Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Chapter 1 & 2: Security Fundamentals and Risk Management > Flashcards

Chapter 1 & 2: Security Fundamentals and Risk Management Flashcards

1
Q

Which standards organization publishes the 802.X series of networking standards

A

Institute of Electrical and Electronics Engineers (IEEE)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which standards organization developed many common internet protocols and issues RFCs on protocols/protocol updates?

A

Internet Engineering Task Force (IETF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which standards organization is international, creates standards for information technology and security standards and practices, and developed the OSI network model?

A

International Organization for Standardization (ISO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which standards organization is a UN agency, allocates radio spectrum, coordinates satellite orbits, and promotes global technical standards related to networking and communication (H.264 MPEG, X.509 digital certificates)

A

International Telecommunication Union (ITU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which standards organization is a US government agency which develops and supports standards used by other government organizations? Their standards are often used by other organizations with similar technology needs.

A

National Institute of Standards and Technology (NIST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which standards organization is a US signals intelligence agency involved in information gathering, codebreaking and codemaking. They have roles in DES, AES, and SHA.

A

National Security Agency (NSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which standards organization further the state of web application security and provides guidelines, articles, software tools, and others.

A

Open Web Application Security Project (OWASP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which standards organization develops and maintains interoperable standards for the WWW?

A

World Wide Web Consortium (W3C)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q 
Which security controls involve organizational policies and training.  They include:
password policies
employee screening
training procedures
compliance with legal regulations
A

Managerial

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which security controls are enforced by technology. They include:
firewalls
authentication systems
encryption protocols

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which security controls are accomplished through employee activities and the execution of policies. They include:
backup management
security assessments
incident response

A

Operational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q 
Which security controls are accomplished through
locks
fences
video surveillance
security guards
A

Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which control is designed to close a gap in an existing control structure?

A

Preventative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which control is designed to detect an active threat and record as evidence

A

Detective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which control is designed to minimize the harm caused by a security breach and to prevent recurrence?

A

Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which control discourages attack or intrusion

A

Deterrent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a federal law designed to protect investors from fraudulent corporate accounting practices? It primarily applies to publicly traded companies and public accounting firms that do business in the US and primarily regulates the preservation, auditing and disclosure of financial records and related communications.

A

Sarbanes-Oxley Act of 2002 (SOX)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which act applies to all federal agencies and requires every agency to develop, document, and implement an information security and protection program, and provides guidelines for doing so?

A

Federal Information Security Management Act (FISMA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a federal law designed to protect health insurance coverage, protects the privacy of patient records, defines PHI, and regulates how it can be used or disclosed.

A

Health Insurance Portability and Accountability Act (HIPAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a federal privacy law that governs access to educational records, requires that adult student or the parents of minor students have access to their records, and limits how those records can be shared with others?

A

Family Educational Rights and Privacy Act (FERPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What act protects the customers of financial institutions by setting minimum standards for financial institutions to safeguard clients and customers personnel information.

A

Gramm-Leach-Bliley Act (GBLA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is an EU law governing all individual data relating to EU residents which addresses security, privacy, and export of data.

A

General Data Protection Regulation (GDPR)

23
Q

What are shared rules developed by the world’s major credit card companies and administered by the PCI council. They regulate how payment information must be stored, processed, and transmitted, and requires vulnerability scanning.

A

Payment Card Industry Data Security Standard (PCI DSS)

24
Q

What governance framework is a series of documents defining security standards, policies, and procedures for the US government

A

NIST 800 series

25
Q

Which framework is defined by SP 800-27 using controls in SP 800-53 and uses a six-step cyclical process to identify and manage risks. This framework is mandatory for US government agencies.

A

NIST Risk Management Framework (RMF)

26
Q

Which framework contains voluntary guidelines for private sector organizations in the US, particularly in critical infrastructure. It focuses on standard guidelines and language for cybersecurity, and is based on industry standards and best practices, but does not contain detailed risk-management procedures, so it should be used in conjunction with RMF.

A

NIST Cybersecurity Framework (CSF)

27
Q

Which framework is a series of broad risk-management framework guidelines containing information security guidelines for all sorts of organizations.

A

ISO 27000

28
Q

Which framework is a broad risk-managment framework that applies to all aspects of organizational risks and their effects on business goals. It is meant to be used in conjunction with ISO 27000, and is more focused on organizational leadership.

A

ISO 31000

29
Q

Which framework includes 20 best practice guidelines for general cybersecurity, initially developed by SANS. Each guideline defines a type of action you can use to reduce security vulnerabilities, and it maps to the NIST CSF, making it a useful tool towards implementing that framework.

A

Center for Internet Security Critical Security Controls for Effective Cyber Defense (CIS CSC)

30
Q

Which framework is focused on cloud security?

A

Cloud Security Alliance Cloud Controls Matrix (CSA CCM)

31
Q

Which framework is an auditing standard published by the American Institute for Certified Public Accountant (AICPA). It Ensures accurate, complete and fair financial reporting with a focus on operational controls on information system.

A

Statement on Standards for Attestation Engagements.

32
Q

Which TCP/IP tool display a variety of network information, including active connections, routing tables and traffic statistics?

A

netstat

33
Q

Which TCP/IP tool displays the IPv4 ARP cache?

A

arp

34
Q

Which TCP/IP tool performs a DNS lookup and displays the IP address of a given hostname?

A

nslookup

35
Q

Which TCP/IP tool is a more powerful alternative to nslookup and is particularly useful for zone transfers.

A

dig

36
Q

Which TCP/IP tool is used in Windows and is similar to tracert

A

pathping

37
Q

Which 2 attack tools make arbitrary network connections?

A

netcat and ncat

38
Q

Which attack tool is a packet crafting utility that can be used for enumeration and exploitation

A

hping

39
Q

Which attack tool is normally used for secure remote access, but can also create proxy connection to obscure the attackers network location

A

SSH

40
Q

Which attack tools is a focused proxy application

A

proxychains

41
Q

Which attack tool is a command-line tool that can transfer data using various protocols. Can be used to upload malicious code or download sensitive files.

A

curl

42
Q

Which attack tool can replay, or resend, network traffic captured by another tool such as tcpdump or Wireshark

A

tcpreplay

43
Q

Which attack tool is a port scanner designed for penetration testing?

A

scanless

44
Q

Medusa, Hydra, Hashcat, John the Ripper, Cain & Abel and patator are all examples of what?

A

Password cracking tools

45
Q

Which 2 exploitation frameworks are used for general purpose exploits

A

Metasploit and core impact

46
Q

Which exploitation framework is focused on web applications

A

w3af

47
Q

Which exploitation framework targets local address resolution protocols

A

Responder

48
Q

How long it takes for a newly installed device to fail is referred to as what?

A

Mean time to failure (MTTF)

49
Q

How long it takes to repair a serviceable device is referred to as what?

A

Mean time to repair (MTTR)

50
Q

The average uptime between failures is referred to as what?

A

Mean time between failures (MTBF)

51
Q

What is calculated by MTBF + MTTR

A

Mean time between service incidents (MTBSI)

52
Q

Which type of scan is most likely to cause disruptions?

A

non-credentialed intrusive scan

53
Q

What is a program that monitors and analyzes
network traffic, detecting bottlenecks and
problems. Also known as protocol analyzer.

A

sniffer

Security+ (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions