Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security (CompTIA Security+) > Chapter 3 - Implementation > Flashcards

Chapter 3 - Implementation Flashcards

1
Q

Domain Name System Security Extensions (DNSSEC)

A

Validates DNS responses such as origin authentication and data integrity
Prevents attackers from manipulating or poisoning the responses to DNS requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Secure Shell (SSH)

A

An encrypted terminal communication that provides secure terminal communication and file transfer features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Secure/ Multipurpose Internet Mail Extensions (S/MIME)

A

Keep emails confidential
Allows to protect information and provide digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Secure Real-time Transport Protocol (SRTP)

A

Take normal conversation across the network and add encryption so nobody can listen to your conversation
Uses AES
HMAC-SHA1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Lightweight Directory Access Protocol Over SSL (LDAPS)

A

Used for reading and writing directories over an Internet Protocol network
Uses SSL and/ or Simple Authentication and Security Layer (SASL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

File Transfer Protocol, Secure (FTPS)

A

Transferring files securely between devices
Uses SSL for encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SSH File Transfer Protocol (SFTP)

A

Provides secure file system functionality
Resuming interrupted transfers, directory listings, remote file removal
Uses SSH for encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Simple Network Management Protocol, Version 3 (SNMPv3)

A

Used for security when querying routers and switches
Provides confidentiality, integrity, and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Hypertext Transfer Protocol over SSL/TLS (HTTPS)

A

Secure version of HTTP
Used for making sure our browser communication is running over an encrypted connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IPSec

A

Communicating between two locations across the internet in a secure form - encryption and packet signing (integrity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IPSec - Authentication Header (AH)/ Encapsulating Security Payloads (ESP)

A

AH - provides integrity
ESP - provides encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IPSec - Tunnel/ Transport

A

Tunnel mode is used to create virtual private networks for network-to-network communications
Transport mode, only the payload of the IP packet is usually encrypted or authenticated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Post Office Protocol (POP)/ Internet Message Access Protocol (IMAP)

A

A way to send and receive email securely
Both use SSL for encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Protocol Use Cases - Voice and Video

A

Use SRTP
Keeps conversations private by using AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Protocol Use Cases - Time Synchronization

A

Use NTPsec
Secure network time protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Protocol Use Cases - Email and Web

A

Email - Use S/MIME
Web - Use HTTPS over SSL/ TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Protocol Use Cases - File Transfer

A

Use FTPS or SFTP (SSH File Transfer Protocol)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Protocol Use Cases - Directory Services

A

Use LDAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Protocol Use Cases - Remote Access

A

Use SSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Protocol Use Cases - Domain Name Resolution

A

Use DNSSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Protocol Use Cases - Routing and Switching

A

Use SSH with SNMPv3 and HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Protocol Use Cases - Network Address Allocation

A

Use DHCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Protocol Use Cases - Subscription Services

A

Use automation subscriptions with constant updates and check for encryption/ integrity checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Dynamic Host Configuration Protocol (DHCP)

A

Assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture
Starvation Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The Endpoint

A

Physical devices that connect to a network system such as mobile devices, desktop computers, virtual machines, embedded devices, and servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Antivirus

A

Software designed to detect and destroy computer viruses
Examples: Trojan horses, worms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Anti-malware

A

Software designed to detect and destroy computer viruses
Examples: Spyware, adware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Endpoint Detection and Response (EDR)

A

A method of threat protection that detects a threat, investigates the threat, and responds to the threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Data Loss Prevention (DLP)

A

The detection of potential data breaches/data ex-filtration transmissions
Data “leakage”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Next-generation Firewall (NGFW)

A

Combining a traditional firewall with other network device filtering functions and controls
Application features, attacks and malware, encrypted data, and access to URLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Host-based Intrusion Prevention System (HIPS)

A

Recognizes and blocks known attacks
Secure OS and application configs and validates incoming service requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Host-based Intrusion Detection System (HIDS)

A

Uses log files to identify intrusions
Can reconfigure firewalls to block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Host-based Firewall

A

A personal software that runs on every endpoint that examines traffic and processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Boot Integrity

A

Ensures that the operating system kernel has not been modified by any malware
Rootkits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Boot Security/ Unified Extensible Firmware Interface (UEFI) (BIOS)

A

A set of routines residing in firmware that boots the operating system and sets up the hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Measured Boot

A

Process of measuring each component, from firmware up through the boot start drivers to provide a way to inform the last software stage if someone tampered with the platform

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Boot Attestation

A

Receives the boot report and changes are identified and made if there have been malware infections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Database Security

A

Protecting stored data and the transmission of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Application Security

A

The process of developing, adding, and testing security features within applications to prevent security vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Input Validations

A

Process of checking to see if all input is correct and making the change if it isn’t
Normalization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Secure Cookies

A

Information used for tracking, personalization, and session management that is stored on your computer by the browser

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Hypertext Transfer Protocol (HTTP) Headers

A

An additional layer of security that ensures encrypted communication
Prevents XSS attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Code Signing

A

Code digitally signed by the developer to show the code has not been altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Allow List

A

Nothing can run unless it’s approved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Block/ Deny List

A

Nothing on this list can be executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Secure Coding Practices

A

A balance between time and quality
Make sure to test - QA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Static Code Analysis

A

The analysis of computer programs performed without executing them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Manual Code Review

A

The process of reading the source code line by line to look out for possible vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Dynamic Code Analysis

A

Designed to test a running application for potentially exploitable vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Fuzzing/ Fuzzers

A

The injection of invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Hardening

A

Minimizing the attack surface and removing all possible points of exploitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Open Ports and Services

A

Possible point of entry
Controlled with firewall
0-65,535

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Registry

A

Primary configuration database used to know when applications are modified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Disk Encryption

A

The prevention of access to application data files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Operating System (OS) Hardening

A

Doing regular updates, managing user accounts, limiting network access, and keep anti-malware and antivirus up to date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Patch Management

A

The systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Patch Management - Third Party Updates

A

Process of installing patches to third-party applications, that are installed on your company’s endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Patch Management - Auto-update

A

Not very good because an update might not be what you want
Test first

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Self-encrypting Drive (SED)

A

A hardware based full disk encryption that does not need an operating system software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Opal

A

Standard specification of SED
Defines a way of encrypting the stored data so unauthorized person who gains possession of the device cannot see the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Hardware Root of Trust

A

The ability to trust that the system is going to be safe and secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Trusted Platform Module (TPM)

A

Designed to help with cryptographic functions that are used within the operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Sandboxing

A

Gives users a safe, lightweight environment to execute code and run applications to test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Full-disk Encryption (FDE)

A

Encrypting everything on the drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Load Balancing

A

Process of distributing a set of tasks over multiple servers, with the aim of making their overall processing more efficient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Active/ Active Load Balancing

A

Having two or more load balancer servers running at the same time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Active/ Passive Load Balancing

A

Having some servers on standby and when the active server fails, the passive server takes over

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Load Balancing Scheduling

A

Round-robin - each server is selected in turn
Weighted round-robin - prioritizing the server use
Dynamic round-robin - Monitor server load and send to server with the lowest use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Load Balancing Persistence

A

Directing a client’s requests to the same backend web or application server for the duration of a “session” or the time it takes to complete a task or transaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Network Segmentation

A

An architectural approach that divides a network into multiple segments or subnets, each acting as its own small network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Segmentation w/ Virtual Local Area Networks (VLANs)

A

Creates a collection of isolated networks within the data center
Severely hinders access to system attack surfaces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Screened Subnet

A

Additional layer of security between the internet and you

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

East-west Traffic

A

Traffic between device in the same data center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Extranet

A

A private network for partners and authorized users
Examples: vendors, suppliers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Intranet

A

Private network for employees within a company only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Zero Trust

A

A framework that assumes a complex network’s security is always at risk to external and internal threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Virtual Private Network (VPN)

A

Mechanism for creating a secure connection between a computing device and a computer network or internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Virtual Private Network (VPN) - Always-on

A

Automated service that establishes a connection between the client and the VPN with no user interactions whatsoever

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Full VPN Tunnel

A

Remote user sends everything to the VPN concentrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Split VPN Tunnel

A

Remote user sends some information to VPN concentrator and separate website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Remote Access VPN

A

Enables users to connect to a private network remotely using a VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Site-to-site VPN

A

If you want to connect to location together with two concentrators
Example: corporate network and remote site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Layer 2 Tunneling Protocol

A

Connecting sites over a layer 3 network as if they were connected at layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

SSL/ TLS VPN

A

Created using the SSL protocol to create a secure and encrypted connection over a less-secure network, such as the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Hypertext Markup Language Version 5 (HTML5) VPNs

A

Creates a VPN tunnel without a separate VPN application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Network Access Control (NAC)

A

The process of restricting unauthorized users and devices from gaining access to a corporate or private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Agent Network Access Control

A

The process of restricting unauthorized users and devices from gaining access to a corporate or private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Agentless Network Access Control

A

Uses the Active Directory to make checks of user device during login and logoffs actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Out-of-band Management

A

The management of devices and IT assets remotely without using the corporate LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Port Security

A

Help secure the network by making sure to block foreign devices from forwarding packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Bridge Protocol Data Unit (BPDU) Guard

A

Prevent attacks on a network by blocking Bridge Protocol Data Units (BPDUs) that are sent from unauthorized devices
Enabled port shuts down as soon as a BPDU is received

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Loop Prevention

A

The sending of traffic between two switches forever
The use of IEEE standard 802.1D prevents loops

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Dynamic Host Configuration Protocol (DHCP) Snooping

A

Layer 2 security technology incorporated into the operating system of a capable network switch that filters DHCP traffic determined to be unacceptable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Media Access Control (MAC) Filtering

A

A security access control method whereby the MAC address assigned to each network interface controller is used to determine access to the physical hardware address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Jump Servers

A

A hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Proxy Server

A

A system that sits between the users and external network to receive and send user requests as well as catching information, access control, URL filtering, and content scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Forward Proxy Server

A

Used to protect and control user access to the internet
“Internal Proxy”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Reverse Proxy Server

A

Used to protect inbound traffic from the internet to your internal service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Network-based Intrusion Detection System (NIDS)

A

Detects and reports network security problems by monitoring network or system activities for malicious or anomalous behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Network-based Intrusion Prevention System (NIPS)

A

A network security tool that continuously monitors a network for malicious activity and takes action to prevent it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Signature-based Intrusion Prevention

A

Monitors inbound network traffic to find sequences and patterns that match a particular attack signature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Anomaly-based Intrusion Prevention

A

An intrusion detection system for detecting both network and computer intrusions and building a baseline of what’s “normal”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Behavior-based Intrusion Prevention

A

An intrusion detection system for recording expected patterns concerning the entity being monitored and reporting it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Heuristic Intrusion Prevention

A

A system that uses artificial intelligence to scan for malicious behavior from a program either within the system, or trying to access the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Passive Monitoring Intrusion Prevention

A

The examination of a copy of the network traffic
Cannot block or prevent the traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Inline Monitoring Intrusion Prevention

A

Sits in the middle or inline the network traffic and monitors and control in real-time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Hardware Security Module (HSM)

A

A device specifically designed to manage and control a large environment
Safeguards and manages cryptographic keys and provides cryptographic processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Collectors

A

A console(s) that receives all censored data and provides output of what is going on on the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Web Application Firewall (WAF)

A

Filters, monitors, and blocks HTTP/ HTTPS traffic to and from a web service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Stateful Firewall

A

Keeps track and monitors the state of active network connections while analyzing incoming traffic and looking for potential traffic and data risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Stateless Firewall

A

Does not keep track of traffic flows and examines each packet individually regardless of history

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Unified Threat Management (UTM)

A

When multiple security features or services are combined into a single device within your network
Includes: web security gateway, URL filter, malware inspection, spam filter, CSU/ DSU, Router, switch, firewall, IDS/ IPS, bandwidth shaper, VPN endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Network Address Translation (NAT) Gateway

A

Used to enable instances present in a private subnet to help connect to the internet or AWS services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Content/ URL Filter

A

Blocks users from loading questionable websites or hosted files via corporate device or network resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Open-source Firewall

A

Provides traditional firewall functionality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Proprietary Firewall

A

Traditional firewall with features like application control and high-speed hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Hardware Firewall

A

Provides efficient and flexible connectivity options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Software Firewall

A

Can be installed on own hardware from anywhere

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Appliance Firewall

A

Has the fattest throughput

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Host-based Firewall

A

Application-aware and can view non-encrypted data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Virtual Firewall

A

Provides valuable East/ West network security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Access Control List (ACL)

A

Specifies which users or system processes are granted access to resources, as well as what operations are allowed on given resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

Quality of Service (QoS)

A

Describes the process of controlling traffic flows and ensuring the performance of critical applications with limited network capacity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Implications of IPv6

A

Most recent version of the Internet Protocol
Secures most attacks but new attacks will occur since this is new

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Port Mirroring/ Port Spanning

A

Cross connecting two or more ports on a network switch so that traffic can be simultaneously sent to a network analyzer or monitor connected to another port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Port Taps

A

A simple device that connects directly to the cabling infrastructure to split or copy packets for use in analysis and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Monitoring Services

A

Ongoing security checks that identify threats, respond to evets, and maintain compliance

128
Q

File Integrity Monitors

A

Identifying when changes to operating system and application files occur
Some should NEVER change

129
Q

North-south Traffic

A

Traffic between the data center and the rest of the network

130
Q

Wi-Fi Protected Access 2 (WPA2)

A

An encrypted security protocol that protects internet traffic on wireless networks
Uses encryption called CCMP block cipher mode

131
Q

Wi-Fi Protected Access 3 (WPA3)

A

Update of the WPA2 security
Uses GCMP cipher mode encryption - stronger encryption

132
Q

Counter-mode/ CBC-MAC Protocol (CCMP)

A

A security protocol used by WPA2 for encryption
CCMP uses AES for confidentiality and CBC-MAC for integrity

133
Q

Galois/ Counter Mode Protocol

A

A security protocol used by WPA3 for encryption
A strong encryption than WPA2
GCMP uses AES for confidentiality and GMAC for integrity

134
Q

Simultaneous Authentication of Equals (SAE)

A

A Diffie-Hellman derived key exchange with an authentication component
Everyone uses different session key, even with same PSK
Fixes WPA2 PSK problem

135
Q

Extensible Authentication Protocol (EAP)

A

A authentication framework
Integrates with 802.1X to prevent access to network until the authentication succeeds
Uses RFC standards

136
Q

Protected Extensible Authentication Protocol (PEAP)

A

Protected EAP
Uses TLS and uses a digital certificate or a generic token card instead of a PAC

137
Q

EAP-FAST

A

EAP Flexible Authentication via Secure Tunneling
Authenticates by means of a protected access credential (PAC)
Negotiates and TLS tunnel and needs a RADIUS server

138
Q

EAP-TLS

A

Requires digital certificates on all devices and a TLS tunnel is built for the user authentication process
Need a PKI

139
Q

EAP-TTLS

A

EAP Tunneled Transport Layer Security
Support other authentication protocols in a TLS tunnel
Requires digital certificate on the AS

140
Q

IEEE 802.1X

A

Port-based Network Access Control (NAC)
You do not get access to the network until you authenticate
Used with RADIUS, LDAP, TACACS+

141
Q

Remote Authentication Dial-in User Service (RADIUS) Federation

A

Links a user’s identity across multiple organization’s networks
Uses 802.1X

142
Q

Wireless Security Mode - Pre-shared Key (PSK)

A

Everyone uses same key
Unique WPA3 session key is derived from the PSK use SAE

143
Q

Wireless Security Mode - Enterprise

A

Uses WPA3/ WPA3 802.1X
Authenticates users individually with an authentication server
Example: RADIUS

144
Q

Wireless Security Mode - Open System

A

No password is required to configure the authentication on your wireless access point/ router

145
Q

Wi-Fi Protected Setup (WPS)

A

The allowing of “easy” setup of a mobile device
Example: PIN, NFC, Push button

146
Q

Captive Portals

A

Web page accessed with a web browser that is displayed to newly connected users of a Wi-Fi or wired network before they are granted broader access to network resources

147
Q

Site Surveys

A

Inspections of an area where work is proposed, to gather information for a design or an estimate to complete the initial tasks required
Examples: access points, frequencies, etc.

148
Q

Heat Maps

A

Identification of wireless signal strengths

149
Q

Wi-Fi Analyzers

A

Provides information about wireless networks, including their signal strength, coverage, names, and security configuration

150
Q

Channel Overlaps

A

The overlapping of channels that cause frequency conflicts

151
Q

Wireless Access Point (WAP) Placement

A

Placing routers strategically to avoid overlap, interference, and excessive signal distance while maximizing coverage and minimizing access points
Examples of interference: microwaves, building materials

152
Q

Controller and Access Point Security

A

Controllers - Strong encryption with HTTPS, automatic logout after no activity
Access Points - Strong passwords and firmware updates

153
Q

Wireless Controllers

A

Centralized management of wireless access points that manage system configuration and performance

154
Q

Cellular Network

A

Mobile devices - “Cell phones”
Separates land into “cells” - antenna coverages a cell with certain frequencies

155
Q

Wi-Fi

A

An internet connection that’s shared with multiple devices in a home or business via a wireless router

156
Q

Bluetooth

A

High speed communication over short distances
Connects our mobile devices to other electronics

157
Q

Near Field Communication (NFC)

A

Two-way wireless communication
Helps with Bluetooth pairing
Examples: payment systems

158
Q

Infrared (IR)

A

A wireless mobile technology used for device communication over short ranges
Requires light-of-sight - control entertainment system

159
Q

Universal Serial Bus (USB)

A

Physical connectivity to device that is used to store and extract files or other documents

160
Q

Point-to-Point Communication

A

One-to-one connection - conversation between two devices

161
Q

Point-to Multipoint Communication

A

802.11 wireless
One-to-many connection

162
Q

Global Positioning System (GPS)

A

Precise navigation that determines location based on timing differences - latitude, longitude, altitude
4 satellites at a time

163
Q

Radio Frequency Identification (RFID)

A

Radar technology that uses electromagnetic fields to automatically identify and track tags attached to objects

164
Q

Mobile Device Management (MDM)

A

The managing of company-owned and mobile-owned devices by setting policies and access control

165
Q

Mobile Device - Application Management

A

Managed through allow lists that only approve apps that can be installed and that are not malicious

166
Q

Mobile Device - Content Management

A

Mobile Content Management (MCM)
Secure access to data and protect data from outsiders by securing file sharing and viewing

167
Q

Mobile Device - Remote Wipe

A

Removing all data from a mobile device

168
Q

Mobile Device - Geofencing

A

Restricting or allowing features when the device is in a particular area
Examples: cameras, logins, etc.

169
Q

Mobile Device - Geolocation

A

The precise tracking details that can track within feet to either find your phone or you

170
Q

Mobile Device - Screen Locks

A

Used to lock your phone to secure you data so nobody can get in without the use of a password

171
Q

Mobile Device - Push Notifications

A

Information that appears on the mobile device screen

172
Q

Mobile Device - Passwords and PINs

A

Used to protect against unauthorized access
Recovery of a password or PIN can be initiated with the MDM

173
Q

Mobile Device - Biometrics

A

You are the authentication factor

174
Q

Mobile Device - Context-aware Authentication

A

Combination of multiple contexts
Where you normally login (IP address)
Where you normally frequently are (GPS location)
Other devices that may be paired (Bluetooth)

175
Q

Mobile Device - Containerization

A

A way to separate personal data from corporate data by creating a logical container to enhance corporate data security

176
Q

Mobile Device - Storage Segmentation

A

Keeps data separate
Isolate the device’s OS and preinstalled apps from user-installed apps and user data

177
Q

Mobile Device - Full Device Encryption

A

Encrypting all of the data on the mobile device

178
Q

Mobile Device - MicroSD Hardware Security Module (HSM)

A

Provides security services such as encryption, key generation, digital signatures, authentication
Now in MicroSD card form

179
Q

Mobile Device - MDM/ Unified Endpoint Management (UEM)

A

Class of software tools that provide a single management interface for mobile, PC and other devices

180
Q

Mobile Device - Mobile Application Management (MAM)

A

Monitor, provision, update and remove apps
Create an enterprise app catalog so users can pick what to install

181
Q

Mobile Device - SEAndroid

A

Security enhancements for Android
A security solution for Android that identifies and addresses critical gaps

182
Q

Third-party Application Stores

A

App Store/ Google Play
Not all apps are secure of appropriate for business

183
Q

Rooting/ Jailbreaking

A

Rooting - Android
Jailbreaking - Apple
Able to gain complete control of the operating system and remove some restrictions present in the software

184
Q

Sideloading

A

Installing unapproved software/ app from a third-party source or transferring files between two devices

185
Q

Custom Firmware

A

Unofficial new or modified version of firmware created by third parties

186
Q

Carrier Unlocking

A

Allowing consumers to move their cell phone from one carrier to another

187
Q

Firmware Over-the-air (OTA) Updates

A

Operating system updates that can be significant that can be installed without using a cable

188
Q

Monitoring of Camera Use

A

Could be used for espionage or inappropriate use
MDM can disable or enable in certain locations

189
Q

Monitoring of SMS/ Multimedia Messaging Service (MMS)

A

Text messages, video, audio that can be exposed to data leaks and phishing attempts
MDM can allow only during certain time frames or locations

190
Q

Rich Communication Services (RCS)

A

A communication protocol between mobile telephone carriers and between phone and carrier, aiming at replacing SMS messages with a text-message system that is richer

191
Q

External Media

A

Data that is stored/ transferred onto external or removable devices
USB or flash drives

192
Q

USB On-the-go (USB OTG)

A

Connect devices directly together by being both the host and a device
No computer or cable required
Usually mobile device and USB/flash drive

193
Q

Monitoring of Recording Microphone

A

Useful for meetings and note taking
Can be a legal liability depending on states
MDM can disable or geo-fence

194
Q

Geo-tagging/ GPS Tagging

A

Phone knows your exact location especially when you document to social media which can cause security concerns

195
Q

WiFi Direct/ ad hoc

A

Ad Hoc - Connecting wireless devices directly without an access point
Wireless Direct - enables mobile phones, cameras, printers, PCs, and gaming devices to create their own Wi-Fi networks without an internet connection

196
Q

Tethering

A

Turns your phone into a mobile WiFi hotspot, so your devices can use your phone’s data to establish an internet connection

197
Q

Hotspot

A

A way to connect to the internet wirelessly when you are away from your home or office network

198
Q

Monitoring of Payment Methods

A
199
Q

Monitoring of Payment Methods

A

Apple Pay, Android Pay, Samsung Pay
Once primary authentication is bypassed, payment is allowed

200
Q

Bring Your Own Device (BYOD)

A

Employee owns device but needs to meet the company’s requirements
Both a home device and a work device

201
Q

Corporate-owned Personally Enabled (COPE)

A

Company buys the device but its used as both personal and corporate
Organization keep full control and is protected using corporate policies

202
Q

Choose Your Own Device (CYOD)

A

Employee buys the device but its used as both personal and corporate
Organization keep full control and is protected using corporate policies

203
Q

Corporate-owned

A

Company buys and owns the device and controls the content on the device
Not for personal use - no mixing business with home use

204
Q

Virtual Desktop Infrastructure (VDI)/ Virtual Mobile Infrastructure (VMI)

A

Apps and data are separated from the mobile device and data is stored securely

205
Q

High Availability (HA) Across Zones

A

Isolated locations with a cloud region that commonly spans across multiple regions
Can use load balancers

206
Q

Cloud Resource Policies

A

Providing access to cloud resources to users who get access
Identity and Access Management (IAM)

207
Q

Cloud Secrets Management

A

Cloud-based methods and tools that organizations use to secure and manage their digital credentials like signatures and keys

208
Q

Cloud Security Integration and Auditing

A

Integrate security across multiple platforms and audit these security controls by validating them

209
Q

Cloud Storage Permissions

A

One permission mistake can cause a breach
Public access should not be default
Identity and Access Management (IAM)

210
Q

Cloud Storage Encryption

A

Data is more accessible that non-cloud data
Server-side - encrypt data in cloud and when stored on disk
Client-side - already encrypted when sent to cloud

211
Q

Cloud Storage Replication

A

Copy data from one place to another
Can be real-time data duplication

212
Q

Cloud Storage High Availability (HA)

A

Maintain up time if an outage or disaster occurs by having backups with constant duplication of data

213
Q

Cloud Virtual Networks

A

The building of the network from the cloud console
Servers, databases, storage devices

214
Q

Public Cloud Subnet

A

All external IP addresses
Connect to the cloud from anywhere

215
Q

Private Cloud Subnet

A

All internal IP addresses
Connect to the private cloud over VPN
No access from internet

216
Q

Network Segmentation

A

Data is separated from the application and adds security systems between application components
WAF, NGFW

217
Q

API Inspection and Integration

A

Viewing specific API queries and monitoring incoming and outgoing data

218
Q

Cloud Storage

A

Data stored on a public cloud

219
Q

Cloud Network

A

Connecting cloud components within and outside the cloud
Cloud devices communicating with each other

220
Q

Hybrid Cloud Subnet

A

Combine internal cloud resources with external
Combine public and private subnets

221
Q

Cloud Access Security Broker (CASB)

A

On-premises or cloud based software that sits between cloud service users and cloud applications, and monitors all activity and enforces security policies

222
Q

Next-Generation Secure Web Gateway (SWG)

A

A way to try and protect users and devices regardless of location and activity

223
Q

Firewall Cost

A

Relatively inexpensive compared to appliances

224
Q

Firewall Need for Segmentation

A

Deploying of a firewall at a desired network boundary so that all traffic crossing the boundary is routed through that firewall

225
Q

Firewall Open Systems Interconnection (OSI) Layers

A

Layer 4 (TCP/ UDP), Layer 7 (application)

226
Q

Cloud Native Controls

A

Security controls integrated and supported by the cloud provider that has many configuration options

227
Q

Third-party Solutions

A
228
Q

Compute Cloud Instances

A

Components performing calculations of instances
Amazon Elastic Compute Cloud (EC2)
Google Compute Engine (GCE)
Microsoft Azure

229
Q

Dynamic Resource Allocation

A

Provisioning resources when needed - use of application
Scale up and down

230
Q

Instance Awareness

A

Manage and identify data flows and make decisions based off of the data
Define and set policies of instances

231
Q

Virtual Private Cloud (VPC) Endpoint

A

Allow private cloud subnets to communicate to other cloud services
Keep conversations private

232
Q

Cloud Security Groups

A

Manage access to compute engines

233
Q

Container Security

A

Use an OS specifically built for containerization
Or group container types together on the same host

234
Q

Application Security

A

Designing, coding and configuring your application to prevent and defend against cyber threats

235
Q

Cloud Third-party Solutions

A

Support across multiple cloud providers that has more extensive reporting

236
Q

Identity Provider (IdP)

A

A list of entities for users and devices that can provide authentication

237
Q

Identity Attributes

A

An identifier or property of an entity that provides identification
Personal - name, email address
Other - job title, mail stop

238
Q

Identity Certificates

A

Assigned to a person or device

239
Q

Identity Token

A

Contains information about what happened when a user authenticated

240
Q

Identity SSH Keys

A

Using a key instead of username and password

241
Q

Identity Smart Cards

A

Integrates with devices that may require PIN

242
Q

User Account

A

Account on a computer associated with a specific person
Data and files can be private to that user

243
Q

Shared Account/ Guest Credentials

A

Used by more than one person that uses a guest login

244
Q

Guest Account

A

Access to a computer for guests that do not have any controls of settings, but just the userspace

245
Q

Service Account

A

Used exclusively by services running on a computer
Access can be defined for a specific service

246
Q

Privileged Accounts

A

Elevated or complete access to a systems

247
Q

Account Policies

A

Controlling access to an account

248
Q

Password Complexity

A

Making your password stronger to prevent guessing or brute force attacks by increasing password entropy (predictability)

249
Q

Password History

A

Passwords that a user has used previously in a system that the attacker may already have

250
Q

Password Reuse

A

Links to password history - user cannot reuse a password that a user has already used

251
Q

Network Location

A

Using location to set policies on whether a user has access to a system by using IP subnet or Geolocation and use Geofencing or Geotagging to restrict access to a user in certain areas

252
Q

Time-Based Logins

A

Something trying to be accessed outside of normal working hours therefore preventing access to the user

253
Q

Access Policies

A

Criteria for granting access to various servers, applications, and other resources on your network

254
Q

Account Permissions

A

Authorization given to users that enables them to access specific resources on the network, such as data files, applications, printers and scanners

255
Q

Account Audits

A

Should be performed routinely to make sure everyone has the correct permissions and are using the resources granted correctly

256
Q

Impossible Travel Time/ Risk Login

A

A calculation made by comparing a user’s last known location to their current location, then assessing whether the trip is likely or even possible in the time that elapsed between the two measurements

257
Q

Lockout

A

Too many unsuccessful login attempts will cause a lockout which in turn prevents brute force attacks

258
Q

Disablement

A

When someone leaves organization or moves to a different part of the company
Makes account inaccessible but will still save the files and data that was on that account

259
Q

Password Keys

A

A physical device that accounts as hardware based authentication

260
Q

Password Vaults

A

Location where all passwords are stored in an encrypted format

261
Q

Trusted Platform Module (TPM)

A

Hardware for cryptographic functions that help with encryption

262
Q

Hardware Security Module (HSM)

A

A physical computing device that safeguards and manages cryptographic keys and provides cryptographic processing

263
Q

Knowledge-based Authentication (KBA)

A

Using personal knowledge as an authentication factor
Static KBA - Pre-configured shared secrets - model of first car
Dynamic KBA - Identity verification service - street number in Florida

264
Q

Challenge-Handshake Authentication Protocol (CHAP)

A

An authentication protocol originally used by Point-to-Point Protocol to validate users
Three-way handshake

265
Q

Password Authentication Protocol (PAP)

A

Basic authentication method used in legacy systems
Sent in the clear and has a non-encrypted password exchange

266
Q

802.1X

A

It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN and prevents access to network until the authentication succeeds

267
Q

Remote Authentication Dial-in User Service (RADIUS)

A

More common AAA protocol
Client-server protocol enables remote access servers to communicate with a central server

268
Q

Single Sign-on (SSO)

A

A session and user authentication service that permits a user to use one set of login credentials

269
Q

Security Assertion Markup Language (SAML)

A

Primary role in online security and enables users to authenticate through a third-party to gain access to multiple applications

270
Q

Terminal Access Controller Access Control System Plus (TACACS+)

A

A Cisco designed extension to TACACS that encrypts the full content of each packet

271
Q

OAuth

A

Authorization framework that provides authorization between applications and determines what resources a user will be able to access

272
Q

OpenID

A

A decentralized authentication protocol that allows users to authenticate with multiple websites using a single set of credentials

273
Q

Kerberos

A

A network authentication protocol that only need to authenticate once and then it will be trusted by the system

274
Q

Attribute-based Access Control (ABAC)

A

An authorization model that evaluates attributes (or characteristics), rather than roles, to determine access
Examples: IP address, time of day, desired action, etc.

275
Q

Role-based Access Control

A

Access to resources based on your role in an organization
Examples: Manager, director, team leader, etc.

276
Q

Rule-based Access Control

A

Manages access to areas, devices, or databases according to a predetermined set of rules or access permissions regardless of their role or position in an organization

277
Q

Mandatory Access Control (MAC)

A

Each object is labeled with a confidential, secret, top secret, etc. label and the administrator decides what user gets access of what object

278
Q

Discretionary Access Control (DAC)

A

An identity-based access control model that provides users with a certain amount of control over their data

279
Q

Conditional Access

A

‘Just-in-time’ evaluation to ensure the person who is seeking access to content is authorized to access the content

280
Q

Privileged Access Management (PAM)

A

A subset of IAM that allows you to control and monitor the activity of privileged users (who have access above and beyond standard users) once they are logged into the system

281
Q

Filesystem Permissions

A

Control the ability of users to read, change, navigate, and execute the contents of the file system

282
Q

Public Key Infrastructure (PKI)

A

Set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption

283
Q

Key Management

A

Deal with key generation, certificate generation, distribution, storage, revocation, and expiration of keys

284
Q

Certificate Authority (CA)

A

An entity that stores, signs, and issues digital certificates

285
Q

Intermediate CA

A

A certificate that was issued as a dividing layer between the Certificate Authority and the end user’s certificate

286
Q

Registration Authority (RA)

A

An authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it

287
Q

Certificate Revocation List (CRL)

A

List of digital certificates that have been revoked by the issuing certificate authority (CA) before their actual or assigned expiration date

288
Q

Certificate Attributes

A

The common name, subject alternative name, and the expiration

289
Q

Online Certificate Status Protocol (OCSR)

A

A way for a browser to check certificate revocation

290
Q

Common Name (CN)

A

The Fully Qualified Domain Name (FQDN) for the certificate

291
Q

Subject Alternative Name

A

Additional host name of the cert that is common on web servers
Examples: professormesser.com and www.professormesser.com

292
Q

Expiration

A

The legally mandated date by which a certified proposed decision is due to be acted upon
Limit exposure to compromise

293
Q

Wildcard Domain

A

Certificates are based on the name of the server and this will apply to all server names in a domain

294
Q

Subject Alternative Name

A

Additional host name for the certificate

295
Q

Code Signing Certificate

A

A signature from the developer who created the code for the application and validates the software hasn’t been modified

296
Q

Self-signed Certificate

A

Public key certificates that are not issued by a certificate authority that do not provide any trust value

297
Q

Machine/ Computer Certificate

A

Provides authenticity on the devices that you physically manage/ see

298
Q

Email Certificate

A

Proves to customers that the email is not a forged phishing attempt and their transactions will be safe

299
Q

User Certificate

A

Used to associate a certificate with a user that can act as a powerful electronic “id card”

300
Q

Root Certificate

A

The public key certificate that identifies the root CA and can issue other certificates such a intermediate

301
Q

Domain Validation (DV) Certificate

A

Owner of the certificate has some control over a DNS domain

302
Q

Extended Validation (EV) Certificate

A

Additional checks have verified the certificate owner’s identity

303
Q

Distinguished Encoding Rules (DER)

A

A binary format designed to transfer syntax for data structures

304
Q

Privacy Enhanced Mail (PEM)

A

A de facto file format for storing and sending cryptographic keys, certificates, and other data and used to provide secure electronic mail communication over the internet

305
Q

Personal Information Exchange (PFX)

A

A password protected file certificate commonly used for code signing your application

306
Q

.cer

A

Primarily a Windows X.509 file extension
Responsible for storing some information about the owner certificate and the specific public key

307
Q

P12 (PKCS #12)

A

Used to transfer a private and publics key pair that can be password protected
Container format for many certificates that store many X.509 certificates in a single .p12 file

308
Q

P7B (PKCS #7)

A

Contains certificates and chain certificates that private keys are not included in a .p7b file

309
Q

Online CA

A

Web browsers use them to authenticate content sent from web servers, ensuring trust in content delivered online

310
Q

Offline CA

A

A certificate authority which has been isolated from network access, and is often kept in a powered-down state which in turn protects the CA

311
Q

Stapling

A

OCSP stapling makes verifying the revocation status of an SSL/TLS certificate faster and easier for a client than ever before

312
Q

Pinning

A

Putting the certificate inside of the application you are using and if the expected key does not match, the application can decide whether or not to shut down

313
Q

Trust Model

A

Single CA, Hierarchal, mesh, web-of-trust, and Mutual authentication

314
Q

Key Escrow

A

Someone else (3rd party) holding your decryption keys

315
Q

Certificate Chaining

A

Listing all of the certs between the server and the root CA (intermediate certs) to ensure that only trusted software and hardware can be used while still retaining flexibility

Cyber Security (CompTIA Security+) (41 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions