
Q

Which of the following is NOT typically included in an impact analysis?

A

c) Marketing strategy

53
Q

What does SOP stand for in the context of change management?

A

b) Standard Operating Procedure

54
Q

Which of the following is a key benefit of version control in change management?

A

c) Maintains a history of modifications

55
Q

In change management, what does the term “stakeholder” refer to?

A

c) Individuals or groups affected by the change

56
Q

What is the primary purpose of a maintenance window?

A

b) To schedule changes during off-peak hours

57
Q

Which of the following is NOT typically part of the change approval process?

A

c) Marketing campaign planning

58
Q

What is the main goal of impact analysis in change management?

A

b) To assess potential consequences of a change

59
Q

Which of the following is a key consideration when dealing with legacy applications in change management?

A

c) Balancing security needs with system limitations

60
Q

What is the purpose of allow lists and deny lists in the context of change management?

A

b) To control access to systems or resources

61
Q

Which of the following is NOT a typical step in the change approval process?

A

c) Implementation of the change

62
Q

What is the primary purpose of assigning ownership in change management?

A

b) To ensure accountability throughout the change process

63
Q

Which of the following best describes the relationship between change management and risk management?

A

c) Change management helps identify and mitigate risks associated with changes

64
Q

What is the main purpose of updating diagrams as part of change management documentation?

A

b) To maintain accurate visual representations of the IT environment

65
Q

Which of the following is NOT a typical technical implication of change management?

A

c) Increased system performance

66
Q

What is the primary purpose of a backout plan in change management?

A

To revert changes and restore systems to their previous state if unexpected issues occur

67
Q

Which of the following is NOT typically a stakeholder in the change management process?

a) IT staff
b) End-users
c) Competitors
d) Compliance officers

A

c) Competitors

68
Q

How does version control contribute to effective change management?

A

Answer: Tracks changes over time, enables rollbacks, and facilitates auditing

69
Q

What is the main benefit of conducting an impact analysis before implementing a change?

A

Answer: Identifies potential effects on various aspects of the organization before implementation

70
Q

In the context of change management, what does “ownership” refer to?

A

Answer: Assigning responsibility for the change to a specific individual or team

71
Q

Why is it important to update documentation after implementing changes?

A

Answer: Ensures accuracy, maintains compliance, and provides up-to-date guidance

72
Q

What role does a maintenance window play in the change management process?

A

Answer: Scheduled period for implementing changes with minimal business disruption

73
Q

How can allow lists and deny lists be affected by system changes?

A

Answer: May require updates to accommodate new systems or block potential threats

74
Q

What is the purpose of a Standard Operating Procedure (SOP) in change management?

A

Answer: Provides consistent, documented processes for routine operations and changes

75
Q

Why might legacy applications pose a challenge during the change management process?

A

Answer: Limited support, potential conflicts with new security measures, special accommodations needed

76
Q

What is the primary goal of the approval process in change management?

A

Answer: To review and authorize proposed changes, ensuring they align with organizational needs and policies

77
Q

How can proper change management help with compliance and auditing efforts?

A

Answer: Provides documented processes, change history, and accountability

78
Q

What potential issues can arise from neglecting to consider dependencies when implementing changes?

A

Answer: Unintended consequences, system failures, or security vulnerabilities

79
Q

Why is it important to involve the security team in the change management process?

A

Answer: Ensures changes align with security policies and don’t introduce vulnerabilities

80
Q

What role do test results play in the change management process?

A

Answer: Validate effectiveness, identify potential issues, and inform decision-making

81
Q

What is the significance of documenting changes in network diagrams?

A

Answer: Maintains accurate visual representations of systems and their relationships

82
Q

How can change management processes help mitigate risks associated with technical changes?

A

Answer: Provides structured approach to assess, implement, and monitor changes

83
Q

How does change management relate to incident response procedures?

A

Answer: Helps identify recent changes that may have contributed to an incident

84
Q

What factors should be considered when scheduling a maintenance window?

A

Answer: Business impact, stakeholder availability, adequate time for implementation and testing

85
Q

How can effective change management contribute to an organization’s overall security posture?

A

Answer: Ensures controlled implementation of changes, risk assessment, and maintenance of security controls

86
Q

What is the primary difference between symmetric and asymmetric encryption?

A

c) Number of keys used

87
Q

Which encryption level protects all data on a storage device?

A

b) Full-disk encryption

88
Q

What is the purpose of a Hardware Security Module (HSM)?

A

b) To manage and safeguard cryptographic keys

89
Q

Which of the following is NOT a function of a Certificate Authority (CA)?

A

c) Encrypting network traffic

90
Q

What is the main purpose of key stretching?

A

b) To make weak passwords more resistant to brute-force attacks

91
Q

Which cryptographic concept ensures the integrity and authenticity of a message?

A

c) Digital signature

92
Q

What is steganography used for in the context of cryptography?

A

b) Hiding the existence of information

93
Q

Which protocol is used to check the revocation status of digital certificates in real-time?

A

b) OCSP

94
Q

Which type of certificate can secure multiple subdomains of a single domain?

A

c) Wildcard certificate

95
Q

What is the primary purpose of a Trusted Platform Module (TPM)?

A

b) To store and protect cryptographic keys

96
Q

What is the main advantage of asymmetric encryption over symmetric encryption?

A

d) Ability to securely exchange keys over an insecure channel

97
Q

Which of the following is NOT a common use of blockchain technology?

A

c) Full-disk encryption

98
Q

What is the purpose of salting in the context of password hashing?

A

b) To make rainbow table attacks more difficult

99
Q

Which encryption level is most appropriate for protecting specific records within a database?

A

c) Record encryption

100
Q

What is the primary purpose of a Certificate Signing Request (CSR)?

A

c) To initiate the process of obtaining a digital certificate

CompTIA Sec+ 701 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions