Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ 601 > 4.0 Flashcards > Flashcards

4.0 Flashcards

1
Q

Volatile

A

Temporary memory or data that is lost when power is turned off or the system is restarted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

COOP

A

Continuity of Operations Planning
Process ensuring essential functions continue during and after disasters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Stakeholder Management

A

Engaging with individuals/groups that have an interest in a process or the outcome of a process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Communication Plan

A

Provides direction on how to communicate issues related to an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Tabletop Exercise

A

A discussion-based exercise where participants sit around a table and talk through one or more scenarios, such as a cyberattack or a natural disaster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

nmap

A

Network scanning tool for discovering hosts, services, and network information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

openssl

A

Open-source library for secure communication and cryptographic protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

grep

A

Command-line utility for searching text or patterns within files using regular expressions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

curl

A

Command-line tool for transferring data with URLs, supporting various protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Head

A

Beginning or top part of a file or data stream, often used to display initial content.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Tail

A

Command-line utility displaying the last part of a file or data stream, often used for real-time log monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Scanless

A

command-line utility to perform port scans without active probing, aiming to avoid detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Reconstitution

A

Process of restoring systems/data to their original/functional state after a disruption or incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Precursors

A

Early indicators or warning signs preceding an event, used in identifying potential threats or vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

tracert

A

Command-line tool tracing data packet routes from source to destination, showing intermediate hops and response times.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

netstat

A

Command-line utility displaying open network connections, routing tables, and interface statistics on a computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

dig

A

Command-line tool querying DNS servers for domain information, IP addresses, DNS records, and name servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

netcat

A

Command-line networking utility establishing TCP/UDP connections, sending/receiving data, and performing port scanning.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

hping

A

Command-line utility for network packet manipulation and analysis, including sending custom packets like TCP, UDP, and ICMP packets from scratch and sending ping request with TCP, UDP packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ipconfig/ifconfig

A

ipconfig-Displays network configuration information.
ifconfig-Displays and configures network interfaces.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

ping

A

Sends echo requests to a designated machine to determine if communication is possible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

netcat

A

Command-line utility for networking tasks such as creating TCP or UDP connections, port scanning, transferring files, and debugging network protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ARP command

A

Allows a system administrator the ability to see and manipulate the ARP cache on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cuckoo

A

A sandbox used for malware analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Dnsenum

A

Command-line utility for DNS enumeration and information gathering, including querying DNS records, identifying subdomains, and discovering DNS zone transfers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

route

A

Command-line utility to provide information on current routing parameters. Used to view and manipulate the IP routing table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Sn1per

A

an automated scanner designed to collect a large amount of information while scanning for vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

chmod

A

A Linux command used to change access permissions of a file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

logger

A

Command-line utility for logging messages to system logs, allowing users to record events, errors, and informational messages for troubleshooting and monitoring purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

PowerShell

A

Microsoft Windows-based task automation and configuration management framework, consisting of a command-line shell and scripting language.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

dd

A

Data Dump
Command-line utility for data duplication, conversion, and manipulation, commonly used for creating disk images, copying data between devices, and performing low-level data operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

WinHex

A

Software for hexadecimal editing, disk editing, and data recovery on Windows systems, offering tools for analyzing and manipulating binary data, disk structures, and file systems at a low level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

FTK Imager

A

Forensic software for acquiring and analyzing digital evidence, including imaging drives, extracting data, and examining file systems, used in forensic investigations and data recovery tasks.

34
Q

Tcpreplay

A

As a suite, tcpreplay is a group of free, open source utilities for editing and replaying previously captured network traffic.
As a tool, it specifically replays a PCAP file on a network.

35
Q

tcpdump

A

Command-line packet analyzer for capturing and displaying network packets in real time, enabling users to monitor network traffic, filter packets based on criteria, and troubleshoot network issues.

36
Q

theHarvester

A

A useful tool for exploring what is publicly available about your organization on the web such as it can provide information on employees, e-mails, and subdomains. It performs open source intelligence (OSINT) gathering to help determine
a domain’s external threat landscape. The tool gathers names, emails, IPs, subdomains, and URLs by using multiple public resources

37
Q

Preparation

A

The phase of incident response that occurs before a specific incident.

38
Q

Identification

A

isthe process where a team member suspects that a problem is bigger than an isolated incident and notifies the incident response team for further investigation.

39
Q

Containment

A

The set of actions taken to constrain the incident to a minimal number of machines.

40
Q

Recovery

A

is the process of returning the asset into the business function and restoring normal business operations.

41
Q

Eradication

A

Involves removing the problem, and in today’s complex system environment, this may mean rebuilding a clean machine.

42
Q

Lessons learned

A

document what went wrong and allowed the incident to occur in the first place. Then examine the incident response process itself.

43
Q

Walkthroughs

A

Examine the actual steps that take place associated with a process, procedure, or event.

44
Q

Simulations

A

Allow personnel to go through the actual steps of an exercise but to perform response and recovery steps rather than just talk about them.

45
Q

MITRE ATT&CK framework

A

A comprehensive matrix of attack elements, including the tactics and techniques used by attackers on a system.

46
Q

Diamond Model of Intrusion Analysis

A

A cognitive model used by the threat intelligence community to describe a specific event

47
Q

Cyber Kill Chain

A

A framework used to defend against the chain of events an attacker takes, from the beginning of an attack to the end of an attack.

48
Q

DRP

A

Disaster Recovery Plan
The data and resources necessary, and the steps required to restore critical organizational processes.

49
Q

BCP

A

Business Continuity Plan
Describes what is needed in order for the business to continue to operate

50
Q

Data retention policy

A

Identifies how long data is retained, and sometimes specifies where it is stored.

51
Q

Sensors

A

Agents placed on systems throughout a network to collect logs from devices and send these logs to the SIEM system.

52
Q

Metadata

A

Data about data instead of the data itself; Information that describes other data.

53
Q

NetFlow

A

A feature available on many routers and switches that can collect IP traffic statistics and send them to a NetFlow collector. Useful for intrusions.

54
Q

Protocol analyzer

A

A piece of software or an integrated software/hardware system that can capture and decode network traffic.

55
Q

Dump files

A

are copies of what was in memory at a point in time—typically a point when some failure occurred

56
Q

The Session Initiation Protocol (SIP)

A

A text-based protocol used for signaling voice, video, and messaging applications over IP.
UDP port 5060

57
Q

Syslog

A

System Logging Protocol
A standard protocol used in Linux systems to send system log or event messages to a specific server, called a syslog server.

58
Q

Journalctl

A

The command to examine logs on a server.

59
Q

Non-repudiation

A

A situation where a statement’s author cannot successfully dispute its authorship or the validity of an associated contract.

60
Q

Checksums

A

a small piece of data, sometimes only 1 or 2 bits, and is used to quickly verify the integrity of data. The purpose of detecting errors that may have been introduced during its transmission or storage.

61
Q

Provenance

A

Tracing something back to its origin, a reference to the origin of data.

62
Q

Exploitation frameworks

A

Tools for discovering, developing, and executing exploits. Penetration testing, security research, and sometimes malicious activities.

Popular Frameworks: Metasploit, Core Impact, Canvas, Exploit Pack.

63
Q

Data sanitization

A

The process of deliberately, permanently, and irreversibly removing or destroying data stored on a memory device to ensure that it cannot be recovered.

64
Q

Sensitivity

A

Can monitor PII, PHI, and other sensitive information to ensure regulatory compliance (HIPAA, PCI DSS, GDPR)

65
Q

Trends

A

Can identify trends in network traffic, event volume, or changes in activities/ activity levels across identities, endpoints, network and infrastructure.

66
Q

Alerts

A

Provide information about events on hosts and network devices. Email notification and response automation (playbooks, SOAR) optional.

67
Q

Correlation

A

Correlates, aggregates, and analyzes the log files from multiple sources can generate a broad, centralized view.

68
Q

Bandwidth monitors

A

Tools that monitor and analyze network bandwidth usage to track data transfer rates, identify bottlenecks, and ensure efficient network performance.

69
Q

NXLog

A

A multi-platform log collection and processing tool that can gather logs from different sources, process them, and forward them to various destinations.

70
Q

Sflow

A

A packet sampling protocol that provides a scalable method of monitoring network traffic across high-speed networks.

71
Q

IPFIX

A

IP Flow Information Export
A protocol standardized by the IETF for exporting IP flow information from routers, switches, and other network devices.

72
Q

Legal hold

A

protecting any documents that can be used in evidence from being altered or destroyed. sometimes called litigation hold

73
Q

Admissibility Evidence

A

Evidence must be relevant to a fact at issue in the case.

74
Q

Time offset

A

where evidence is collected across multiple time zones, you must record offset based on time zone.

75
Q

Swap/pagefile

A

A space on a hard drive used as the virtual memory extension of a computer’s RAM.

76
Q

Cache

A

A small, high-speed storage layer that holds frequently accessed data to speed up future requests.

77
Q

Right-to-audit clauses

A

Written into supply chain contracts, allow an auditor can visit the premises to inspect and ensure that the contractor is complying with contractual obligations.

78
Q

Tags

A

Are virtual ‘sticky notes’ or labels attached to documents, making them easier to search/find.

79
Q

Strategic intelligence/
counterintelligence

A

Information that is vital for formulating and implementing policies, strategies, and decisions, often related to national security, defense, or business strategies.

80
Q

E-discovery

A

The process of identifying, collecting, and producing electronically stored information (ESI) in response to a request for production in a lawsuit or investigation.

Just gathering, no analyzation.

CompTIA Security+ 601 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions