Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

casp > CASP > Flashcards

CASP Flashcards

1
Q

What is ISO 31000

A

A risk management framework.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What type of risk can you not eliminate?

A

Residual risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is residual risk?

A

Risk you cannot eliminate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are two ways to measure risk?

A

Qualitative and quantitative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which risk response is also included when risk mitigation is performed?

A

Acceptance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What describes the probability of a threat being realized?

A

Likelihood

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What describes the amount of loss during a one year timespan?

A

ALE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is risk appetite?

A

An assessment of what level of residual risk is tolerable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What describes the amount of residual risk that is tolerable to the organization?

A

Risk appetite.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the core functions of the NIST CSF?

A

NIST Cybersecurity Framework

Identify
Protect
Detect
Respond
Recover
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the required steps of the NIST RMF?

A

NIST Risk Management Framework Steps:

Prepare
Categorize
Select
Implement
Assess
Authorize
Monitor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the steps of the risk management life cycle?

A

Risk Management Lifecycle:

Identify
Assess
Control
Review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is risk tolerance?

A

The thresholds that separate different levels of risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Identify a popular risk framework.

A

NIST 800-37
COBIT
COSO
ISO 31000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What phase of the risk management life cycle identifies effective means by which identified risks can be reduce?

A

Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What phase of the risk management life cycle identifies risk items?

A

Identify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What phase of the risk management life cycle determines associated risk levels?

A

Assess

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What phase of the risk management life cycle determines if a risk level has changed?

A

Review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What should include detailed descriptions of the necessary steps to complete a task?

A

Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What function of NIST CSF defines capabilities needed for the timely discovery of security incidents?

A

Detect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What’s a formal mechanism for measuring performance of a program against desired goals?

A

KPI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What program demonstrates a cloud service providers adherence to security?

A

CSA STAR

Cloud Security Alliance, Security Trust and Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What standards were established by the AICPA to evaluate controls designed to protect technology and finance?

A

SOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the cybersecurity standards developed by the DoD?

A

CMMC

Cybersecurity Maturity Model Certification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which cloud represents the lowest amount of responsibility for the customer?

A

SaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What describes when a customer is completely dependent upon a vendor for products or services?

A

Vendor lock in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What describes when a copy of vendor-developed code is provided to a trusted third party?

A

Source code escrow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What describes all of the suppliers, vendors, and partners needed to deliver a final product?

A

Supply chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What type of data sanitization involves multiple block level overwrites?

A

Clear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What type of data sanitization is proof against all recovery techniques?

A

Purge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does “clearing” data do?

A

Multiple block level overwrites?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What does “purging” data do?

A

Best recovery, even against cleanroom and material analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is an attestation of compliance?

A

set of policies, contracts, and standards identified as essential in the agreement between two parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is a set of policies, contracts, and standards identified as essential in the agreement between two parties?

A

Attestation of compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the five levels of the CMMI?

A 
Initial
Managed
Defined
Quantitatively Managed
Optimizing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What’s a non regulatory agency in the US that establishes standards and best practices?

A

NIST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Describe the relationship between regulations and standards?

A

Regulations are lawful mandates that state a standard must be followed, while standards are a set of practices that can be implemented to fulfill a regulation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What regulation enforces rules for organizations related to the European Union?

A

GDPR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which US Federal law is designed to protect the privacy of children?

A

COPPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which process is designed to provide assurance that information systems are compliant with federal standards?

A

Certification and Accreditation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What describes the actions taken to ensure that a system continues to operate in a compliant way?

A

Continuous monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is authority to operate?

A

A formal letter of accreditation by a Certifying Authority upon successful review of an independent audit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are the phases of the certification and accreditation process?

A

Initiation and planning
Certification
Accreditation
Continuous monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is often referred to as the prudent man rule?

A

Due Care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is due care?

A

Prudent man rule

The reasonable and expected protections put in place to protect an asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is due diligence?

A

The ongoing and documented effort to continuously evaluate and improve asset protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is an MSA?

A

Master service agreement

Establishes an agreement between two entities to conduct business during a defined term.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is an NDA?

A

Non disclosure agreement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is an MOU?

A

Memorandum of understanding
A contract that can establish ROE between two parties.
Difficult to enforce
Formal means to define roles and expectations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is an ISA?

A

Interconnection security agreement

Rules for two entities to connect and share data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is an OLA?

A

Operational level agreement

Internal documents established to define the essential operational needs for it to meet its SLAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is a PLA?

A

Privacy level agreement

SLA but for data protection requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What describes the identification of applicable laws depending upon the location of the organization, data, or customer/subject?

A

Legal Jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What describes when an organization’s legal team receives notification to preserve electronic information?

A

Lit hold

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What type of agreement is often an umbrella contract that establishes the agreement between two entities to conduct business?

A

Master Service Agreement

MSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What agreement governs services that are both measurable and repeatable?

A

SLA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the steps of the NIST 800-34 for business continuity planning?

A

Develop the continuity planning policy statement
conduct the business impact analysis
identify preventive measures
create contingency strategies
develop an information systems contingency plan
ensure plan testing, training, and exercises
ensure plan maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the relationship between disaster recovery and business continuity plans?

A

Disaster recovery plans are focused on the immediate needs of a disaster and is a part of the business continuity plan which is broader and covers a longer time frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the last step in a business continuity plan?

A

Plan maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What can be described as an analysis of a system’s requirements, functions, and interdependence used to characterize system contingency requirements an dpriorities in the event of a disruption?

A

BIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What generally defines the amount of data that can be lost without irreparable harm?

A

RPO

Recovery Point Objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which type of assessment seeks to identify specific types of sensitive data?

A

PIA

Privacy impact assessmetnt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Using other locations to manage a disaster response is known as what?

A

Alternate site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What type of DR site has the lowest operating expense and complexity?

A

Cold site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Which site is one that can be activated and used within minutes?

A

Hot site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Which NIST publication has to do with incident response?

A

NIST 800-61

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is NIST 800-61?

A

Incident Handling Guide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are the types of DR tests?

A 
Checklist
Walkthrough
Tabletop
Parallel
Full Interruption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Which type of DR test is the most disruptive?

A

Full interruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Which type of DR test is a meeting to review the plans and analyze their effectiveness against various scenarios?

A

Walk through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Which type of DR test is used to determine whether all parties involved in the response know what to do and how to work together?

A

Tabletop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is a UTM?

A

Unified threat management - device or virtual appliance that provides multiple security services in a single solution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What types of services does a UTM typically offer?

A 
Content filtering
DLP
SPAM
Antivirus
Web filtering
firewall
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Describe non-transparent vs transparent proxy.

A

Non-transparent requires clients to be manually configured with the proxy server as a target.

Transparent intercepts client traffic without the client having to be reconfigured.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is a resource record set?

A

A package of resource records created by the authoritative DNS server signed by a zone signing key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

In DNS what is the difference between a zone signing key and a key signing key?

A

The zone signing key signs the resource record set, the key signing key signs the zone signing key so it can be easily revoked and re-established in case of compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is an API gateway?

A

a mechanism allowing software interfaces to be detached from the main application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is an XML gateway?

A

An interface gateway that does not allow the extensibility as an API gateway but allows processing and firewall like inspection. More secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What can be used to protect against DNS spoofing and DNS poisoning?

A

DNSSEC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What is the difference in NetFlow and sFlow?

A

Netflow packets in a transmission are aggregated into a flow and then exported for processing and analysis. sFlow is a sampling of packets and not a true aggregate of flows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What are the typical capabilities of a SIEM?

A 
Aggregation
Correlation
Alerting
Visibility
Compliance
Data Retention
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

What are the two main components of a VPN?

A

The creation of a network tunnel between endpoints and the protection of the data within.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What is the difference in L2TP and IPSec?

A

L2TP (layer two tunneling protocol) is the establishment of a vpn tunnel while IPSec is the encryption of the data within.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is a solution designed to validate an endpoint’s security before it gets onto the network?

A

Network access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What is a passive technology used to provide visibility into network traffic on a switch?

A

TAP

Test access port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What version of SNMP should be used?

A

v3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Why is a TAP preferable over a SPAN?

A

TAPs do not cause negative performance on the switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What type of networking is called east-west and is based upon policies established through SDN to limit traffic between workloads?

A

Microsegmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which NIST SP talks about Zero Trust?

A

NIST SP 800-207

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What is NIST 800-207?

A

Zero Trust Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

What are the planes in an SDN?

A

Control
Data
Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Which SDN plane controls where traffic should be switched?

A

Control Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Which SDN plane handles the actual switching and security?

A

Data Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Which SDN plane monitors traffic and network status?

A

Management Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Which type of environment is characterized by having hosts and networks available for use by visitors?

A

Guest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

What is a specially configured, highly hardened system for performing administrative tasks?

A

Jump box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What type of network segmentation differs from a traditional approach to provide higher security, granularity, and flexibility?

A

Microsegmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What network implementation creates an SDN by utilizing existing physical equipment?

A

SDN Overlay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What is vertical vs horizontal scaling?

A

Vertical scaling adds more power to an existing server, horizontal adds more servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is type 1 virtualization?

A

“bare metal” - installed directly to the hardware, esxi, hyperv

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

What is type 2 virtualization?

A

Installed to the OS - vmware player, virtual box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What describes improving performance by adding additional resources to an individual system?

A

Vertical scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

What describes improving performance by adding additional systems to distribute load?

A

Horizontal scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What leverages the global footprint of cloud platforms by distributing and replicating the components of a service?

A

CDN

Content delivery network

105
Q

What design strategy often conflicts with IT approaches that look to consolidate platforms and reduce product portfolios?

A

Diversity

106
Q

Which type of virtualization allows the client to either access an application hosted on a server or stream the application from the server to the client for local processing?

A

Application virtualization

107
Q

What is the set of automated tasks to be performed as part of a cloud deployment?

A

Bootstrapping

108
Q

Describe the three main types of VDI

A

Hosted - provided by a third party that manages the entire infrastructure.

Centralized - all VDI instances are hosted within the enterprise, when an instance is requested a new one is created

Synchronized - lets work continue in a disconnected state with a local copy of the VDI that is then synchronized back up

109
Q

What is the difference in application virtualization and VDI?

A

VDI is a virtualization of the entire desktop or endpoint experience. Application virtualization is limited to just one application and may be referred to as “clientless”.

110
Q

What are the extensions of service oriented architecture?

A

People
Process
Platform
Practice

111
Q

What are some functions that can be performed via a Container API?

A

List logs generated by an instance
issue commands to the running container
create, update, and delete containers
list capabilities

112
Q

What environment is used to merge code from multiple developers to a single master copy?

A

Test

113
Q

What describes middleware software designed to enable integration and communication between a wide variety of applications throughout an enterprise?

A

Enterprise service bus

114
Q

What is shadow IT?

A

IT systems deployed without the approval of centralized IT to work around shortcomings, requirements, or bottlenecks.

115
Q

What are the steps of the SDLC?

A 
Planning
Solution design
Coding
Testing
Release/ Deployment
116
Q

What is regression testing?

A

Evaluating whether changes in code have caused unintended bugs.

117
Q

What type of testing is to find issues where changes in code have caused previously working functions to fail?

A

Regression testing

118
Q

What type of testing involves pass/fail for one block of code?

A

Unit Test

119
Q

Which type of testing verifies that individual components of a system work together?

A

Integration testing

120
Q

Which development model includes phases that cascade with each phase only starting when the last finishes?

A

Waterfall

121
Q

What development model incorporates security as code and infrastructure as code?

A

SecDevOps

122
Q

What is the director services standard?

A

X.500

123
Q

How does kerberos work?

A

Clients request services from an application server, and both rely on an intermediary - the key distribution center.

User authenticates and is given a ticket granting ticket from the ticket granting server

This ticket granting ticket is used to request a ticket granting service

124
Q

What port does TACACS use?

A

49

125
Q

What is the certificate standard?

A

X.509v3

126
Q

What does OAuth provide?

A

Authorization, not authentication

127
Q

What is the port based network access control standard?

A

802.1x

128
Q

What is the device requesting access in network access control called?

A

Supplicant

129
Q

What is an HOTP?

A

HMAC based one time password. This is often what mfa fobs or smartphone authenticator apps use. They do not however have to expire.

130
Q

What is TOTP?

A

Time based one time password - a refinement of HOTP that forces each token to expire.

131
Q

In REST, what is a method to transfer claims between two parties?

A

JSON Web tokens which are signed and protected with a Message Authentication code, or encrypted

132
Q

When storing passwords, what method should not be used?

A

Encryption

133
Q

What is the term used to describe when credentials created and stored at an external provider are trusted for identification and authentication?

A

Federation

134
Q

Which access control is a modern, fine grained type of access control that uses XACML?

A

ABAC

Attribute based access control

135
Q

What authentication protocol is comparable to radius and used in Cisco devices

A

TACACS

136
Q

What authentication scheme uses an HMAC built from a shared secret plus a value derived from a device and server’s local timestamps?

A

TOTP

Time based one time password

137
Q

What is hardware root of trust?

A

Trust Anchor

Secure susbsystem that is able to provide attestation that the system hasn’t been changed.

138
Q

What is a TPM?

A

Trusted platform module

Hardware based storage of encryption keys, passwords, and other identification information.

139
Q

What is EAP?

A

extensible authentication protocol

provides a framework for deploying multiple types of authentication protocols and technologies

140
Q

What are the parts of OAuth.

A

Provider - the site that owns the data and the user account, such as Facebook or Google.

Resource Owner - the user with an account with a provider that can allow a client access to some part of their account.

Client - the site that wants to use some resource of the provider by getting permission and authorization from said provider. The client must be registered with the authorization server.

141
Q

What does SAML use for communication?

A

XML

142
Q

What does OAuth use for communication?

A

JSON

143
Q

What is the data lifecycle?

A 
Create
Store
Use
Archive
Destroy
144
Q

In which stage of the data life cycle is data shared using various mechanism such as email?

A

Use

145
Q

What are the parts of data management?

A

Inventory, mapping, and integrity management.

146
Q

What data obfuscation method replaces sensitive data with an irreversible value?

A

Tokenization

147
Q

What data obfuscation method is designed to protect PII so that it can be shared?

A

Anonymization

148
Q

What are the types of data obfuscation methods?

A 
Encryption
Format Conversion (encoding)
Tokenization
Scrubbing
Anonymization
149
Q

Which type of virtualization platform supports micro services and serverless architecture?

A

Containerization

150
Q

What is assigned to cloud resources through the use of tags?

A

Metadata

151
Q

Which type of cloud service model can be described as virtual machines and software running on a shared platform to save costs??

A

Multi-tenant

152
Q

What are four types of cloud storage models?

A

Object
File based
Block
Blob

153
Q

Which storage model typically supports cloud based applications needs to access documents, video, or image files?

A

Object

154
Q

Which storage model typically uses a traditional hierarchical system to store files by a path?

A

File-based

155
Q

Which storage model typically supports high performance, transactional applications such as databases?

A

Block

156
Q

Which storage model typically supports the storage of large amounts of unstructured data?

A

Blob

157
Q

What is blockchain?

A

An expanding list of transactional records which are secured using cryptography. Each block is hashed and the hash value of the previous block in the chain is included int he hash calculation of the next block which links them.

The ledger is distributed across a peer to peer network.

Every node has the ability to view every transaction.

158
Q

What is a system whereby multiple groups can calculate a function, but the function itself is only known by a single party?

A

Secure multi-party computation

MPC/SMPC

159
Q

Which technology is a ledger distributed across a p2p network?

A

blockchain

160
Q

What emulates a real life environment through computer generated sites and sounds?

A

Virtual reality

161
Q

What term describes computer generated images of a person that appear real?

A

deep fake

162
Q

What type of processing deconstructs knowledge into a series of smaller, simpler parts that can be interpreted?

A

Deep learning

163
Q

What type of computing uses information represented by spin properties and momentum of matter?

A

Quantum

164
Q

What kind of cert is used to identify a devices within an organization?

A

Trust certificate

165
Q

What is the current wifi standard to use?

A

WPA3

166
Q

What type of encryption does WPA2 use?

A

AES-CCMP

167
Q

What type of encryption does WPA3 use?

A

AES-GCMP

168
Q

What type of communication does NFC use?

A

RFID

169
Q

What is DoH?

A

DNS over HTTPS

Offers privacy between the user and the DNS server by encrypting the DNS requests

170
Q

What is sideloading?

A

Installing an apk file to android that’s not from the app store.

171
Q

What is a popular android unauthorized app store?

A

F-Droid

172
Q

What are two types of certificates commonly used to implement access controls for mobile devices?

A

Trust certificates, personal certificates

173
Q

Which standard is associated with Simultaneous authentication of equals?

A

WPA3

174
Q

Which device attack allows complete control of a device without the target being paired?

A

Blueborn attack

175
Q

What is the process of determining which additional software or scripts may be installed or run on a host beyond it baseline?

A

execution control

176
Q

What do BIOS and UEFI use?

A

BIOS uses the master boot record (MBR)

UEFI uses GUID partition table (GPT)

177
Q

What is secure boot?

A

secure boot is designed to prevent a computer from being hijacked by a malicious OS via digital certificates from valid OS vendors.

178
Q

What is measured boot?

A

uses platform configuration registers (PCRs) in the TPM at each stage in the boot process to check critical areas for change

179
Q

What modules does the secure boot attestation services?

A

NV-RAM which stores the OEMs secure boot info
signature database (db)
revoked signature database (dbx)
Key enrollment key (kek) database

180
Q

What is a hardware security module?

A

An HSM is a network appliance designed to perform centralized PKI for a network of devices. Can also be a plugin pcie card or usb connected.
Supposedly better than TPM.

181
Q

Which types of attacks on Android can bypass the protections of mandatory access control?

A

Interapp communication attacks

182
Q

Which control is designed to prevent a computer from being hijacked by a malicious OS?

A

Secure boot

183
Q

Which type of host protection should provide capabilities that directly align to the NIST cybersecurtiy framework core?

A

EDR

184
Q

What describes intentionally spreading data across different storage locations?

A

data dispersion

185
Q

What is bit splitting?

A

Aka cryptographic splitting

splitting encrypted data outputs into multiple parts which are subsequently stored in disparate storage locations and then encrypting the outputs a second time

186
Q

What are some FaaS?

A

functions as a service
AWS Lambda
Google Cloud Functions
Microsoft Azure functions

187
Q

What are some security concern with serverless computing?

A

ensuring that the clients accessing the services have not been compromised

entirely reliant on the service provider

188
Q

Which cloud computing practice eliminates the use of traditional virtual machines?

A

Serverless

189
Q

What is a critical component dictating the implementation of logging capabilities in the cloud?

A

Regulations

190
Q

What is an ASIC?

A

application specific integrated circuit, expensively designed single function system

191
Q

What is an FPGA?

A

field programmable gate array

A controller not fully set at the time of manufacture that can be programmed to perform a specific function

192
Q

What is SCADA vs ICS

A

ICS is industrial control systems, they provide mechanisms for workflow and process automation with machinery. They have embedded PLCs which are linked by a fieldbus or industrial ethernet. Human Machine interfaces provide access via control panel or software.

SCADA is supervisory control and data acquisition - it takes the place of a control server in large scale, multiple site ICSs. Typically runs as regular software.

193
Q

What is a PLC?

A

Programmable logic controller - act as a bridge between the real world and the digital world.

194
Q

Which component integrates practically all of the components of a traditional chipset?

A

system on a chip

195
Q

Which type of industrial computer is typically used to enable automation in assembly lines and is programmed using ladder langauge?

A

Programmable logic controller

196
Q

Which type of availability attack are industrial computers most sensitive to?

A

Denial of service

197
Q

What are two popular hashing algorithms?

A

MD5 and SHA

198
Q

What are SHA1 and SHA256’s output size?

A

160 bit and 256 bit

199
Q

What algorithm was designated SHA3?

A

Keccack

200
Q

What is RIPEMD?

A

Hashing algorithm designed at the same time as SHA1
Outputs 128, 160, 256, and 320 bits.
Used within PGP encryption.

201
Q

What is HMAC?

A

hash based message authentication code

a way to tell the message hasn’t changed and the sender knows the secret key

requires shared key

sender uses an HMAC function to produce a MAC by feeding it the message and a secret key. the receiver can re-do the HMAC function with the message and shared key and if it matches the MAC sent it’s good

202
Q

What is Poly1305?

A

MAC focused on speed that works well on older devices, often combined with Salsa20 and ChaCha

203
Q

What is a stream cipher?

A

data is encrypted one bit at a time
good for encrypting items where the length of the message is not known

uses an initializaiton vector to generate a unique keystream, which changes

204
Q

What is a block cipher

A

data is encrypted in equal sized blocks, data is padded if too short

205
Q

What are some stream ciphers and which are good?

A

RC4 - bad
Salsa20 - good
ChaCha - good, based off Salsa, combined with Poly1305 often

206
Q

What are some stream ciphers and which are good

A

3des - bad

AES - the best, can use variable block sizes

207
Q

What are the modes of cipher blocks and which are good?

A 
Cipher block chaining (cbc) - bad
Electronic codebook - bad
Galois/Counter Mode (GCM) - good
Counter (CTR) - good
Output Feedback (OFB) - good
208
Q

Which MAC method is commonly used with Sals20?

A

Poly1305

209
Q

What is S/MIME?

A

Secure multipurpose internet mail extensions

Mail using digital certificates to encrypt email

210
Q

What are three signing methods?

A

RSA - factoring large prime numbers
DSA - digital signature algorithm, faster at generating slower at verifying
ECDSA - elliptic curve digital signature algorithm, utilizes properties of elliptic curves

211
Q

What are two key agreement methods?

A

Diffie-helman (DH)

Elliptic curve diffie hellman (ECDH)

212
Q

What are the parts of a cipher suite?

A

Key exchange, signature, bulk encryption, message authentication, elliptic curve

213
Q

What is EAP-TLS?

A

extensible authentication protocol transport layer security

one of the strongest types of authentication and is widely supported

encrypted tunnel between supplicant and server

both supplication and server are configured with certificates

214
Q

What is PEAP?

A

protected extensible authentication protocol

encrypted tunnel between supplicant and auth server

only requires server side public key

must use MS-CHAPv2 or EAP-GTC for its inner authentication method

215
Q

What is Eap TTLS?

A

uses server side cert, can use any inner authentication protocol

216
Q

What is EAP FAST?

A

eap with flexible authentication via secure tunneling

217
Q

What is IPSEC?

A

VPN

works at layer 3

provides both confidentiality and integrity by signing each packet

218
Q

What are the two modes of IPSEC?

A

Authentication header - provides integrity but does not encrypt the payload. Includes the IP header

ESP - encapsulation security payload - can be used to encrypt the packet and can provide confidentiality, authentication, and integrity. Excludes the IP header

219
Q

What is ECC?

A

Asymmetric encryption, has low overhead.

220
Q

What are the ECC implementations?

A

P256 - no longer recommended

P384 - can be used for top secret

221
Q

What takes a key generated from a user and repeatedly converts it to a longer and more random key?

A

Key stretching

222
Q

What are some key strethcing methods?

A

PBKDF2 - widely used

BCRYPT, adds salt

223
Q

What is the bulk encryption method used int he following cipher suite: ECDHE-RSA-AES128-GCM-SHA256

A

AES128-GCM

224
Q

What is the key exchange method used int he following cipher suite: ECDHE-RSA-AES128-GCM-SHA256

A

ECDHE

225
Q

What is the signing method used int he following cipher suite: ECDHE-RSA-AES128-GCM-SHA256

A

RSA

226
Q

What is the MAC method used int he following cipher suite: ECDHE-RSA-AES128-GCM-SHA256

A

SHA256

227
Q

What device used to provide strong authentication stores a user’s digital certificate, private key, and a PIN?

A

Smart Card

228
Q

What are the certificate life cycle management steps?

A 
Generate
Provision
Discover
Inventory
Monitor
Protect
Renew
Revoke
229
Q

What is cert pinning?

A

techniques to ensure that when a client inspects a certificate, it is inspecting the proper certificate

230
Q

What is cert stapling?

A

having a web server periodically obtain a time-stamped ocsp response from the CA and returns this response in lieu of making the client contact OCSP itself

231
Q

What is HSTS?

A

HTTP strict transport security - a configuration to force https

232
Q

What entity is responsible for issuing certificates?

A

Certificate Authority

233
Q

What is a term to describe the requirement for both client and server devices to use certificates to verify identity?

A

Mutual authentication

234
Q

Describe threat vs adversary emulation.

A

Threat emulation is emulating known tactics techniques and procedures in a realistic way without emulating a specific threat actor

Adversary is threat emulation but mimicing a specific actor

235
Q

What is the cyber kill chain?

A

Developed by Lockheed Martin, steps an adversary must complete to achieve their goals

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command and Control
Actions on Objectives
236
Q

What is a defensive approach that assumes breach?

A

Threat hunting

237
Q

What are some types of decoy files?

A

Honytoken

Canary file

238
Q

What are some deceptive security technologies?

A 
Decoy files
Honeypot
Honeynet
Simulators
Dynamic network configurations
239
Q

What is a simple to deploy deceptive technology?

A

Simulator

240
Q

What is a sandbox application?

A

A self contained software application which includes all of the necessary components to operate on an immutable system.

241
Q

What is a self contained software application which includes all of the necessary components to operate on an immutable system.

A

A sandbox application.

242
Q

What ways can you fix buffer overflow?

A

Patching
Secure Coding
Address space layout randomization
Data execution protection

243
Q

What is data execution protection?

A

The operating system identifies areas of memory allowed and not allowed to contain executable code and prevents that code from executing out of bounds.

244
Q

What describes how software can be analyzed for open-source components?

A

Software composition analysis.

245
Q

What is the default tcpdump command?

A

tcpdump -i eth0

246
Q

What are some types of logs?

A

Network logs
Access logs
Vulnerability logs
Netflow logs

247
Q

What is NetFlow also known as?

A

IP Flow Information Export (IPFIX)

248
Q

What are the steps of the incident response process?

A 
Preparation
Detection and Analysis
Containment
Eradication and Recovery
Post Incident Activity
249
Q

Alerts generated by IDS are more critical as they go down or up in value?

A

Down in value, 1 is critical

250
Q

What uses YARA rules most often?

A

Anti-virus

251
Q

What are the four steps of the forensic process?

A

Identification
Collection
Analysis
Reporting

252
Q

What are some file carving tools?

A

Foremost - linux

strings

253
Q

What are some binary analysis tools?

A 
hexdump
Ghidra - written by NSA
GNU project debugger
OllyDBG - windows debugger
readelf 
objdump
strace - interactions between processes and the linux kernel
ldd - dependency display
file
254
Q

What can be used to inspect firmware images?

A

Binwalk

255
Q

What tool can read and write file metadata?

A

exiftool

256
Q

What term describes evidence handling from collection through presentation in court?

A

chain of custody

257
Q

What are some live collection tools?

A 
netstat
ps
vmstat - real time I/O information
lsof - listopen files
netcat
conntrack - interact with connection tracking
tcpdump
wireshark
258
Q

What are some hashing utilities?

A

sha256sum

ssdeep - compare files

casp (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions