Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cat's Cysa+ > CySA+ 100 > Flashcards

CySA+ 100 Flashcards

1
Q

What are the three key objectives of information security?

A

Confidentiality, integrity, and availability (CIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Risk exists at the intersection of _______ and _________.

A

Threats and vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the overall risk rating for a risk that has medium likelihood and high impact?

A

High

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What type of system controls access to a network based on criteria such as time of day, location, device type, and system health?

A

Network access control (NAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the three networks typically connected to a triple-homed firewall?

A

The Internet, an internal network, and a DMZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the TCP port for the HTTP protocol?

A

80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the TCP port for the HTTPS protocol?

A

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the four types of firewalls?

A

Packet filters, stateful inspection firewalls, next-generation firewalls, and web application firewalls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

______ may be used to apply settings to many different Windows systems at the same time.

A

Group Policy Objects (GPOs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the four phases of penetration testing?

A

Planning, Discovery, Attack, and Reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What type of software can you use to enumerate the services that are accepting network connections on a remote system without probing that system for vulnerabilities?

A

Port scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the range of well-known ports?

A

0–1023

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the range of registered ports?

A

1024–49151

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the most commonly used port scanner?

A

nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What Cisco logging level indicates a critical event?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What service is responsible for resolving domain names to IP addresses?

A

DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What tool can be used to determine the path between two systems over the Internet?

A

Traceroute or tracert, depending on the operating system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What service allows you to look up the registered owner of a domain name?

A

whois

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What type of data analysis looks for differences from expected behaviors?

A

Anomaly analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What type of data analysis predicts threats based on existing data?

A

Trend analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What regulation requires vulnerability scans for organizations involved in credit card processing?

A

PCI DSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What regulation requires vulnerability scanning for federal government agencies?

A

FISMA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What type of vulnerability scan leverages read-only access to the scan target?

A

Credentialed scan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What term is used to describe an organization’s willingness to tolerate risk?

A

Risk appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What type of account should be used to perform credentialed vulnerability scans?

A

Read-only account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What function is performed by QualysGuard, Nessus, Nexpose, and OpenVAS?

A

Vulnerability scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the purpose of Nikto and Acunetix?

A

Web application scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What criteria should be used in prioritizing the remediation of vulnerabilities?

A

Criticality, difficulty, severity, and exposure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What industry-standard system is used to assess the severity of security vulnerabilities?

A

CVSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the CVSS score ranges?

A

Under 4.0 is low, 4.0–5.9 is medium, 6.0–9.9 is high, and 10.0 is critical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the term used to describe when a scanner reports a vulnerability that does not really exist?

A

False positive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What type of vulnerability allows an attacker to place more data into an area of memory than is allocated for a specific purpose?

A

Buffer overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What type of attack seeks to increase the level of access that an attacker has to a targeted system?

A

Privilege escalation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What type of attack allows an attacker to run software of his or her choice on the targeted system?

A

Arbitrary code execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the current secure standard for providing HTTPS encryption?

A

TLS 1.2 or later

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

In what type of attack does the attacker sends spoofed DNS requests to a DNS server that are carefully designed to elicit responses that are much larger in size than the original requests?

A

DNS amplification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What term is used to describe any observable occurrence in a system or network that relates to a security function?

A

Security event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What term is used to describe a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices?

A

Security incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the phases of incident response?

A

Preparation; Detection & Analysis; Containment, Eradication, & Recovery; and Post-Incident Activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What type of documents provide the detailed, tactical information that CSIRT members need when responding to an incident?

A

Procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What document serves as the cornerstone of an organization’s incident response program?

A

Incident Response Policy

42
Q

What type of threat consists of highly skilled and talented attackers focused on a specific objective?

A

Advanced Persistent Threat (APT)

43
Q

What are the types of impact used to describe the scope of a security incident?

A

Functional impact, economic impact, and recoverability effort

44
Q

What are the common attack vectors for security incidents?

A

Common attack vectors for security incidents include external/removable media, attrition, the web, email, impersonation, improper usage, loss or theft of equipment, and other/unknown sources.

45
Q

What Linux command displays processes, memory utilization, and other detail about running programs?

A

top or ps

46
Q

What term is used to describe traffic sent to a command and control system by a PC that is part of a botnet?

A

Beaconing

47
Q

What Windows tool provides information on memory, CPU, and disk use?

A

Perfmon

48
Q

What protocol is used to gather information about and manage network devices?

A

SNMP

49
Q

What Linux command allows you to list the files that are open by processes on a system?

A

lsof

50
Q

What type of information is found in network flow data?

A

Flow data provides information about the source and destination IP address, protocol, and total data sent.

51
Q

What protocol is used to ensure that all security devices on a network have synchronized clocks?

A

NTP

52
Q

What tool can administrators use to determine the maximum bandwidth available on a network connection?

A

iPerf

53
Q

What is the purpose of FTK, EnCase, SIFT, and the Sleuth Kit (TSK)?

A

Forensic toolkits

54
Q

What type of device is designed to copy drives for forensic investigation, and then provide validation that the original drive and the content of the new drive match?

A

Forensic drive duplicator

55
Q

Where can forensic analysts turn to find point-in-time information from prior actions on a Windows system?

A

Volume shadow copies

56
Q

Where can forensic analysts turn to find information about logins, service start/stop events, and evidence of applications being run on a Windows system?

A

Event logs

57
Q

What Linux utility is commonly used to clone drives in RAW format?

A

dd

58
Q

What type of device can ensure that attaching a drive to a forensic copy device or workstation does not result in modifications being made to drive, thus destroying the forensic integrity of the process?

A

Write blocker

59
Q

What Linux kernel modules allow forensic access to physical memory?

A

fmem and LiME

60
Q

What tool provides a list of USB devices that have been connected to a Windows system?

A

USB Historian

61
Q

What is the first action that incident responders should take after identifying a potential incident?

A

Contain the damage

62
Q

Network segmentation, isolation, and removal of affected systems are examples of ___________ strategies

A

Containment

63
Q

Once responders have contained the damage caused by an incident they should move on to __________ and ________ steps.

A

Eradication and recovery

64
Q

At the conclusion of a cybersecurity incident response effort, CSIRT members should conduct a formal ____________ session.

A

Lessons learned

65
Q

What activities should always occur to validate an incident recovery effort?

A

Verify user accounts, verify permissions, verify logging, and conduct vulnerability scans.

66
Q

What are the three options available for the secure disposition of media containing sensitive information?

A

Clear, purge, and destroy

67
Q

What is the focus of the recovery phase of incident response?

A

Restoring normal operations

68
Q

____________ is a time-consuming investigative task that often distracts incident responders and results in dead ends.

A

Identifying the attackers

69
Q

________ are high-level statements of management intent.

A

Policies

70
Q

_______ outline what information the organization will maintain and the length of time different categories of information will be retained prior to destruction.

A

Data retention policies

71
Q

________ provide mandatory requirements describing how an organization will carry out its information security policies.

A

Standards

72
Q

__________ are detailed, step-by-step processes that individuals and organizations must follow in specific circumstances.

A

Procedures

73
Q

_________ provide best practices and recommendations related to a given concept, technology, or task.

A

Guidelines

74
Q

Many exception processes require the use of ___________________ to mitigate the risk associated with exceptions to security standards.

A

Compensating controls

75
Q

What law includes security and privacy rules for protected health information?

A

HIPAA

76
Q

What law applies to the financial records of publicly traded companies?

A

Sarbanes–Oxley

77
Q

__________ provides the same level of protection to all systems or networks.

A

Uniform protection

78
Q

What type of controls include firewalls, intrusion detection and prevention systems, network segmentation, and authentication and authorization systems?

A

Technical (or logical) controls

79
Q

What type of controls involve processes and procedures like those found in incident response plans, account creation and management, as well as awareness and training efforts?

A

Administrative (or managerial) controls

80
Q

What type of controls include locks, fences, and other controls that control or limit physical access, as well as controls like fire extinguishers that can help to prevent harm to property?

A

Physical controls

81
Q

_____________ are intended to stop an incident from occurring by taking proactive measures to stop the threat

A

Preventive controls

82
Q

A _______ is often used when services or systems need to be exposed to lower trust areas

A

DMZ

83
Q

___________ is important to ensure continuity for roles, regardless of the reason a person leaves your organization.

A

Succession planning

84
Q

What are the three types of views that can commonly be taken to review a security architecture design?

A

Operational views, technical views, and logical views

85
Q

What term is used to describe the set of claims made about an individual or account holder that are made about one party to another party?

A

Identities

86
Q

What are the three elements of the AAA framework?

A

Authentication, authorization, and accounting

87
Q

What is the purpose of TACACS+, RADIUS, and Kerberos?

A

Authentication

88
Q

What authorization standard is used by many websites to allow users to share elements of their identity or account information while authenticating via the original identity provider?

A

OAuth

89
Q

In Kerberos, what type of ticket allows complete access to the Kerberos connected systems, including creation of new tickets, account changes, and even falsification of accounts or services?

A

Ticket Granting Ticket (TGT)

90
Q

What service is the core identity store and AAA service in most Windows-centric organizations?

A

Active Directory

91
Q

__________ is the steady accrual of additional rights over time as account owners change roles, positions, or responsibilities.

A

Privilege creep

92
Q

What are the steps of the account life cycle?

A

Create account and set password; provision services; modify and maintain account; disable account; retire and deprovision account.

93
Q

What are the stages of the software development life cycle?

A

Planning, Requirements, Design, Coding, Testing, Training and Transition, Ongoing Operations and Maintenance, End-of-Life Decommissioning

94
Q

The _______ phase of the SDLC includes actual coding of the application.

A

Development

95
Q

What are the three types of system environments commonly used in organizations?

A

Development, Test, and Production

96
Q

In the _______ software development model, each phase follows sequentially and phases do not overlap.

A

Waterfall

97
Q

The _______ software development model is an iterative and incremental process.

A

Agile

98
Q

During the _______ phase of software development, security practitioners may be asked to participate in initial assessments or cost evaluations.

A

Feasibility

99
Q

____________ is a form of structured, formal code review intended to find a variety of problems during the development process.

A

Fagan inspection

100
Q

What testing technique involves sending invalid or random data to an application to test its ability to handle unexpected data?

A

Fuzz testing or fuzzing

Cat's Cysa+ (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions