Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CySA+ CS0-001 > 2.3 Vulnerability Management > Flashcards

2.3 Vulnerability Management Flashcards

1
Q

in which type of attack is a user connected to a different web server than the one intended by the user?

A

hyperlink spoofing attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what is meant by VM escape?

A

viruses and malware can migrate multiple VMs on a single server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

which type of system does a stuxnet attack target?

A

a supervisory control and data acquisition (SCADA) system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

which type of attack involves flooding a recipient e-mail address with identical e-mails?

A

spamming attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is a replay attack?

A

an attack where an intruder records the communication between a user and a server, and later plays the recorded information back to impersonate the user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is the purpose of GPS tracking on a mobile device?

A

it allows a mobile device to be located

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is a command injection?

A

when an operating system command is submitted in an HTML string

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is war chalking?

A

leaving signals about a wireless network on the outside of the building where it is housed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

which attack is an extension of the denial-of-service (DoS) attack and uses multiple computers?

A

DDoS attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

which component of a computer use policy indicates that data stored on a company computer is not guaranteed to remain confidential?

A

a no expectation of privacy policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

how do you ensure that data is removed from a mobile device that has been stolen?

A

use a remote wipe or remote sanitation program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is phishing?

A

when an e-mail request for confidential information that appears to originate from a bank or other trusted institution is received

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what is click-jacking?

A

a technique that is used to trick users into revealing confidential information or taking over the user’s computer when clicking links

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what does the acronym SCADA denote?

A

supervisory control and data acquisition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

which type of attack allows an attacker to redirect internet traffic by setting up a fake DNS server to answer client requests?

A

DNS spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is the purpose of screen locks on mobile devices?

A

to prevent users from accessing the mobile device until a password or other factor is entered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

which type of attack is characterized by an attacker who records an encrypted transmission between a client and a server computer so that he or she can then send it to the server to gain access?

A

a replay attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

why is it important to limit the use of flash drives and portable music devices by organization employees?

A

to prevent users from copying data to their personnel devices and possibly causing data leakage or from transferring malware to corporate computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

which type of attack is characterized by an attacker who situates himself or herself in such a way that he or she can intercept all traffic between two hosts?

A

man-in-the-middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

should virtual servers have the same information security requirements as physical servers?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is a smurf attack?

A

an attack where a ping request is sent to a broadcast network address with the aim of overwhelming the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what causes VM sprawl to occur?

A

when multiple VMs become difficult to manage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what is an Xmas attack?

A

an attack that looks for open ports

24
Q

what is an XML injection?

A

when a user enters values in an XML query that takes advantage of security loopholes

25
Q

what is the purpose of SCADA?

A

to collect data from factories, plants, or other remote locations, and send the data to a central computer that manages and controls the data

26
Q

what does the acronym ICS denote?

A

industrial control system

27
Q

which servers are susceptible to the same type of attacks as their hosts, including denial of service attacks, detection attack, and escape attacks?

A

virtual servers

28
Q

what is spear phishing?

A

an e-mail request for confidential information that appears to come from your supervisor

29
Q

what is the main difference between virtualization and cloud computing?

A

the location and ownership of the physical components

30
Q

what is an evil twin?

A

an access point with the same SSID as the legitimate access point

31
Q

what is vishing?

A

a special type of phishing that uses VoIP

32
Q

where should you physically store mobile devices to prevent theft?

A

in a locked cabinet or safe

33
Q

what is whaling?

A

a special type of phishing that targets a single power user, such as Chief Executive Officer (CEO)

34
Q

what is the purpose of a remote sanitation application on a mobile device?

A

to ensure that the data on the mobile device can be erased remotely in the event the mobile device is lost or stolen

35
Q

which address is faked with IP spoofing attacks?

A

the source IP address

36
Q

what is bluesnarfing?

A

the act of gaining unauthorized access to a device (and the network it is connected to) through its bluetooth connection

37
Q

which attack uses clients, handles, agents, and targets?

A

DDoS attack

38
Q

when does path traversal occur?

A

when the ../ characters are entered into the URL to traverse directories that are not supposed to be available from the Web

39
Q

what is war driving?

A

the act of discovering unprotected wireless network by driving around with a laptop

40
Q

which type of attack does challenge handshake authentication protocol (CHAP) protect against?

A

replay

41
Q

what does the acronym DDoS denote?

A

distributed denial of service

42
Q

what is header manipulation?

A

when a hacker is able to manipulate a packet header to deface, hijack, or poison the packet

43
Q

what is bluejacking?

A

an attack that sends unsolicited messages over a bluetooth connection

44
Q

which attack requires that the hacker compromise as many computers as possible to initiate the attack?

A

DDoS attack

45
Q

what is an IP spoofing attack?

A

an attack in which the source IP address in an IP datagram is modified to imitate the IP address of a packet originating from an authorized source

46
Q

which type of attack searches long lists of words for a particular language to match them to an encrypted password?

A

dictionary attack

47
Q

why is GPS tracking often disabled?

A

it is considered a security threat. as long as GPS tracking is enabled and the mobile device is powered on, the device (and possibly its user) can be located

48
Q

what is spimming?

A

an instance of spam sent over an instant message application

49
Q

what is malicious insider?

A

an employee who uses his access to the network and facility to obtain confidential information

50
Q

what is the purpose of a screen lock on a mobile device?

A

to act as a deterrent if a mobile device is lost or stolen by requiring a key combination to activate the device

51
Q

encrypting all files on a system hardens which major component of a server?

A

the file system

52
Q

what is an IV attack?

A

cracking the WEP secret key using the initialization vector (IV)

53
Q

what is pharming?

A

traffic redirection to a web site that looks identical to the intended web site

54
Q

what is the purpose of mobile device encryption?

A

to ensure that the contents of the mobile device are confidential

55
Q

which type of attack sequentially generates every possible password and checks them all against a password file?

A

brute force attack

56
Q

which type of brute-force attack attempts to find any two hashed messages that have the same value?

A

a birthday attack

CySA+ CS0-001 (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions