Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Computer Studies > CYBRSCRTY-MODULE 2 > Flashcards

CYBRSCRTY-MODULE 2 Flashcards

1
Q

Benchmark/secure configuration guides

A

Guidelines for configuring a device or software usually distributed by hardware manufacturers and software developers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Adversary tactics, techniques, and procedures (TTP)

A

A database of the behavior of threat actors and how they orchestrate and manage attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Black box

A

A penetration testing level in which the testers have no knowledge of the network and no special privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Blue Team

A

A penetration testing team that monitors for Red Team attacks and shores up defenses as necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Bug bounty

A

A monetary reward given for uncovering a software vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Center for Internet Security (CIS)

A

A nonprofit community-driven organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Cleanup

A

Returning all systems back to normal following a penetration test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cloud Controls Matrix

A

A specialized framework of cloud-specific security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Cloud Security Alliance (CSA)

A

An organization whose goal is to define and raise awareness of best practices to help secure cloud computing environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Common Vulnerabilities and Exposures (CVE)

A

A tool that identifies vulnerabilities in operating systems and application software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Common Vulnerability Scoring System (CVSS)

A

A numeric rating system of the impact of a vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Configuration review

A

An examination of the software settings for a vulnerability scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Credentialed scan

A

A scan in which valid authentication credentials, such as usernames and passwords, are supplied to the vulnerability scanner to mimic the work of a threat actor who possesses these credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Drone

A

An unmanned aerial vehicle (UAV) without a human pilot on board to control its flight

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

European Union General Data Protection Directive (GDPR)

A

A regulation regarding data protection and privacy in the European Union and the European Economic Area (EEA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

False negative

A

Failure to raise an alarm when there is a problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

False positive

A

Raising an alarm when there is no problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Footprinting

A

Gathering information from outside the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Framework

A

A series of documented processes used to define policies and procedures for implementation and management of security controls in an enterprise environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Fusion center

A

A formal repository of information from enterprises and the government used to share information on the latest attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Gray box

A

A penetration testing level in which the testers are given limited knowledge of the network and some elevated privileges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Intrusive scan

A

A vulnerability scan that attempts to employ any vulnerabilities which it finds, much like a threat actor would

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ISO 27001

A

A standard that provides requirements for an information security management system (ISMS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

ISO 27002

A

A “code of practice” for information security management within an organization and contains 114 different control recommendations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ISO 27701

A

An extension to ISO 27001 and is a framework for managing privacy controls to reduce the risk of privacy breach to the privacy of individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

ISO 31000

A

A standard that contains controls for managing and controlling risk

26
Q

Lateral movement

A

Moving through a network looking for additional systems threat actors can access from their elevated position

27
Q

Log

A

A record of events that occur

28
Q

Log reviews

A

An analysis of log data

29
Q

Maneuvering

A

Conducting unusual behavior when threat hunting

30
Q

NIST Cybersecurity Framework (CSF)

A

A measuring stick against which companies can compare their cybersecurity practices relative to the threats they face

31
Q

NIST Risk Management Framework (RMF)

A

A guidance document designed to help organizations assess and manage risks to their information systems

32
Q

Non-credentialed scan

A

A vulnerability scan that provides no authentication information to the tester

33
Q

Nonintrusive scan

A

A vulnerability scan that does not attempt to exploit the vulnerability but only records that it was discovered

34
Q

Open source intelligence (OSINT)

A

Publicly accessible information

35
Q

Passive reconnaissance

A

Searching online for publicly accessible information

36
Q

Payment Card Industry Data Security Standard (PCI DSS)

A

A compliance standard to provide a minimum degree of security for handling customer card information

37
Q

Penetration testing

A

A type of test that attempts to exploit vulnerabilities just as a threat actor would

38
Q

Persistence

A

A process in which a load balancer creates a link between an endpoint and a specific network server for the duration of a session

39
Q

Pivot

A

Turning to other systems to be compromised

40
Q

Platform/vendor-specific guides

A

Guidelines that only apply to specific products

41
Q

Privilege escalation

A

Moving to more advanced resources that are normally protected from an application or user

42
Q

Purple Team

A

A penetration testing team that provides real-time feedback between the Red and Blue teams to enhance the testing

43
Q

Red Team

A

A penetration testing team that scans for vulnerabilities and then exploits them

44
Q

Reference architecture

A

An authoritative source of information

45
Q

Regulations

A

Standards typically developed by established professional organizations or government agencies using the expertise of seasoned security professionals

46
Q

Request for comments (RFC)

A

Documents that are authored by technology bodies employing specialists, engineers, and scientists who are experts in those areas

47
Q

Rules of engagement

A

Limitations or parameters in a penetration test

48
Q

Security Information and Event Management (SIEM)

A

A tool that consolidates real-time security monitoring and management of security information with analysis and reporting of security events

49
Q

Security, Orchestration, Automation, and Response (SOAR)

A

A tool designed to help security teams manage and respond to the very high number of security warnings and alarms by combining comprehensive data gathering and analytics in order to automate incident response

50
Q

Sentiment analysis

A

The process of computationally identifying and categorizing opinions, usually expressed in response to textual data, in order to determine the writer’s attitude toward a particular topic

51
Q

SSAE SOC 2 Type II

A

A standard for reports on internal controls that reviews how a company safeguards customer data and how well those controls are operating

52
Q

SSAE SOC 2 Type III

A

A standard for reports on internal controls that can be freely distributed

53
Q

Standard

A

A document approved through consensus by a recognized standardization body

54
Q

Threat feeds

A

Cybersecurity data feeds that provide information on the latest threats

55
Q

Threat hunting

A

Proactively searching for cyber threats that thus far have gone undetected in a network

56
Q

Unmanned Aerial Vehicle (UAV)

A

An aircraft without a human pilot on board to control its flight

57
Q

User behavior analysis

A

Looking at the normal behavior of users and how they interact with systems to create a picture of typical activity

58
Q

Vulnerability feeds

A

Cybersecurity data feeds that provide information on the latest vulnerabilities

59
Q

Vulnerability scan

A

A frequent and ongoing process, often automated, that continuously identifies vulnerabilities and monitors cybersecurity progress

60
Q

War driving

A

Searching for wireless signals from an automobile or on foot while using a portable computing device

61
Q

War flying

A

An efficient means of discovering a Wi-Fi signal using drones

62
Q

White box

A

A penetration testing level in which the testers are given full knowledge of the network and the source code of applications

63
Q

White Team

A

A penetration testing team that enforces the rules of the penetration testing

Computer Studies (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions