Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ SYO-501 > Chapter 7 > Flashcards

Chapter 7 Flashcards

Protecting Against Advance Attacks

1
Q

DoS

A

Denial-of-Service is and attack from a single source that attempts to disrupt the services provided by the attacked system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

DDoS

A

Distributed Denial of Service is an attack on a system launched from multiple sources intended to make a computers resources or services unavailable to users

DDoS attacks typically include sustained, abnormally high network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Escalation

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Privilege

A

Filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

MAC Spoofing

A

An attack that changes the source MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IP Spoofing

A

An attack that changes the source IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

MITM

A

Man-in-the-Middle is an attack using active interception or eavesdropping

It uses a third computer to capture traffic sent between two other systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ARP Poisoning

A

An attack that misleads systems about the actual MAC address of a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ARP Request

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ARP Reply

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DNS Poisoning

A

An attack that modifies or corrupts DNS results

DNSSEC helps prevent DNS poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DNSSEC

A

Domain Name System Security Extensions is a suite of extensions to DNS used to protect the integrity of DNS records and prevent some DNS attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Amplification Attack

A

An attack that increases the amount of bandwidth sent to a victim

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Brute Force

A

A password attack that attempts to guess a password

Online brute force attacks guess passwords of online systems

Offline attacks guess passwords contained in a file or database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Dictionary

A

A password attack that uses a file of words and character combinations

The attack tries every entry within the file when trying to guess a password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Hash

A

A number created by executing a hashing algorithm against data, such as a file or message

Hashing is commonly used for integrity

Common hashing algorithms are MD5, SHA-1, and HMAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

MD5

A

Message Digest 5 is a hashing function used to provide integrity

MD5 creates 128-bit hashes, which are also referred to as MD5 checksums

Experts consider MD5 cracked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

SHA

A

Secure Hash Algorithm is a hashing function used to provide integrity

Versions include SHA-1, SHA-2, and SHA-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Pass the Hash

A

A password attack that captures and uses the hash of a password

It attempts to log on as the user with the hash and is commonly associated with the Microsoft NTLM protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Birthday

A

A password attack named after the birthday paradox in probability theory

The paradox states that for any random group of 23 people, there is a 50 percent chance that 2 of them have the same birthday

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Collision

A

A hash vulnerability that can be used to discover passwords

A hash collision occurs when two different passwords create the same hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Rainbow Table

A

A file containing precomputed hashes for character combinations

Rainbow tables are used to discover passwords

PBKDF2 and bcrypt thwart rainbow table attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Salt

A

A random set of data added to a password when creating the hash

PBKDF2 and bcrypt are two protocols that use salts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Replay Attack

A

An attack where the data is captured and replayed

Attackers typically modify data before replaying it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Known Plaintext

A

A cryptographic attack that decrypts encrypted data

In this attack, the attacker knows the plaintext used to create chiphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Typo Squatting

A

The purchase of a domain name that is close to a legitimate domain name

Attackers often try to trick users who inadvertently use the wrong domain name

Also called URL hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Hosting a Malicious Website

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Earning Ad Revenue

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Reselling the domain

A

filler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Clickjacking

A

An attack that tricks users into clicking something other than what they think they’re clicking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Session Hijacking

A

An attack that attempts to impersonate a user by capturing and using a session ID

Session IDs are stored in cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Domain Hijacking

A

An attack that changes the registration of a domain name without permission from the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Man-in-the-Browser

A

An attack that infects vulnerable web browsers

It can allow the attacker to capture browser session data, including keystrokes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Shimming

A

A driver manipulation method

It uses additional code to modify the behavior of a driver

35
Q

Refactoring

A

A driver manipulation method

Developers rewrite the code without changing the driver’s behavior

36
Q

Zero-day Vulnerability

A

A vulnerability or bug that is unknown to trusted sources but can be exploited by attackers

Zero-day attacks take advantage of zero-day vulnerabilities

37
Q

Memory Leak

A

An application flaw that consumes memory without releasing it

38
Q

Integer Overflow

A

An application attack that attempts to use or create a numeric value that is too big for an application to handle

Input handling and error handling thwart the attack

39
Q

Buffer Overflow

A

An error that occurs when an application receives more input, or different input, than it expects

It exposes system memory that is normally inaccessible

40
Q

Pointer Deference

A

A programming practice that uses a pointer to reference a memory area

A failed dereference operation can corrupt memory and sometimes even cause an application to crash

41
Q

DLL Injection

A

An attack that injects a Dynamic Link Library (DLL) into memory and runs it

Attackers rewrite the DLL, inserting malicious code

42
Q

Compiled Code

A

Code that has been optimized by an application and converted into an executable file

Compare with runtime code

43
Q

Runtime Code

A

Code that is interpreted when it is executed

Compare with compiled code

44
Q

Input Validation

A

A programming process that verifies data is valid before using it

45
Q

Verifying Proper Characters

A

Filler

46
Q

Implementing Boundary or Range Checking

A

Filler

47
Q

Blocking HTML Code

A

Filler

48
Q

Preventing the use of certain characters

A

Filler

49
Q

Race Condition

A

A programming flaw that occurs when two sets of code attempt to access the same resource

The first one to access the resource wins, which can result in inconsistent results

50
Q

Error-Handling

A

A programming process that handles errors gracefully

51
Q

Errors to users should be general

A

Fillers

52
Q

Detailed information should be logged

A

Filler

53
Q

Encryption

A

A process that scrambles, or ciphers, data to make it unreadable

Encryption normally includes a public algorithm and a private key

Compare with asymmetric and symmetric encryption

54
Q

Authentication

A

The process that occurs when a user proves an identity, such as with a password

55
Q

Dead Code

A

Code that is never executed or used

It is often caused by logic errors

56
Q

obfuscation

A

An attempt to make something unclear or difficult to understand

Steganography methods use obfuscation to hide data within data

57
Q

Static code analyzers

A

Filler

58
Q

Dynamic Anlysis

A

Filler

59
Q

Stress testing

A

Filler

60
Q

Sandboxing

A

The use of an isolated area on a system, typically for testing

Virtual machines are often used to test patches in an isolated sandbox

Application developers sometimes use the chroot command to change the root directory

61
Q

Model Verification

A

Filler

62
Q

Waterfall

A

A software development life cycle model using a top-down approach

It uses multiple stages with each stage starting after the previous stage is complete

Compare with agile

63
Q

Secure DevOps

A

A software development process using an agile-aligned methodology

It considers security through the lifetime of the project

64
Q

Security Automation

A

Filler

65
Q

Continuous Integration

A

Filler

66
Q

Baselining

A

Filler

67
Q

Immutable System

A

Filler

68
Q

Infrastructure as Code

A

Filler

69
Q

Change Management

A

The process used to prevent unauthorized changes

Unauthorized changes often result in unintended outages

70
Q

Version Control

A

A method of tracking changes to software as it is updated

71
Q

Apache

A

Filler

72
Q

Internet Information Services (IIS)

A

Filler

73
Q

Normalization

A

The process of organizing tables and columns in a database

Normalization reduces redundant data and improves overall database performance

74
Q

Homer Simpson

A

Filler

75
Q

Stored Procedures

A

A group of SQL statements that execute as a whole, similar to a mini-program

Developers use stored procedures to prevent SQL injection attacks

76
Q

Injection Attack

A

An attack that injects code or commands

Common injection attacks are DLL injection, command injection, and SQL injection attacks

77
Q

XSS

A

A web application vulnerability

Attackers embed malicious HTML or JavaScript code into a web site’s code, which executes when a user visits the site

78
Q

XSRF

A

A web application attack

XSRF attacks trick users into performing actions on web sites, such as making purchases, without their knowledge

79
Q

Framework

A

A structure used to provide a foundation

Cyber security frameworks typically use a structure of basic concepts and provide guidance to professionals on how to implement security

80
Q

Regulatory

A

Filler

81
Q

Non-regulatory

A

Filler

82
Q

National Versus International

A

Filler

83
Q

Industry-Specific

A

Filler

Security+ SYO-501 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions