CompTIA CySA+ CS0-003 Deck 6 Flashcards
Learn key concepts found in the CompTIA CySA+ CS0-003 Exam.
(ISO)
International Organization for Standardization
(ISO) International Organization for Standardization
Develops many standards and frameworks governing the use of computers, networks, and telecommunications, including ones for information security (27K series) and risk management (31K series).
(OWASP)
Open Web Application Security Project
(OWASP) Open Web Application Security Project
A charity and community publishing a number of secure application development resources.
(CIS)
Center for Internet Security
(CIS) Center for Internet Security
A not-for-profit organization (founded partly by SANS). It publishes the well-known “Top 20 Critical Security Controls” (or system design recommendations).
(PCI DSS)
Payment Card Industry Data Security Standard
(PCI DSS) Payment Card Industry Data Security Standard
Information security standard for organizations that process credit or bank card payments.
What is the name of the document designed to demonstrate an organization’s compliance with PCI DSS requirements?
Attestation of Compliance
Vulnerability Scanner
Hardware or software configured with a list of known weaknesses and exploits and can scan for their presence in a host OS or particular application.
Fingerprinting
Identifying the type and version of an operating system (or server application) by analyzing its responses to network scans.
Static Analysis
The process of reviewing uncompiled source code either manually or using automated tools.
Dynamic Analysis
Software testing that examines code behavior during runtime. It helps identify potential security issues, potential performance issues, and other problems.
Fuzzing
A dynamic code analysis technique that involves sending a running application random and unusual input so as to evaluate how the app responds.
Reverse Engineering
The process of analyzing the structure of hardware or software to reveal more about how it functions.
What type of scanning describes indirect methods of assessment, such as inspecting traffic flows and protocols?
Passive Scanning
______________describes the effort taken to more specifically identify details about a device.
Fingerprinting
A configuration ____________details the recommended settings for services and policy configuration for a device or software operating in a specific role.
Baseline
Segmentation
Enforcing a security zone by separating a segment of the network from access by the rest of the network. This could be accomplished using firewalls or VPNs or VLANs. A physically separate network or host (with no cabling or wireless links to other networks) is referred to as air-gapped.
(OT)
Operational technology
(OT) Operational technology
Communications network designed to implement an industrial control system rather than data networking.
(ICSs)
Industrial Control Systems
(ICSs) Industrial Control Systems
Network managing embedded devices (computer systems that are designed to perform a specific, dedicated function).
(HMIs)
Human-Machine Interfaces
(HMIs) Human-Machine Interfaces
Input and output controls on a PLC to allow a user to configure and monitor the system.
Data Historian
Software that aggregates and catalogs data from multiple sources within an industrial control system.
(SCADA)
Supervisory Control and Data Acquisition
(SCADA) Supervisory Control and Data Acquisition
Type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographically large areas from a host computer.
(PLCs)
Programmable Logic Controllers
(PLCs) Programmable Logic Controllers
Type of processor designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems.
(SCAP)
Security Content Automation Protocol
(SCAP) Security Content Automation Protocol
A NIST framework that outlines various accepted practices for automating vulnerability scanning.
(OVAL)
Open Vulnerability and Assessment Language
(OVAL) Open Vulnerability and Assessment Language
An XML schema, maintained by MITRE, for describing system security state and querying vulnerability reports and information.
(CPE)
Common Platform Enumeration
(CPE) Common Platform Enumeration
Scheme for identifying hardware devices, operating systems, and applications developed by MITRE.
(CVE)
Common Vulnerabilities and Exposures
(CVE) Common Vulnerabilities and Exposures
Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
(CCE)
Common Configuration Enumeration
(CCE) Common Configuration Enumeration
Scheme for provisioning secure configuration checks across multiple sources developed by MITRE and adopted by NIST.
(CVSS)
Common Vulnerability Scoring System
(CVSS) Common Vulnerability Scoring System
A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.
What is the attack complexity identified in the following vector? CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High
What is the impact to integrity identified in the following vector? CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High
Physical (P), Local (L), Adjacent network (A), or Network (N) are all values for which base metric?
Attack Vector (AV)
This describes when a vulnerability scan incorrectly indicates that a vulnerability or misconfiguration is present when it is not.
False positive
What type of vulnerability cannot be detected by vulnerability scanning tools?
Zero-Day
The three categories in a CVSS score include impact, exploitability, and __________________.
Remediation
What dashboards provide a live view of critical data and are composed of graphs, charts, status indicators, and other visual representations?
Vulnerability Reporting Dashboards
What assessment measures the risk posed by a particular system, application, or individual vulnerability in terms of being successfully hacked or breached?
Risk Score
Memorandum of Understanding (MoU)
Usually a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve the exchange of money.
(MoU)
Memorandum of Understanding
(SLA)
(SLA) Service-Level Agreement
An agreement that sets the service requirements and expectations between a consumer and a provider.
