Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comptia + > 4.2 > Flashcards

4.2 Flashcards

1
Q

Monitoring and visibility is a critical aspect of

A

hardened security and zero trust initiatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

All types of systems must be monitored including:

A
  • Corporate LAN endpoint devices
  • Web, email, productivity, and other application
    servers (i.e., SharePoint)
  • Voice over Internet Protocol (VoIP), messaging, and
    conferencing services
  • Databases and storage area networks
  • Infrastructure devices
  • Customer premises edge
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what do Network monitoring tools enhance?

A

enhance visibility into system health by offering real-time information about various wired, wireless, and
cloud-based components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This suite of tools utilizes two techniques to capture performance
metrics from assorted infrastructure and security devices – both physical and virtual:

A

*Agent-based monitoring
* Agentless monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Agent-based monitoring

A

leverages lightweight software, known as a monitoring agent, on the devices or virtual machine to track the uptime and performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Agentless monitoring

A

uses special application programming interfaces
(APIs) or integrated code to track the health of the devices

a less intrusive way to
achieve visibility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

agent based monitoring example

A

*A prototypical example of agent-based monitoring is using Simple Network Management Protocol
version 2C and 3 agents on infrastructure devices to send traps and informs to SNMP management
stations
*In cloud computing environments, special agents can be embedded into virtual machine instances
or installed on instantiated virtual servers to perform various system management activities

*slowed system down

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Agentless monitoring (info)

A

*It typically utilizes application-specific APIs and different network protocols (such as SNMP and
Windows Management Interface -WMI) to discern the overall performance of on-site and cloud-based assets, such as servers and applications
* This monitoring method does not involve the overhead of installing, tuning, and updating dedicated or third-party monitoring agents on every component
* This may be considered easier than the traditional agent-based approach

less intrusive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Log aggregation

A

the process of accumulating,
categorizing, standardizing, and consolidating log
data from across an IT infrastructure to enable and
enhance streamlined log analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what happens without Log aggregation?

A

administrators and
engineers would have to manually organize, deduplicate, and search through log data from various sources to generate meaningful metrics and information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Log aggregation goals

A
  • Replicating log files to a centralized location
  • Collecting Syslog, auditd, and other traps
  • Supporting automated pipelines and workflows
  • Parsing key-value pairs
  • Performing more complex transformations such as
    multiline log aggregation, tokenization, scrubbing,
    or masking sensitive data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

alerting

A

m delivers metrics and alarms
from various tools and systems to admins and
security operators for informational/event
notifications, incident management, and optimization of the wider ecosystem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what do alerting systems help ensure?

A

that event
responses are quick and efficient so that the odds of overlooked actions are reduced

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The Security Content Automation
Protocol (SCAP)

A

a synthesis of interoperable
specifications derived from community ideas.
Community participation is a great strength for SCAP,
because the security automation community ensures
the broadest possible range of use cases is reflected in
SCAP functionality

compliance more achievable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

importance of SCAP

A

Improves cybersecurity posture
Streamlines vulnerability evaluation
Simplifies compliance
Makes software deployments easy
Boosts cybersecurity collaboration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

SCAP specifications

A

Asset Identification
Asset Reporting Format (ARF)
Common Platform Enumeration (CPE)
Open Vulnerability Assessment Language (OVAL)
Open Checklist Interactive Language (OCIL)
Trust Model for Security Automation Data (TMSAD)
Extensible Configuration Checklist Description Format
(XCCDF)
Software Identification (SWID) Tagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Asset Identification

A

an important role in an
organization’s ability to quickly correlate different
sets of information about assets

18
Q

Asset Reporting Format (ARF)

A

a data model to express the transport format of
information about assets, and the relationships between assets and reports

19
Q

Common Platform Enumeration (CPE)

A

a standardized
method of describing and identifying classes of applications,
operating systems, and hardware devices present among an
enterprise’s computing assets

20
Q

Open Vulnerability Assessment Language (OVAL)

A

an information security community effort to standardize how to
assess and report upon the machine state of computer systems

21
Q

Open Checklist Interactive Language (OCIL)

A

a framework for expressing a set of questions to be presented to a
user and corresponding procedures to interpret responses to
these questions

22
Q

Trust Model for Security Automation Data (TMSAD)

A

describes
a common trust model that can be applied to specifications
within the security automation domain, such as SCAP

23
Q

Extensible Configuration Checklist Description Format
(XCCDF)

A

is a specification language for writing security
checklists, benchmarks, and related kinds of documents

24
Q

Software Identification (SWID) Tagging

A

allows for the proper
management of software inventories of managed devices in
support of higher-level business, information technology, and
cybersecurity functions

25
Q

Security information and event management (SIEM)

A

is a solution that helps enterprises detect, analyze, and
respond to security threats before they affect
business operations

26
Q

Security information and event management (SIEM) is a combination of?

A

security information
management (SIM) and security event management
(SEM) into a unified security management system

27
Q

SIEM technology gathers?

A

event log data from a
range of sources and recognizes activity that diverges from the norm in real-time

28
Q

benefits of SIEM systems

A

*A centralized look at potential threats
*Advanced threat intelligence
*Regulatory compliance auditing and reporting
*Enhancing transparency into users, applications, and devices

29
Q

Security orchestration, automation, and response (SOAR)

A

an assortment of software services and tools that
allow organizations to simplify and aggregate
security operations in three core areas

30
Q

Security orchestration, automation, and response (SOAR) 3 core areas:

A
  • Threat and vulnerability management
  • Incident response
  • Security operations automation
31
Q

Security automation involves:

A

performing security
related tasks without the need for human intervention

  • Can be defensive detection, response, and
    remediation, or offensive vulnerability assessment
    and penetration testing
32
Q

Antivirus software

A

intended to protect computers
and mobile devices from exploits, malware,
crackers, and cybercriminals

33
Q

antivirus systems examine:

A

data on hard drives, memory,
and incoming packets from the Internet (websites,
email messages, attachments, and applications) to
recognize, block, and offer ongoing protection
against malicious software, infected links, and other
threats and suspicious activity

34
Q

Antivirus software functions by:

A

regularly scanning
all devices to discover and block known worms and
viruses as well as new and emerging malware
variants

35
Q

heuristic rules

A

human driven but also a machine learning tool

36
Q

Antivirus forms of detection:

A
  • Signature detection
  • Heuristic detection of files
  • Multicriteria analysis (MCA) – uses the data from other detection
    methods to flag a file as possibly dangerous
  • Sandbox and cloud analysis
  • Intrusion prevention via host intrusion prevention system (HIPS)
  • Anti-spam
  • Ransomware protection
37
Q

Data loss prevention (DLP)

A

a security initiative that
recognizes and mitigates unsafe or unauthorized
sharing, transfer, or use of sensitive data such as
personally identifiable information (PII) and
protected health information (PHI)

38
Q

DLP engines and services can help organizations with:

A

monitoring and protection of sensitive information
across on-premises systems, cloud-based locations,
and endpoint devices

It also assists with compliance for regulations such as
the Health Insurance Portability and Accountability
Act (HIPAA) and General Data Protection Regulation
(GDPR)

39
Q

Simple Network Management Protocol (SNMP)

A

a powerful
protocol and toolset that facilitates the sharing of
information among various devices on a network,
regardless of their hardware or software

40
Q

SNMP uses a basic client-server architecture using:

A
  • Managers collect and process information about
    devices on the network
  • Clients, called agents, are any type of device or
    device component connected to the network
41
Q

netflow

A

a network monitoring protocol, developed by Cisco,
invented to capture metrics about the volume and types of traffic
traversing a network device

42
Q

Technically, a flow is defined by its 5-tuple, a collection of five data
points:

A
  • The source and destination IP addresses exchange information
  • The source and destination ports, if any (ICMP, for example, doesn’t use ports)
  • The protocol

comptia + (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions