Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comptia + > 3.5 > Flashcards

3.5 Flashcards

1
Q

security baseline

A

the minimum
amount of security controls needed for safeguarding an IT system based on its identified needs for confidentiality, integrity,
and/or availability protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

center for internet security (cis)

A

The CIS Benchmarks are strict configuration recommendations for more than 25 vendor product
families

They represent a consensus-based initiative by cybersecurity experts globally to help organizations
protect their systems against threats more effectively and confidently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

hardening (server hardening)

A

a combination of
methods, tools, and best practices used to reduce vulnerability in servers and computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

the goal of server hardening:

A

to lessen network and
IT security risks by shutting down ports and channels used by unnecessary services and
applications

It also includes removing default and automatic configuration settings and activating built-in security features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

challenges to hardening embedded/IOT systems

A

dependability
uneven security updates
attack replication
industrial protocols
device life cycles
remote deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

dependability

A

many critical aspects such as utility
grids, transportation infrastructure, and communication systems are controlled by difficult to
patch embedded systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

uneven security updates

A

most of the embedded
and specialty systems are not upgraded regularly for
security updates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

attack replication

A

since embedded devices are
mass produced, the same version of components
have the same design and build as other devices in
the lot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

industrial protocols

A

embedded systems often
follow a set of custom procedures that are not protected or recognized by enterprise security tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

device life cycles

A

specialty IoT devices typically
have a much longer lifespan than PCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

remote deployment

A

many embedded devices are
deployed in the field, outside the enterprise security perimeter; therefore, they may be directly connected to the Internet without the security layers provided in the industrial environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

wireless site surveys

A
  1. The first phase of a wireless site survey is to identify all the wireless deployment requirements
  2. Next, the surveyor should get a diagram of the area the network will cover, preferably with building blueprints:
    * Perform a walkthrough and document the infrastructure evaluation
  3. The next step is to look out for places where wireless access points can be mounted, such as ceilings and pillars
    * After this, determine the areas to be covered:
    * Don’t forget utility rooms that may house wireless equipment
    * Indicate areas on the floor plan
    * Determine the tentative access point locations:
    * Make sure to check the coverage range of your access points
    * Build in some overlap between neighboring access points to guarantee seamless roaming,
    dynamic load balancing, and network resiliency
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

wireless analysis

A

The initial decision should be to acquire an industry
leading wireless analysis and spectrum analysis
toolkit
* A Wi-Fi analyzer is a useful software application that
can report many things about the wireless network
and the networks around you, helping you optimize
your Wi-Fi for best performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

heat map

A

A Wi-Fi heatmap tool generates a color-coded graphical representation of different wireless
metrics such as signal strength, signal-to-noise
(SNR) ratio levels, and interference in different
areas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

mobile deployment models

A
  • bring your own device (BYOD)
  • corporate-owned,personally-enabled (COPE)
    *choose your own device(CYOD)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

bring your own device (BYOD)

A
  • Employees are permitted to use their personal mobile devices to access enterprise data and
    systems
17
Q

There are four basic options for BYOD:

A
  • Unlimited access for personal devices
  • Access only to non-sensitive systems and data
  • Access with IT control over personal devices, apps,
    and stored data
  • Access while preventing local storage of data
18
Q

corporate-owned, personally-enabled (COPE)

A

Company gives the employees or contractors mobile devices that are provisioned from vendors and cellular providers without end
user input

The users can handle as if they were their own
This model prevents the need for two smartphones

COPE programs should use containerization tools and extensive mobile device management and mobile application management

19
Q

choose your own device(CYOD)

A
  • Much like BYOD, it lets employees work from anywhere using a mobile device
  • CYOD devices must be approved by the organization, unlike BYOD
  • Users often select from a list of approved devices, which are usually smartphones

demands device management

20
Q

three basic core competencies that all organizations need from an EMM solution:

A
  • Visibility – understanding what’s running on mobile devices is
    the key to discovering potential risks and adhering to
    compliance policies
  • Secure access – providing the ability for mobile users to
    securely authenticate and authorize access to apps and data
  • Data protection – offering dynamic antimalware and data loss
    prevention (DLP) capabilities to help limit the risk of attacks and
    data breaches
21
Q

sandboxing ( partitioning
or compartmentalization)

A

These techniques involve orchestrating the
packaging, isolation, and encapsulation of
apps and work data in a separate segmented
user space within the device

22
Q

Storage sandboxing (segmentation)

A

comprises
partitioning various types of data on devices
to protect IP, personally identifiable
information (PII), and protected health
information (PHI) and support DLP initiatives

23
Q

WPA2 (info)

A

Wi-Fi Protected Access 2 (WPA2) was the replacement for WPA (2004)

All devices required testing and certification from Wi-Fi Alliance (2006)
* It uses Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) for security
* WPA2 supports pre-shared key (PSK) and enterprise authentication
* Management Frame Protection (MFP) was optional but highly recommended

24
Q

WPA3

A
  • The Wi-Fi Alliance announced this new security protocol in 2018, with WPA3 support becoming mandatory for all routers carrying the Wi-Fi Certified label since July 2020
  • All WPA3 networks use the latest security methods, disallow outdated legacy protocols, and require the
    use of Protected Management Frames (PMF)

*Authenticated encryption – GCMP-256

25
Q

Protected Management Frames (PMF)

A
  • PMF enhances privacy protections already in place for data frames with mechanisms to improve the
    resiliency of mission-critical networks
26
Q

RADIUS

A

network protocol and a server client architecture widely used for centralizing authentication, authorization and accounting(AAA) functions in corporate networks

27
Q

application security

A

validation testing
functionality testing
secure cookies
code signing

28
Q

validation testing

A
  • Validation testing is the process of ensuring that the tested and
    developed software application or mobile app fulfills the needs
    of the customer:
  • The business requirement logic or use cases must be tested in full
    detail
  • All the critical functionalities of an application must be tested here
  • It is critical to know how to verify the business logic that is
    provided:
  • A common technique is input validation which ensures only
    properly formed data is entering the workflow in an information
    system
29
Q

Design
qualification
(DQ)

A

Defines the functional and operational specification of the instrument and
details the conscious decision in the selection of the supplier

30
Q

Installation
qualification
(IQ)

A

Establishes that the instrument is received as designed and specified, that it
is properly installed in the selected environment, and that this environment
is suitable for the operation of the instrument

31
Q

Operational
qualification
(OQ)

A

The process of demonstrating that an instrument will function according to
the operational specification in the selected environment

32
Q

Performance
qualification
(PQ)

A

The process of demonstrating that an instrument performs according to a specification appropriate for its routine use

33
Q

secure cookies

A
  • HTTP cookies are small packets of data stored
    in a browser client
  • This data may contain sensitive data like
    passwords or user information and is therefore
    vulnerable for attacks
  • To limit vulnerability, developers can enhance
    cookie security by adding specific attributes to
    the set cookies, making it difficult for attackers
    to manipulate
34
Q

method for securing cookies

A
  • Really Simple Secure Sockets Layer (SSL) uses the
    HttpOnly, secure, and use_only_cookies parameters
    to make cookies more secure:
  • The HttpOnly flag will tell the browser that this
    cookie can only be accessed by the server
  • The secure parameter will make sure cookies are only
    sent over a secure SSL connection
  • The use_only_cookies parameter will tell your
    website to use only cookies to store session data
35
Q

Static application security testing (SAST)

A

commonly defined as a clear-box (know all) test, where an analysis of the application source code, byte code, and binaries is carried
out by the application test without executing the code

36
Q

what is Static application security testing (SAST) used for?

A
  • It is used to find coding errors and omissions that are symptomatic of security vulnerabilities
  • SAST is often used as a test method when the tool is under development – earlier in the
    development life cycle
  • It can be used to find SQL injection attacks,
    cross-site scripting errors, buffer overflows,
    unhandled error conditions, and probable
    back doors into the application
37
Q

Dynamic application security testing (DAST)

A

considered an opaque (know nothing) test
where the tool must find distinct execution
paths in the application being analyzed

38
Q

what is Dynamic application security testing (DAST) used for?

A

Unlike SAST, which analyzes code that is not
running, DAST is used against applications in
their running state
* It is primarily considered effective when testing exposed HTTP and HTML interfaces of web applications
* Static and dynamic application tests work in concert to improve the reliability of applications being built and bought by organizations

39
Q

acquisition/procurement (info)

A

process involves
possible assignment of ownership, custodians,
and/or stewards
* The labeling or tagging schema will be applied
* Classification and sensitivity levels are attached
* The accounting methodology will be
implemented which may include
* RADIUS/DIAMETER/LDAPS
* Automated and integrated inventory engines
* Integration with directory services,
configuration management database, human
resources, and legal

comptia + (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions