Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

2022 Security+ SYO-601 CompTIA > 3.0 - Implementation > Flashcards

3.0 - Implementation Flashcards

1
Q

Define

SRTP

A
  • Secure Real-Time Transport Protocol
  • Adds security features to RTP
  • Integrity, replay protection, and AES encryption
  • Used for voice and video
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define

NTPsec

A
  • Secure Network Time Protocol
  • Began development in 2015
  • Adds security to NTP and cleans up code base
  • (NTP has commonly been used as amplifiers in DDoS attacks)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define

S/MIME

A
  • Secure/Multipurpose Internet Mail Extensions
  • Public key encryption and digital signing of mail content
  • Requires PKI or similar organization of keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define

IPsec

A
  • Internet Protocol Security
  • Allows sending of data over OSI layer 3 with authentication and encryption for every packet
  • Very standardized, common to use across multiple vendors
  • Its two primary protocols are AH and ESP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Explain

AH

A
  • Application Header
  • One of the core protocols of IPsec
  • Adds a hash of the IP packet and a shared key
  • The hash adds integrity
  • The shared key authenticates the origin
  • Also includes sequence numbers, to prevents replay attacks
  • Does not encrypt data, only provides integrity
  • Can be used independently, but is most often used with ESP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define

ESP

A
  • Encapsulation Security Payload
  • One of the core protocols of IPsec
  • Adds encryption to IP packets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Difference between FTPS and SFTP?

A
  • FTPS is “FTP over SSL”

* SFTP is “SSH FTP”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define

LDAPS

A
  • LDAP Secure

* A non-standard implementation of LDAP over SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define

SASL

A
  • Simple Authentication and Security Layer
  • Directory service to provide authentication using many different methods
  • Such as Kerberos or client certificate
  • Can be used by LDAP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define

DNSSEC

A
  • Domain Name System Security Extensions
  • Validates DNS responses to authenticate the origin and confirm the data integrity
  • Uses public key cryptography
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define

SNMPv3

A
  • The secure version of SNMP

* Adds authentication, integrity, and confidentiality through encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How can security be added to DHCP?

A
  • It does not include any security functions in its original specification
  • Switches can be configured to only allow DHCP responses to come from specified trusted interfaces
  • In Active Directory, DHCP servers must be authorized
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define

DHCP Snooping

A
  • The term used by Cisco for the feature of specifying what interfaces on a switch are allowed to send DHCP responses
  • Filters invalid IP and DHCP information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Explain

EDR

A
  • Endpoint Detection and Response
  • A newer method of threat protection, rather than signature-based
  • Detects threats through behavior analysis, machine learning, process monitoring
  • Can run through a lightweight agent on an endpoint
  • Both investigates threats and can respond to it
  • Reponses may include isolating the system, quarantining the threat, rolling back to a previous config
  • Can be automated and API-driven
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are alternative terms for NGFW?

A
  • Application Layer Gateway
  • Stateful Multilayer Inspection
  • Deep Packet Inspection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define

NGFW

A
  • Next-Generation Firewall
  • Inspects the application layer, all data in every packet, rather than just looking at IP address and port number
  • Can allow or block application features
  • Identify attacks and malware
  • Examine encrypted data (if configured to manage the keys)
  • Prevent access to URLs or URL categories
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define

HIDS and HIPS

A

• Host-Based Intrusion Detection System

and

  • Host-Based Intrusion Prevention System
  • Runs directly on an endpoint/host, and looks through log files to identify intrusions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Explain

TPM

A
  • Trusted Platform Module
  • Hardware installed to assist with cryptography and device security
  • Cryptographic processor and key generator
  • Comes with unique keys burned in during production
  • Can store keys, hardware configuration info, etc.
  • Password protected with anti-brute force features
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How does UEFI BIOS protect against malicious firmware updates?

A
  • BIOS includes the manufacturer’s public key
  • When flashing a BIOS update, the firmware’s digital signature is checked against that key
  • BIOS will prevent unauthorized writes to the flash
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define

Secure Boot

A
  • Part of the UEFI specification
  • When enabled, Secure Boot verifies the bootloader
  • Checks the bootloader’s digital signature
  • Bootloader must be signed with a trusted certificate, or else its signature must be manually approved
  • Confirms that no part of that bootloader has been changed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define

Trusted Boot

A
  • The bootloader verifies the digital signature of the OS kernel
  • The boot process will halt if a corrupted kernel is detected
  • The kernel then verifies all other startup components, including boot drivers and startup files
  • ELAM then runs prior to loading all remaining drivers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define

ELAM

A
  • Early Launch Anti-Malware
  • A security feature of Windows that checks every driver to see if it is trusted prior to loading it
  • Runs early in the boot process
  • Checks digital signatures, and prevents untrusted drivers from loading.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Explain

Measured Boot

A
  • UEFI stores a hash of firmware, boot drivers, and everything else loaded during Secure Boot and Trusted Boot processes
  • This hash is stored in the TPM and can be sent, encrypted and signed by the TPM, to a verification server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define

Remote Attestation / Boot Attestation

A
  • When the Measured Boot process completes, the TPM encrypts, signs, and sends an operational report to a verification server
  • The attestation server receives the boot report, and compares it to the known-trusted configuration of the system
  • If changes are found, they are identified and various actions can be taken
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is this another name for?

Fuzzing

A
  • A colloquial term for Dynamic Analysis
  • May also be referred to as:
  • Fault-injecting
  • Robustness testing
  • Syntax testing
  • Negative testing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define

Dynamic Analysis

A
  • A type of attack on applications, where random input is sent
  • Attacker is looking for vulnerabilities, application crashes, buffer overflows, exceptions, etc.
  • “Fuzzers” are tools to perform this.
  • Very time and processor resource heavy, but often designed to perform high-probability tests first.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Describe security concerns surrounding:

Cookies

A
  • Cookies are used for tracking, personalization, and session management
  • Generally should not be a security risk, unless someone gains access to them.
  • Secure Cookies have an attribute set that requires they will only be sent over HTTPS
  • Sensitive information ought never to be stored in a cookie
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Explain

HTTP Secure Headers

A
  • A way for the web server to restrict the capabilities of a browser from performing certain functions
  • Useful when an application is being used on your web server, but you aren’t certain of that application’s security
  • For example, can be used to:○ enforce HTTPS○ only allow scripts, stylesheets, or images from the local site (preventing XSS attacks)○ prevent data from loading in an iframe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Explain

Code Signing

A
  • Application code can be digitally signed by the developer, confirming that the code has not been modified
  • Asymmetric encryption:○ A trusted CA signs the developer’s public key○ And the developer signs the code with their private key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How can applications be allowed or denied?

A
  • Allow lists and deny lists can be made to control what applications may run on a system
  • Lists may be based on, for example:○ Application’s hash○ A certificate, for digitally signed applications○ The application’s path, allowing applications to only run in certain folders○ The application’s network zone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Explain

SAST

A
  • Static Application Security Testing
  • A tool to perform automated analysis on source code to identify security flaws
  • Findings and recommendations are reported, and would still need to be manually verified and applied
  • Not all flaws can be identified this way, such as authentication security issues and insecure cryptography
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Name a tool that can scan and verify what ports are open?

A

• Nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Define

SED

A
  • Self-Encrypting Drive
  • Hardware-based full disk encryption
  • No operating system software needed
  • Follows the “Opal storage specification”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What functions may a Load Balancer perform? (six answers)

A
  • Primary function it to manage the load across multiple servers
  • May also perform any of the following:○ TCP offload (handles some TCP traffic rather than the servers)○ SSL offload (encryption/decryption, so that comm. between balancer and servers is in-the-clear)○ Caching (keeps copy of common responses on balancer, so it can respond quickly on behalf of servers)○ Prioritization / QoS○ Content switching (application-centric balancing, directing different functions to different servers)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Explain Scheduling and list four possible methods

A
  • Scheduling is the method of determining which server a load balancer will direct traffic to
  • Example Active/Active methods:○ Round-Robin (each server selected in turn)○ Weighted Round-Robin (prioritizing some servers over others, rather than equal)○ Dynamic Round-Robin (distribute traffic to server with lowest current load)

• Active/Passive scheduling will only route traffic to “passive” servers if an active server fails (making the passive server become active)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Define

Affinity

A
  • In Load Balancing, Affinity connects users to specific servers, so that whenever they reconnect, they will be directed to the same server as previously
  • Often based on IP address / port number or session ID
  • Used when an application requires communication to the same instance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Explain

Extranet

A
  • Similar in structure to a DMZ, but usually requires additional authentication to access, rather than allowing any public access
  • Often used for partners, vendors, suppliers, etc. to gain access to internal resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define

East-West Traffic

A
  • Traffic between devices in the same data center

* Includes traffic between separate customers within the same data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define

North-South Traffic

A
  • A term for a data center’s Ingres/egress traffic to and from an outside device
  • Usually requires a stricter security posture than east-west traffic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define

Concentrator

A
  • The device that performs encryption and decryption for a VPN connection
  • Often integrated into a firewall, but can also be a standalone device
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Explain

SSL VPN

A
  • Uses the common SSL/TLS protocol (tcp 443)
  • Therefore, usually does not run into any firewall issues
  • can authenticate users
  • Doesn’t require digital certificates or shared passwords
  • Can be run from within a browser or a light VPN client, but often doesn’t require a VPN client
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Explain

HTML5 VPN

A
  • HTML5 includes API support with web cryptography API

* Allows for the creation of a VPN tunnel in a browser without any VPN application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Explain

L2TP

A
  • Layer 2 Tunneling Protocol
  • Connecting sites over a layer 3 network as though they were connected at layer 2
  • Commonly implemented with IPsec (L2TP for the tunnel, IPsec for the encryption)○ Sometimes referred to as L2TP over IPsec or L2TP/IPsec
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Explain

Transport Mode vs. Tunnel Mode

A
  • IPsec modes of operation
  • in Transport mode, only the Data portion of the IP packet is encrypted
  • In Tunnel mode, both the IP Header and the Data are encrypted, and a new IP header is added, which directs the packet to the VPN concentrator on the other side of the tunnel.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Define

Broadcast Storm Control

A
  • A security feature for switches
  • Limits the number of broadcasts per second
  • Often also used to control multicast and unknown unicast traffic
  • Can be managed either by specific values, percentages, or deviations baseline behavior
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Define

BPDU

A
  • Bridge Protocol Data Unit

* The primary protocol used by Spanning Tree Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Define

BPDU Guard

A
  • If a BPDU frame is seen on a PortFast configured interface, the interface will shutdown
  • This is because PortFast interfaces are only supposed to connect to endpoints, which would never send BPDUs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Define

PortFast

A
  • Cisco’s term for the feature of bypassing the STP listening and learning steps when a device is plugged in
  • Configured for ports that are known to only be needed to connect to endpoints, so STP is not needed since it won’t create a loop.
  • STP takes 20-30 seconds to determine how to handle a new connection, so bypassing it saves time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Explain

MAC Filtering

A
  • Limiting access to the network based on MAC address Allow Lists
  • Security through obscurity
  • Not very secure since Allowed MACs on the network can be easily discovered and spoofed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

List some security implications of IPv6

four bullets

A
  • No need for NAT
  • Some attack types no longer apply (such as ARP spoofing, since there is no ARP)
  • But some new attack types apply, such as Neighbor Cache Exhaustion
  • It is not necessarily more or less secure than IPv4, it’s just different
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Define

Neighbor Cache Exhaustion

A
  • An IPv6 attack which fills up the neighbor cache on devices
  • Can make a system unable to communicate with other devices on the network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Define

SPAN

A
  • Switched Port ANalyzer

* Cisco’s name for port mirroring to a software-based tap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Define

FIM

A
  • File Integrity Monitoring
  • Monitoring changes to files that should never change
  • Notifies when changes occur
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Two examples of FIM tools?

A
  • Tripwire: Real-time FIM tool for Linux

* SFC (System File Checker) - On-demand FIM for Windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Define

Stateless Firewall

A
  • Older style of firewall that does not keep track of traffic flows
  • Packets coming into the network will need access rules to get in, even if it is in response to requests originating from the firewall’s internal network
  • Access rules are required for both directions of a session’s traffic
  • Security concerns since rules require that external traffic will gain entry even if it is unsolicited
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Explain

UTM

A
  • Unified Threat Management
  • An all-in-one security appliance
  • Firewall, Content filter, anti-malware, spam filter, IDS/IPS, VPN endpoint, etc.
  • A precursor to NGWF
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Explain

WAF

A
  • Web Application Firewall
  • Applies rules to HTTP/HTTPS conversations
  • Instead of looking at ports and IPs, it allows or denies based on expected input.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

If a firewall has an implicit deny, why might an admin create an explicit deny for a specific service?

A

• Implicit denies are not logged. Creating a rule means an attempted access will generate a log.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is an advantage of host-based firewalls?

A

• Since it runs on your local machine, it can view traffic from an encrypted communication (HTTPS, etc.), since it is decrypted locally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Define

Dissolvable Agent

A
  • Used for Network Access Control
  • For running health checks and posture assessment on devices on / connecting to the network
  • No installation required
  • Runs during the assessment, and terminates when no longer required
61
Q

Define

Agentless NAC

A
  • Used for Network Access Control
  • For running health checks and posture assessment on devices on / connecting to the network
  • Integrated with Active Directory
  • Checks are made during login and logoff
  • Only runs at those times; cannot be scheduled
62
Q

What functions may a Proxy Server perform? (list 5)

A
  • Keeping a local cache of information
  • Access Control
  • URL Filtering
  • Content Scanning
  • A Reverse Proxy, which examines incoming requests from the Internet before sending them to a web server
63
Q

Define

Transparent Proxy Server

A

• A proxy server on a network, where endpoints don’t need to be explicitly configured to use it, and aren’t aware of it.

64
Q

What does this stand for?

NIDS

A

• Network-based Intrusion Detection System

65
Q

What does this stand for?

NIPS

A

• Network-based Intrusion Prevention System

66
Q

What is an out-of-band response?

A
  • When a passive IPS (not in-line with traffic) identifies malicious traffic and sends an TCP RST (reset) frame to prevent further traffic
  • It does not prevent the original packet from going through, but disrupts the traffic flow and prevents further communication
  • The reset frame is part of the TCP protocol; this response does not work with UDP traffic
67
Q

What methods can be used by an IPS to identify malicious activity? (Four answers)

A
  • Signature-based: Must match exactly
  • Anomaly-based: Create a baseline of what’s normal to detect unusual activity
  • Behavior-based: Programmed to know what certain malicious activities might look like
  • Heuristics: use artificial intelligence and big data
68
Q

Define

Jump Server

A
  • A system that you connect to in order to access other internal systems
  • Must be highly-secured, hardened, and monitored
69
Q

Define

HSM

A
  • Hardware Security Module
  • A dedicated server for handling cryptographic functions, storing keys, certificates, etc.
  • Used in very large environments with many devices that need cryptographic keys
  • Usually installed in clusters with lots of redundancy
  • Built with specialized hardware designed for cryptography
  • Can act as a proxy to offload encrypted communication for webservers, and forward the traffic to the webservers in the clear
70
Q

What does this stand for?

MIC

A

• Message Integrity Check

71
Q

Define:

CCMP

A
  • Stands for: Counter/CBC-MAC Protocol
  • A block cipher mode
  • The type of encryption used with WPA2
  • Uses AES for confidentiality
  • Uses CBC-MAC for MIC
72
Q

Define:

CBC-MAC

A
  • Cipher Block Chaining Message Authentication Code Protocol

* A form of MIC (Message Integrity Check)

73
Q

Define:

GCMP

A
  • Galois/Counter Mode Protocol
  • A block cipher mode
  • The type of encryption used in WPA3
  • Uses AES for confidentiality
  • Uses GMAC for MIC
74
Q

Define:

GMAC

A
  • Galois Message Authentication Code

* A form of MIC

75
Q

What security advantages does WPA3 have over WPA2?

A
  • WPA2 is susceptible to brute force attacks. Once the passphrase is known, an attacker can read all communication of all devices
  • WAP3 uses:○ mutual authentication○ creates a shared session key without sending that key across the network○ perfect forward secrecy○ SAE
76
Q

Explain:

Perfect Forward Secrecy

A
  • A session key is created for each session, and disposed of when the session is over
  • New sessions would create a new key
  • Used, among other places, in WPA3
77
Q

Explain:

SAE

A
  • Simultaneous Authentication of Equals
  • A Diffie-Hellman derived key exchange (same process), but adds an authentication component
  • An IEEE standard
  • sometimes called the dragonfly handshake
  • Used, among other places, in WPA3
78
Q

Describe WPS from a security standpoint.

A
  • Best practice is to disable it
  • If it does not have brute-force protection built in, it is extremely easy to brute force
  • Only 11,000 possible combinations need to be tried to gain access
  • Brute-force lockouts are now the norm, but most devices out there don’t have it.
79
Q

How can WPS authenticate a device?

A
  • a PIN (which is easily brute-forced)
  • A physical button to push on the WAP
  • NFC
80
Q

What type of authentication does WPA2-Enterprise use?

A

• 802.1X

81
Q

Explain

802.1X

A
  • A type of network access control that requires authentication to access the network, whether wired or wireless
  • Typically uses a central authentication database such as RADIUS, LDAP, TACACS+, etc.
  • The authenticator (the device that provides network access) communicates to an authentication server on behalf of the supplicant (client)
82
Q

Define

NAC

A
  • Port-based Network Access Control

* A name for 802.1X

83
Q

Define:

EAP

A
  • Extensible Authentication Protocol
  • The authentication protocol used by 802.1X, as well as many other types of authentication for wireless networks
  • Supports multiple types of authentication
  • Manufacturers can build their own EAP methods
84
Q

Explain:

EAP-FAST

A
  • EAP Flexible Authentication via Secure Tunneling
  • Ensures that the authentication server and supplicant can communicate with each other over a secure tunnel.
  • The server provides a protected access credential (PAC), i.e. a shared secret, to the supplicant, they mutually authenticate and negotiate a TLS tunnel, and user authentication occurs over the TLS tunnel.
85
Q

Define:

PAC

A
  • Protected Access Credential

* A shared secret, used in EAP-FAST

86
Q

Define:

AS

A

• The acronym used for the Authentication Server in EAP

87
Q

Define

PEAP

A
  • Protected EAP (Extensible Authentication Protocol)
  • Created by Cisco, Microsoft, and RSA Security
  • Similar to EAP-FAST, but instead of a PAC (Private Access Credential), the AS uses a digital certificate.
  • (As with a web server, the client does not need its own certificate, only the server)
  • User can authenticate using MSCHAPv2 for Microsoft services, or GTC
88
Q

What does this stand for?

MSCHAPv2

A

• Microsoft Challenge Handshake Authentication Protocol version 2

89
Q

What does this stand for?

GTC

A

• Generic Token Card

90
Q

Explain:

EAP-TLS

A
  • EAP with TLS
  • Similar to PEAP, but requires a digital certificate on the client as well as the AS, so they can mutually authenticate
  • Once devices have authenticated to each other, the TLS tunnel is built for the user authentication process
  • Complex implementation as it requires all network devices to have certificates
  • May not be suitable, as not all devices can support the use of digital certificates,
91
Q

Explain:

EAP-TTLS

A
  • EAP Tunneled TLS
  • Similar to PEAP, builds a TLS tunnel using the digital certificate of the AS
  • (Does not require the supplicant to have a certificate)
  • Can use any authentication method inside the TLS tunnel, including other EAPs, MSCHAPv2, or anything else.
92
Q

Define

Wireless Controller

A
  • A centralized management device for wireless access points

* Allows management of system configuration, performance, updates, etc.

93
Q

Define

MCM

A
  • Mobile Content Management
  • Controls for securing access to data and protecting it from outsiders
  • Managed from the mobile device manager (MDM)
  • May include controls for file sharing and viewing, as well as DLP and encryption requirements
94
Q

Explain

Context-Aware Authentication

A
  • An emerging technology
  • Looks at multiple contexts to determine whether a login attempt is likely to be authentic
  • Contexts may include:○ Device IP address○ GPS information○ Devices connected / Bluetooth paired to the device○ more
95
Q

In the context of BYOD, define:

Containerization

A
  • The separation of enterprise mobile apps and data from personal apps and data
  • Storage on a mobile device is segmented to keep business data in a contained area with restricted sharing
  • Makes offboarding much easier. Business data can be wiped without removing personal data.
96
Q

Define

MicroSD HSM

A
  • A small Hardware Security Module, in microSD card form
  • Provides security services to mobile devices, such as:○ encryption○ key generation○ digital signatures○ authentication
97
Q

Explain

UEM

A
  • Unified Endpoint Management
  • Similar to MDM, but also manages non-mobile devices
  • Allows users to change between devices, such as phone and laptop, and still have same security and access
98
Q

Explain

MAM

A
  • Mobile Application Management
  • Provision, update, and remove apps from your own enterprise app catalog
  • Monitor application use
  • Fine-grained control of wiping data
99
Q

Explain

SEAndroid

A
  • Security Enhancements for Android
  • Puts SELinux functions into Android OS
  • Supports additional access control security policies
  • Enabled by default since Android version 4.3 in July 2013
  • Developed by NSA
100
Q

List some security features added by SEAndroid (four answers)

A
  • Protects privileged access to Android system daemons
  • Changed Discretionary Access Control (DAC) to Mandatory Access Control (MAC)
  • Isolate and sandboxes Android apps
  • Centralized policy configuration
101
Q

Define:

OTA

A
  • Over the Air
  • A type of firmware update for mobile devices
  • Delivered wirelessly without needing to connect to any device
102
Q

List some capabilities of MDM

A
  • Control firmware updates
  • Use an allow list or block list of approved / blocked apps
  • Control microphone/camera use to disable/enable either always or only in certainly locations
  • Control SMS/MMS usage by timeframe or location
103
Q

Define

USB OTG

A
  • USB On-the-Go
  • A USB 2.0 Standard that allows supported devices to connect directly together
  • A mobile device can act as both a host and a device, acting as storage
104
Q

Define

Geotagging

A
  • aka GPS Tagging
  • Adds location to file metadata
  • Can cause security concern, since investigating these files can create a path of a user
  • Can be disabled
105
Q

Define

COPE

A
  • Corporate-Owned, Personally-Enabled
  • A mobile deployment model
  • Similar to BYOD, but the company buys the device and allows it to also be used for personal use
  • Company keeps full control of device
106
Q

Define

CYOD

A
  • Choose Your Own Device

* Similar to COPE, but with the user’s choice of device

107
Q

Explain

VMI

A
  • Virtual Mobile Infrastructure
  • Like thin clients, mobile phones can also connect to a cloud service where apps and data are stored
  • If the device is lost, no data is lost, no security concern
  • Allows for centralized app development, since you only need to write for a single VMI platform
  • No need to update all individual devices
108
Q

Define

AZ

A
  • Availability Zone
  • Isolated locations with a cloud region (geographic location)
  • Each AZ is completely independent
109
Q

Define

HA Across Zones

A

High Availability Across (Availability) Zones

• Highly Available applications can be aware of Availability Zones, and recognize an outage in a particular zone to adjust accordingly

110
Q

Define

IAM

A
  • Identity and Access Management
  • Cloud resource security control to determine who gets access, and what they get access to
  • Maps job functions to roles
  • Granular policies control access by user group, IP, date and time, geolocation, etc.
111
Q

Define

VPC Endpoint

A
  • Virtual Private Cloud Endpoint
  • Allows private cloud subnets to communicate to other cloud services, even without an internet connection.
  • Facilitates connectivity between VPCs and cloud services such as storage.
112
Q

What are some tips for container security?

A
  • Use OSs that are designed specifically for containers

* Group containers of similar type onto the same host, to limit the scope of any intrusion

113
Q

Define

Security Group

A
  • In the context of Cloud Computing:
  • Security Groups provide Layer 4 firewall services for all resources within a VPC (Virtual Private Cloud)
  • Not to be confused with Security Groups in Active Directory
  • Not sure why they’re not just called “VPC Firewalls” or something.
114
Q

Define

DAC vs. MAC

A
  • Discretionary Access Control / Mandatory Access Control
  • In DAC model, users have control over access to their own data or local computer resources
  • In MAC model, access permissions are set by administrators. Resources objects (such as files) are given security labels which assign a classification and category, which matches it to users’ classifications and categories to determine access.
115
Q

Explain

CASB

A
  • Cloud Access Security Broker
  • May be installed as client software, run as a local network appliance, or a cloud service
  • Four functions:○ Visibility into what apps are in use, what data is being transferred, etc.○ Enforce compliance regulations○ Prevent threats / disallowed blocked items○ Data Security: Enforce DLP, Encryption, etc.
116
Q

Explain

SWG

A
  • Next-Gen Secure Web Gateway
  • Protects users and devices regardless of location and activity
  • Goes beyond just examing Layer 4 (TCP/UDP), URLs, and GET requests
  • Examines JSON strings and API requests, to allow or disallow very specific activities
117
Q

Explain

IdP

A
  • Identity Provider
  • A third-party providing identity control for another service.
  • Essentially “Authentication as a Service”
  • Commonly used by SSO applications
118
Q

Explain

SSH Keys

A
  • The use of public/private cryptographic keys to authenticate in SSH instead of a username and password
  • Especially used for automation and scripts, since you won’t be there to enter a password when the script is running
  • Key management is crticial, to centralize, control, and audit key use
  • Both open source and commercial SSH key managers are available
119
Q

How to generate and login with an SSH key?

A

• ssh-keygen

○ the command in Linux or MacOS

○ Creates a public/private key pair for authentication

• Copy the public key to the SSH server:

○ ssh-copy-id user@host

  • Copy the private key to any system that will need to login
  • You can now login with the following command, no password required:○ ssh user@host
120
Q

Explain

KBA

A
  • Knowledge-Based Authenication
  • A form of “Something you know”
  • Static KBA: Pre-configured security questions, often used with account recovery.○ Ex., what was your first car?

• Dynamic KBA: Not pre-configured, but pulled from some other source, often an identity verification service.

 ○ Ex., Which of the following addresses did you live at in 1999?
121
Q

Explain

PAP

A
  • Password Authentication Protocol
  • An old, basic authentication method.
  • Rare today. Used only in legacy systems.
  • No encryption, designed for analog dialup connections.
  • When used today, the application may provide encryption, encapsulated within PAP, so it’s not sent in the clear.
122
Q

Explain

CHAP

A
  • Challenge-Handshake Authentication Protocol
  • Encrypted challenge sent over the network
  • A step up from PAP
  • Server sends a challenge based on the password, which verifies both sides have that password, without sending the password itself.
  • This challenge-response may continue to occur periodically during the connection, invisible to the user
123
Q

Explain

MS-CHAP

A
  • Microsoft’s implementation of CHAP
  • MS-CHAP v2 is the most recent version
  • Both v1 and v2 are insecure and should not be used, because they use DES
  • DES is susceptible to brute force decryption of the hash
124
Q

Explain

TACACS

A
  • Terminal Access Controller Access-Control System
  • A remote authentication protocol
  • Originally built when using analog dial-up lines
  • Created for access ARPANET
125
Q

Explain

XTACACS

A
  • Extended TACACS
  • Cisco proprietary version of TACACS
  • Has additional support for accounting and auditing
126
Q

Explain

TACACS+

A
  • The latest version of TACACS. released in 1993
  • If using TACACS today, it is probably this version
  • Adds more authentication requests and response codes
127
Q

Explain

Kerberos

A
  • a Network authentication protocol
  • Authenticates once, then you are trusted by the system and don’t need to re-authenticate to access resources
  • Server provides a “ticket” that your system uses to authenticate to other systems without entering password again
  • Mutual authentication, which protects against on-path or replay attacks
  • Standard since 1980s, Microsoft began using it in Windows 2000
128
Q

What databased may be used on the backend of IEEE 802.1X?

A
  • Can work with a variety, including:
  • RADIUS
  • LDAP
  • TACACS+
129
Q

Define

SAML

A
  • Security Assertion Markup Language
  • An open standard for authentication and authorization
  • Authenticate through a third-party to gain access
  • Not designed to support mobile apps, so is likely to decline in usage as time goes on
130
Q

What is the flow of SAML?

A
  • Client accesses resource server
  • Resource server sends signed/encrypted SAML request to client, and directs them to the authorization server
  • Client signs into the Authorization Server
  • Authorization Server provides SAML token
  • Client sends SAML token to resource server and gain access
131
Q

Explain

OAuth

A

Open Authorization

  • An authorization framework with significant industry support
  • Determines what resources a user can access
  • Does not authenticate, only authorizes
  • Often used to provide authorization between applications
  • Ex. “Datto wants permissions to your Microsoft 365 account for the following. Do you want to allow this?”
132
Q

Explain

ABAC

A
  • Attribute-Based Access Control
  • Next-gen authorization model, aware of context
  • Combines and evalutes multiple parameters to determine access
  • Ex. IP address, time of day, desired action, etc.
133
Q

Explain

PAM

A
  • Privileged Access Management
  • Centralized management of administrative / superuser accounts
  • When an admin needs to perform administrative task or gain access, they make a request from the vault, and the privileged access they need is granted only temporarily. “Checked out.”
  • Enables automation
  • manages access for each user
  • extensive tracking and auditing
134
Q

Explain

CRL

A
  • Certificate Revocation List
  • Maintained by the CA
  • Contains many revocations in a large file which changes all the time.
135
Q

Explain

OCSP

A
  • Online Certificate Status Protocol
  • Allows a web browser to check revocation status of a single certificate
  • Requests are usually sent to an OCSP responder, managed by the CA, via HTTP
  • More efficient than downloading an entire CRL just to check one certificate
  • Most modern browsers support OSCP, but some older browsers and apps do not.
136
Q

Define:

DV

A
  • Domain Validation Certificate
  • SSL Certificate that shows the owner of the certificate is control over the DNS domain
  • This is the most common certificate used by websites
137
Q

Define

EV

A
  • Extended Validation Certificate
  • Like a DV, but additional checks have verified the certificate owner’s identity
  • Browsers will show a name in the address bar next to the padlock icon that indicates the SSL connection
  • Not common anymore, since SSL has become standard, there’s not much point in promoting your use of it.
138
Q

Explain

X.509

A

• The standard structure for digital certificates

139
Q

Explain

DER

A
  • Distinguished Encoding Rules
  • A type of binary encoding format
  • Common and used across many platforms
  • perfect for an X.509 certificate
140
Q

Explain

PEM

A
  • Stands for “Privacy-Enhanced Mail”
  • An encoded X.509 certificate in ASCII format
  • Makes it easier to read and e-mail, rather than the binary form of DER
  • The most common format provided by CAs
141
Q

Define

PKCS #12

A
  • Public Key Cryptography Standards #12
  • A container format for many certificates
  • Store multiple X.509 certs in a single .p12 or .pfx file
  • Often used to transfer a private and public key pair
  • The container can be password protected
142
Q

Define

CER

A
  • An X.509 file extension used primarily by Windows
  • Can be encoded either as binary DER or as ASCII PEM format
  • Usually only contains a public key; private keys would be transferred in the .pfx file format
143
Q

Define

PKCS #7

A
  • Public Key Cryptography Standards #7
  • Contains certificates and chain certificates; but does not include private keys
  • .p7b file extension
  • ASCII format
  • Wide support across multiple OSs and platforms
144
Q

Explain

OCSP Stapling

A
  • Instead of the CA needing to respond to all OCSP requests, the certificate holder can verify their own status
  • Status information is stored on the certificate holder’s server
  • OCSP status is “stapled” into the SSL/TLS handshake, digitally signed by the CA
145
Q

Explain

Pinning

A
  • To ensure that you’re really communicating to the legitimate server, you can “pin” the expected certificate or public key to an application.
  • You then compare that pined certificate to what you see when actually communicating with the server.
  • The cert must be compiled into the app, or added at first run.
  • If the expected cert doesn’t match the certificate the server presents, the application can either shut down, or show a message, or etc.
146
Q

List 5 types of PKI trust relationships.

A
  • Single CA
  • Hierachical (Single root CA with intermediate and leaf CAs)
  • Mesh (CAs that all certify each other; does not scale well)
  • Web-of-trust (alternative to traditional PKI)
  • Mutual Authentication (Server and client both authenticate to each other)
147
Q

Explain

Key Escrow

A
  • When your private keys (decryption keys) are kept and controlled by a 3rd-party
  • Ex., A business might store employee information in encrypted form, and only be able to access that private info if it is validated by the 3rd party
  • Requires trust of the 3rd party and very specific and clear process and procedures for validating
148
Q

What does this stand for?

FDE

A

• Full Disk Encryption

149
Q

What does this stand for?

HIDS

A

• Host-based Intrusion Detection System

2022 Security+ SYO-601 CompTIA (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions