Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comptia + > 5.1/5.2 > Flashcards

5.1/5.2 Flashcards

1
Q

automation

A

involves generating a single task to run automatically without any human intervention

Automation could involve sending alerts to a security
information and event management (SIEM) system,
dynamically triggering a serverless function at a cloud
provider, or adding a record to a database when a
batch job is run

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Orchestration

A

involves managing several or many
automated tasks or processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

orchestration (info)

A

As opposed to focusing on one task, orchestration combines all the individual tasks

Orchestration occurs with various technologies, applications, containers, datasets, middleware,
systems, and more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

User and resource provisioning

A

Most modern
enterprises have tightly integrated Joiner and Mover
onboarding and provisioning processes that involve
automation between human resources, legal,
directory services, identity management (IdM), and
inventory engines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Guardrails

A

Cloud providers use JSON policies and Infrastructure as Code (IaC) to enforce least privilege policies and separation of duties to remove
certain application programming interface (API) calls from privileged groups and users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security group firewalls

A

are layer 3/5 stateful packet
filters applied to either subnets or virtual instances
in hypervisors or cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Ticket creation and escalation

A

as part of a service
desk deployment will run scripts and automated
workflow:
* Software-defined networks (SD-LAN, SD-WAN, SDMAN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

benefits of automation

A
  • Efficiency and productivity
  • Time savings
  • Enforcing baselines
  • Standard infrastructure configurations
  • Secure scalability
  • Employee retention
  • Reaction time
  • Force multiplier
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

single point of failure (SPOF)

A

is a flaw in the design, configuration, or implementation
of the automation solution:
* If the automation solution is not redundant and
reliable, one loses the overall benefits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

goals of incident response

A

Prevent the spread
Reduce the immediate impact
Protect and maintain ongoing operations
Support forensics, e-discovery, and
continuity of operations
Provide after-action reports and lessons learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

readication

A

Potentially unwanted programs (PUPs) can be eradicated by
advanced antivirus and antimalware suites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

testing incident response

A

Plan review (read-through)
Tabletop
Walk-through (exercise)
Simulation
Parallel
Full interruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Plan review (read-through):

A
  • Group discussion, plan auditing, and Delphi and
    brainstorming sessions with stakeholders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tabletop:

A
  • Documented plans, diagrams, and logical
    and virtual walk-throughs to eliminate gaps/errors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Walk-through (exercise):

A
  • Planned rehearsals and drills
  • Performed in stages and by department/building only
  • Should find additional gaps to those found during
    plan review and tabletop exercises
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Simulation:

A
  • Focus on specific scenarios and areas
  • Use real business continuity plan (BCP) and disaster
    recovery plan (DRP) resources (recovery sites)
    and teams (swarm simulations)
  • Test snapshot recovery and hot spares
  • May be the highest-level test that most
    organizations conduct
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Parallel:

A
  • Conduct a real-world drill while still operating
    business
  • Is more resource-intensive than simulations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Full interruption:

A
  • Conduct real-world drill while ceasing business
    activities
  • Is cost-prohibitive for most organizations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Root cause analysis (RCA)

A

defined as a collective term that describes a wide range of approaches, tools, and techniques
used to uncover causes of problems

a function of the Problem Management IT
service practice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

root cause

A

is defined as a factor that introduced a non-conformance in an application, service, or
system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RCA steps

A

define the problem
collect data
identify possible causal factors
identify the root causes
recommend and implement solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

threat hunters

A

aka “hunt teams”

Involve groups of cyber investigators aggressively
seeking out threats on a network or system

Are often compliance or regulatory auditors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

cyber kill chain

A

the succession of steps and phases used during a structured external or internal cyberattack

It is used by penetration testers and threat-hunting teams to better understand advanced persistent threats from exploits and malware attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

why perform digital forensics?

A
  • Laws have been violated
  • Organizational policies have been violated
  • Systems have been attacked
  • Data and identity have been breached
  • Intellectual property has been exfiltrated
  • Privileged insiders are suspected of crimes
  • It is the next incident response phase (root cause
    analysis/problem management)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

E-discovery

A

is innovative technology that has
emerged over the last decade to lower the risks and costs associated with big data, especially in litigation
and internal corporate and government investigations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

The e-discovery process includes four phases:

A
  • Identifying and collecting documents
  • Sorting through data by relevance
  • Creating production sets
  • Managing data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

order of volatility

A
  1. CPU and its cache
  2. Kernel statistics, tables, and caches
  3. Memory (RAM)
  4. Temporary file systems and swap/slack space
  5. Disk drives and volumes
  6. Attached removable drives
  7. Logged data to a remote location
  8. Copies of data to archived media/cloud
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

processing forensic evidence

A
  • Detect encrypted files and volumes
  • Discover compressed files and folders
  • Perform validation and pattern matching
  • Leverage regular expressions and metacharacters in forensic kits
  • Filter for suspected user data
  • Filter security identifiers (SIDs) on shared systems for privacy reasons
  • Perform discovery of hidden data in slack space
  • Extract only meaningful data
  • Conduct traces and calibrated estimates to determine suspect(s)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

chain of custody

A

ensures that the integrity of collected evidence remains intact in its original state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

two important things of chain custody:

A

date and time the evidence is collected and the location of artifacts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

chain of custody involves:

A

strict procedures for collecting,
handling, and tagging evidence

Provides a history and timeline of
evidence handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

chain of custody maintains, provides and prohibits what?

A
  • Maintains evidence integrity
  • Provides accountability
  • Prohibits tampering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

legal hold

A

a process that an organization uses
to retain all forms of pertinent data and information when it reasonably expects some type of litigation against it, or some need for future utility in a court of law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

forensic reporting

A

Should have as much information as necessary but not a “data overload”

May need to express in simpler terms or have different reports for different target audiences
* Provide electronic and physical documents of all findings
* Meet with proper authorities and possibly prepare to offer expert testimony
* Provide any needed clarification
* Identify overall impact on business and recommend any countermeasures
* Answer who, what, when, and how – important for court and other proceedings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

data source logs

A

firewall
application
endpoint
OS-specific
IPS/IDS
network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

firewall

A

can provide traffic data in layer 2
frames up to deep packet application inspection
using different outputs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

application

A

for email, web, SharePoint, file,
directory, database servers, and more

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

endpoint

A

such as Palo Alto Cortex XDR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

OS-specific

A

security logs from Windows, UNIX,
Linux, macOS, Solaris

40
Q

IPS/IDS

A

logs, alerts, dumps, traps, informs

41
Q

network

A

from infrastructure device, security
appliances, database activity monitors, and more

42
Q

SOAR allows organizations to simplify and aggregate
security operations in three core areas:

A
  • Threat and vulnerability management
  • Incident response
  • Security operations automation
43
Q

Security automation involves:

A

performing securityrelated tasks without the need for human
intervention

  • It includes defensive detection, response, and
    remediation, or offensive vulnerability assessment
    and penetration testing
44
Q

These categories are then mapped to three types of playbooks for SOAR:

A
  • Manual (series of manual tasks)
  • Semi-automated (hybrid of automated and manual subtasks)
  • Fully-automated (completely automated)
45
Q

(SOAR) Four types of automation:

A
  • Defensive (anything that tries to prevent the threat or risk)
  • Forensic (anything that tries to retrieve additional evidence)
  • Offensive (anything proactive that tries to investigate an asset)
  • Deception (anything that retrieves or adjusts deception tools)
46
Q

(SOAR) Three different categories of action:

A
  • Enrichment (adding additional configuration management database
    (CMDB) or environment data)
  • Escalation (email, ticket escalation, Simple Notification Service (SNS),
    chat/messaging communication)
  • Mitigation (the modification of device configuration)
47
Q

security practitioner

A

must align all security
functions to a business’s strategy, value proposition, charters, goals, mission, and objectives

This alignment must permeate through all organizational processes including governance, steering committee charters, and corporate
initiatives to name a few

48
Q

Security governance typically focuses on three
attributes or characteristics:

A
  • Authority
  • Decision-making
  • Accountability
49
Q

Security governance

A

as the rules
that protect the assets and continuity of an
organization

It includes mission statements, charters, declarations of value propositions, policies, standards, and procedures

50
Q

Security governance activities

A
  • Creating a risk register (ledger)
  • Aligning security strategy with organizational goals
  • Publishing all compliance and regulatory requirements
  • Performing a vital role in risk assessment and management:
  • Offering guidance into acquiring security controls to reduce risk
  • Tracking and recording all compliance and remediation initiatives
  • Documenting stakeholder interactions and reporting related
    workflows
51
Q

centralized governance

A

the higher positions of
management, such as executives and/or the C-suite,
hold the decision-making authority:

  • It relies heavily on top-down decision-making
52
Q

decentralized governance

A

management distributes the decision-making authority throughout the organization:

  • Decisions are made closer to the source of action and information
  • It is used in flatter, more projectized organizations
53
Q

Board governance defines the roles and
responsibilities of board members and executives in
the form of a:

A
  • Working board
  • Governing board
  • Advisory board
54
Q

board of directors (BOD)

A

the governing body of an organization or company, whose members are
elected by shareholders (in the case of public
companies)

** Every public company must have a board of directors

55
Q

The duties of the board of directors include:

A

setting strategy, overseeing executive management, and protecting the interests
of shareholders, bondholders, and other
stakeholders

56
Q

steering committee

A

a group of key
organizational stakeholders that makes determinations regarding an organization’s priorities
or order of business, and manages its operations
general counsel

57
Q

goal of a steering committee is to:

A

oversee and
support a project from the management level

58
Q

Information Security Committee exists to:

A

offer recommendations to executive management and
team leads concerning security efforts undertaken

59
Q

Cybersecurity and Infrastructure Security Agency (CISA)

A

leads the national effort to understand, manage, and reduce risk to
our cyber and physical infrastructure

60
Q

United States Customs and Border Protection (CBP)

A

has the
mission to keep terrorists and their weapons out of the U.S.
along with securing trade and travel while enforcing regulations,
including immigration and drug laws

61
Q

Office of Homeland Security Situational Awareness (OSA)

A

provides operations coordination, information sharing,
situational awareness, common operating picture, and executes
the DHS Secretary’s responsibilities across the homeland
security enterprise

62
Q

Office of Intelligence and Analysis (I&A)

A

assists the Homeland
Security Enterprise with the timely intelligence and information
it needs to keep the homeland safe, secure, and resilient

63
Q

Physical and logical asset owners may:

A
  • Determine the classification level
  • Conduct labeling and tagging
  • Grant additional shares and rights
64
Q

Custodians (controllers)

A
  • They should maintain the assets from a technical and operational perspective
  • Custodians often interact directly with owner stakeholders and answer to executive managers (C-suite)
    responsible for
65
Q

custodians often responsible for:

A

ensuring confidentiality,
integrity, authenticity, availability and non-repudiation of assets

66
Q

stewards

A
  • Will manage assets from a business perspective
  • May interface with other departments such as legal,
    human resources, mobile application, and digital asset managers
  • Are more likely to deal directly with internal and external customers and stakeholders
67
Q

stewards ensure:

A

compliance (standards and controls)
and data quality

68
Q

officers are responsible for:

A

due diligence and adherence to
security governance

  • They will often answer to steering committees and various boards
    such as the BOD
69
Q

Regulatory compliance

A

describes the actions an organization takes to comply with those rules and policies as part of its operations

70
Q

best practices and guidelines are

A

e like standards, but
are more flexible and not usually mandatory

71
Q

standards allow:

A

information technology staff to
be consistent and systematic

72
Q

Standards specify:

A

use of specific technologies
in a uniform way, because no one individual
practitioner can know everything

73
Q

standards help to provide:

A

consistency in the enterprise,
because it is unreasonable to support multiple
versions of hardware and software unless
necessary

usually mandatory

74
Q

policies establish:

A

a general framework within which to work and a guiding direction to take in the future

75
Q

The function of a policy is to:

A

classify guiding
principles, direct behavior, and offer stakeholder
guidance and a security control implementation
roadmap

76
Q

Sanctioned policy:

A
  • The policy has the support of executive
    management
  • It requires visible participation and action,
    ongoing communication and championing,
    investment, and prioritization
77
Q

Applicable policy:

A
  • The policy is applicable to the organization
  • Strategically, the information security policy must support the guiding principles and goals of the organization
  • Tactically, it must be relevant to those who must comply
78
Q

Realistic policy:

A
  • The policy can be effectively executed
  • Policies must represent the actual environment in
    which they will be deployed
  • Information security policies and procedures should only express what is achievable
  • If the policy is to advance the organization’s guiding
    principles, one can also assume that a positive
    outcome is anticipated
79
Q

A policy should never:

A

set up constituents for
failure but instead should offer a clear track for
success

80
Q

Flexible policy:

A
  • The policy can accommodate change and be adapted if necessary
  • An adaptable information security policy recognizes that information security is not a static, point-in-time endeavor, but rather an ongoing
    process designed to support the organizational mission
81
Q

Comprehensive policy:

A
  • The policy scope includes all relevant parties - it is inclusive
82
Q

An information security policy must consider:

A
  • Organization objectives
  • International law
  • Cultural norms of its employees
  • Business partners, suppliers, and customers
  • Environmental impacts
  • Global cyber threats
83
Q

Enforceable policy:

A
  • The policy is statutory and is enforced
  • Enforceable means that administrative, physical, or
    technical controls can be put in place to support the
    policy
  • Compliance can be measured and, if necessary,
    appropriate sanctions applied
84
Q

Enforcement stages should be well-documented:

A
  • Verbal reprimand
  • Written warning
  • Punitive actions
  • Temporary suspension
  • Permanent termination
  • Legal actions
85
Q

Standard and policy examples:

A
  • Password
  • Access control
  • Physical security
  • Encryption
  • Information security
  • Business continuity
  • Disaster recovery
  • Incident response
  • Software development life cycle (SDLC)
  • Change management
  • Acceptable Use Policy (AUP)
86
Q

Acceptable Use Policy (AUP)

A

Identifies how employees are expected to
use resources in the organization

87
Q

AUP defines rules of behavior/code of conduct:

A
  • Use proper and acceptable language
  • Avoid illegal activities
  • Avoid disturbing or disrupting other
    systems
  • Do not reveal personal information
  • Do not reveal confidential information
88
Q

Sample AUP categories

A
  • Mobile device policy
  • Virtual private network (VPN)/software-defined
    perimeter (SDP) usage
  • Operating systems and software
  • Social media
  • Removable media
  • Augmented reality
  • Personal cloud storage
  • Clean desk
89
Q

Procedures

A

usually required and are the lowest level of the policy chain

Procedure documents are longer and more
detailed than standards and guidelines documents

90
Q

Standard operating procedure (SOP)

A

Are step-by-step instructions that define how workers carry out routine tasks

91
Q

SOP can greatly improve:

A
  • Efficiency
  • Quality
  • Performance
  • Communication
  • Compliance with regulations
92
Q

SOP considerations

A

-Offer all the steps needed to complete the
process
-Describe the purpose and limits of
procedures
-Clarify concepts and terminology
-Consider health and safety issues
-List the location of all necessary supplemental resources

93
Q

change management practice (change control practice)

A

reduces risk in security
policy by delivering a systematic approach to assess and manage proposed and subsequent changes

94
Q

what three changes does change control practice help?

A
  • Normal changes (passwords)
  • Standard changes (lap tops replaced)
  • Emergency changes (RFC, service desk)
95
Q

what does change control practice assure?

A

that changes are carefully assessed for
possible impacts on project scope, schedule, and resources, allowing for informed decisions

96
Q

onboarding (provisioning)

A

Provides assets, guidance, knowledge, skills, and
behavior needed for associated job roles:

  • Videos, printed material, computer-based training
    (CBT), lectures, formal and informal meetings, and
    mentors

comptia + (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions