Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Chapter 1 - Mastering Security Basics > Flashcards

Chapter 1 - Mastering Security Basics Flashcards

1
Q

Use Case

A

Describes a goal than an organization wants to achieve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Confidentiality

A

Prevents the unauthorized disclosure of data. Authorized personnel can access the data, but unauthorized cannot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Encryption

A

Scrambles data to make it unreadable by unauthorized personnel. Authorized personnel can decrypt the data to access it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Identification

A

Claiming identity with unique username

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Authentication

A

Prove identity with authentication, such as a password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Authorization

A

Granting or restricting access to resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Stenography

A

Hiding data within data. Obscures the data and can be used in a use case to support obfuscation. Referred to as hiding data in plain sight. Example is embedding a hidden message in an image by modifying bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Obfuscation

A

Attempting to make something unclear or difficult to understand. Its called security by obscurity. Not reliable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Best way to protect data confidentiality

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Access Controls

A

Help protect confidentiality by restricting access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrity

A

Provides assurances that data hasn’t changed. This means data isn’t modified, tampered with, or corrupted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Hash

A

Simply a number created by executing a hashing algorithm against data, such as a file or message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Digital Signature

A

Attached to file or email to assure that nothing was modified. Also provided authentication. Also provide non-repudiation (you can’t deny you digitally signed it after sending). Require digital certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Availability

A

Indicates that data and services are available when needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Redundancy

A

Adds duplication to critical systems and provides fault tolerance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Risk

A

Possibility or likelihood of a threat exploiting a vulnerability resulting in a loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Threat

A

Any circumstance or event that has the potential to compromise confidentiality, integrity, or availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Vulnerability

A

A weakness in the hardware, software, the configuration, and even the users operating the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Security Incident

A

An adverse event or series of events that can negatively affect the confidentiality, integrity, or availability of an organization’s IT systems and data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Risk Mitigation

A

Reduces the chances that a threat will exploit a vulnerability, by implementing security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Technical Controls

A

Use technology to reduce vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Principle of Least Privilege

A

Individuals or processes are granted only to privileges they need to perform their assigned tasks or functions, but no more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Administrative Controls

A

Use methods mandated by organizational policies or other guidelines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Risk Assessments

A

Help quantify and qualify risks within an organization so that the organization can focus on the serious risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Quantitative Risk Assessment

A

Uses cost and asset values to quantify risks based on monetary values

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Qualitative Risk Assessment

A

Uses judgments to categorize risks based on probability and impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Vulnerability Assessment

A

Attempts to discover current vulnerabilities or weaknesses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Pen Tests

A

Attempts to exploit vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Physical Controls

A

Any controls that you can physically touch. Includes lighting, signs, fences, guards, and more.

Many physical controls are also technical controls, such as a fire suppression system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Preventive Controls

A

Controls to prevent security incidents like hardening, security awareness & training, security guards, change management, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Hardening

A

Making a system or application more secure than its default configuration.

Includes disabling unnecessary ports and services, implementing secure protocols, using strong passwords along with a robust password policy, and disabling default and unnecessary accounts.

32
Q

Security Awareness and Training

A

Ensuring that users are aware of security vulnerabilities and threat help prevent incidents.

33
Q

Change Management

A

Ensures that changes don’t result in unintended outages. One must submit a change to a change management process.

Both operational and preventive control.

34
Q

Detective Controls

A

Detects when vulnerabilities have been exploited, resulting in a security incident.

35
Q

Log Monitoring

A

Monitoring logs to detect anomalies.

36
Q

Trend Analysis

A

Using past logs or alerts to identify a trend, such as an increase of attacks on a specific system

37
Q

Security Audit

A

Examines the security posture of an organization. An example may be reviewing current permissions to ensure no one has more permissions than they should.

38
Q

Difference between detective controls and prevention controls

A

Detective control (IDS) cant predict/prevent an attack while Prevention control (IPS) stop the incident from occurring at all.

39
Q

Corrective Controls

A

Attempt to reverse the impact of an incident or problem after it has occurred. Examples include IPS and Backups & system recovery

40
Q

Deterrent Controls

A

Attempt to discourage a threat. Some attempt to discourage potential attackers from attacking, and others attempt to discourage employees from violating a security policy. Very similar to preventive controls.

41
Q

Compensating Controls

A

Alternative controls used instead of a primary control. Includes issuing a Time-based One-Time Password while employee awaits smart card.

42
Q

Virtualization

A

Allows you to host one or more virtual systems on a single physical system.

43
Q

Hypervisor

A

The software that creates, runs, and manages the VMs is the hypervisor.

44
Q

Host

A

The physical system hosting the VMs.

45
Q

Guest

A

Operating systems running on the host system are guests or guest machines.

46
Q

Host elasticity and scalability

A

Refer to the ability to resize computing capacity based on the load.

47
Q

Type 1 Hypervisors

A

Run directly on the system on the system hardware. Called bare-metal hypervisors

48
Q

Type 2 Hypervisors

A

Run as a software within a host operating system.

49
Q

Application Cell/Container virtualization

A

Runs services or applications within isolated application cells/containers. Doesn’t have its own kernel.

50
Q

Snapshot

A

Provides you with a copy of the VM at a moment in time which can be used as a backup.

51
Q

VDI/VDE

A

Virtual Desktop Infrastructure/Virtual Desktop Environment

A user’s desktop operating system runs as a VM on a server

52
Q

Persistent virtual desktop

A

Each user has a custom desktop image

53
Q

Non-persistent virtual desktop

A

Serves the same desktop for all users. Reverts back to known state (snapshot) when they log off.

54
Q

VM escape

A

An attack that allows an attacker to access the host system from within the virtual system.

A successful VM escape attack often gives the attacker unlimited control over the host system and each virtual system within the host.

55
Q

VM Sprawl

A

Occurs when an organization has many VMs that aren’t managed properly. This means they aren’t updated or or unauthorized.

56
Q

Ping

A

Tests connectivity for remote systems. Checks name resolution. Checks security posture (if pings aren’t getting through firewall if configured to do so).

Uses ICMP echo request packets.

57
Q

ipconfig

A

Shows the TCP/IP configuration information for a system. This includes IP, subnet, gateway, MAC, and DNS server address.

58
Q

Command so show content of DNS cache

A

ipconfig /displaydns

59
Q

Command to erase contents of the DNS cache

A

ipconfig /flushdns

60
Q

Non-promiscuous mode

A

Normal function of NIC where it only processes packets addressed directly to its IP address.

61
Q

Promiscuous mode

A

NIC processes all packets regardless of the IP address.

62
Q

Which command is replacing ifconfig

A

ip command

63
Q

ipconfig vs ifconfig

A

ifconfig can manipulate the settings on the network interfaces.

64
Q

How to enable promiscuous mode

A

ifconfig command

65
Q

Command to view and manipulate NIC settings

A

ip command

66
Q

Netstat

A

Allows you to view statistics for TCP/IP protocols on a system. Can also view active TCP/IP network connections.

67
Q

Command to display all TCP/UDP ports that a a system is listening on

A

Netstat -a

68
Q

Command to display the routing table

A

Netstat -r

69
Q

ESTABLISHED

A

Normal state for the data transfer phase of a connection. Indicates an active open connection.

70
Q

LISTEN

A

System is waiting for a connection request.

71
Q

CLOSE_WAIT

A

Indicates the system is waiting for a connection termination request

72
Q

TIME_WAIT

A

Indicates the system is waiting for enough time to pass to be sure the remote system received a TCP-based acknowledgment of the connection.

73
Q

SYN_SENT

A

Indicates the systems sent a TCP SYN (synchronize) packet as the first part of the SYN, SYN-ACK (synchronize-acknowledge), ACK (acknowledge) handshake process and it is waiting for the SYN-ACK response

74
Q

SYN_RECEIVED

A

This indicates the system sent a TCP SYN-ACK packet after receiving a SYN packet as the first part of the SYN, SYN-ACK, ACK handshake process.

75
Q

Tracert

A

Lists the routers between two systems. Identifies faulty routers and where traffic stops.

76
Q

ARP

A

resolves IP addresses to MAC addresses and stores the result in the ARP cache.

Security+ (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions