Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMPtia Security + > DOMAIN 1 > Flashcards

DOMAIN 1 Flashcards

1
Q

SOCIAL ENGINEERING

A

an attempt by an attacker to convince someone to provide info (like a password) or
perform an action they wouldn’t normally perform (such as clicking on a malicious link).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

PHISHING

A

commonly used to try to trick users into giving up personal information (such as user
accounts and passwords), click a malicious link, or open a malicious attachment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SPEAR PHISHING

A

targets specific groups of users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

WHALING

A

targets high level executives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

VISHING

A

(voice phishing) phone based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SMISHING

A

uses SMS (text) messaging on mobile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SPAM

A

Unsolicited email, generally
considered an irritant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SPIM

A

SPAM over instant messaging, also
generally considered an irritant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

DUMPSTER DIVING

A

Gathering important details (intelligence) from
things that people have thrown out in their trash.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

TAILGATING

A

when an unauthorized individual might
follow you in through that open door
without badging in themselves.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ELICITING INFORMATION

A

strategic use of casual conversation
to extract information without the
arousing suspicion of the target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SHOULDER SURFING

A

a criminal practice where thieves
steal your personal data by spying
over your shoulder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PHARMING

A

an online scam
similar to phishing, where
a website’s traffic is manipulated, and
confidential information is stolen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IDENTITY FRAUD

A

use of another person’s
personal information,
without authorization, to commit a crime or to
deceive or defraud that person or other 3rd party.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

PREPENDING

A

Prepending is adding words or phrases like “SAFE”
to a malicious file or suggesting topics via social
engineering to uncover information of interest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

INVOICE SCAMS

A

fake invoices with a goal of receiving money or
by prompting a victim to put their credentials
into a fake login screen.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

CREDENTIAL HARVESTING

A

attackers trying to gain access to your
usernames and passwords that might be
stored on your local computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PASIVE DISCOVERY

A

Techniques that DO NOT send packets to the target; like Google hacking, phone
calls, DNS and WHOIS lookups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SEMI-PASSIVE DISCOVERY

A

Touches the target with packets in a non
aggressive fashion to avoid raising
alarms of the target.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ACTIVE DISCOVERY

A

More aggressive techniques likely to be noticed by the target, including port
scanning, and tools like nmap and Metaspoit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

HOAXES

A

Intentional falsehoods coming in a variety of forms ranging from virus
hoaxes to fake news. Social media plays a prominent role in hoaxes today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IMPERSONATION

A

A form of fraud in which attackers pose as a known or trusted person to
dupe the user into sharing sensitive info, transferring money, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

WATERING HOLE ATTACK

A

Attack strategy in which an attacker guesses or observes which websites an
organization often uses and infects one or more of them with malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

TYPOSQUATTING
aka “URL hijacking”

A

a form of cybersquatting (sitting on
sites under someone else’s brand or
copyright) targeting users who type
an incorrect website address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PRESTEXTING

A

An attacker tries to convince a victim to give up
information of value, or access to a service or system. The attacker develops a story, or pretext, in order to fool the victim.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

INFLUENCE CAMPAIGNS

A

A social engineering attack intended to manipulate
the thoughts and minds of large groups of people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

HYBRID WARFARE

A

Attack using a mixture of conventional and unconventional
methods and resources to carry out the campaign. Including:

  • SOCIAL MEDIA: May use multiple social platforms leveraging multiple/many
    individuals to amplify the message, influencing credibility.
    May involve creating multiple fake accounts to post content and
    seed the spread. And may even include paid advertising.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

PRINCIPLES OF SOCIAL ENGINEERING

A
  • Authority
  • Intimidation
  • Consensus
  • Scarcity
  • Familiarity aka “liking”
  • Trust
  • Urgency
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

APPLICATION ATTACKS

A

attacks attackers use to exploit
poorly written software .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

ROOTKIT (escalation of privilege)

A

freely available on the internet and exploit known vulnerabilities in various
operating systems enabling attackers to elevate privilege.

Countermeasures: keep security patches up
to date
anti
malware software, EDR/XDR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

BACK DOOR

A

undocumented command sequences that allow individuals with knowledge
of the back door to bypass normal access restrictions.
often used in development and debugging.

Countermeasures: firewalls, anti
malware, network monitoring, code review.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

COMPUTER VIRUS

A

a type of malicious code or program written to
alter the way a computer operates and is designed
to spread from one computer to another.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

TYPES OF VIRUSES

A

Crypto-malware
Hoaxes
Logic Bombs
Trojan Horse

34
Q

TYPES OF MALWARE

A
  • Worm
  • Potentially Unwanted Programs (PUPs)
  • Keylogger
  • Spyware
  • Fileless virus
  • Command and control
  • Remote access trojan (RAT)
  • Ransomware
35
Q

FILELESS VIRUS

A

a type of malicious software that does not rely on virus
laden files to infect a
host. Instead, it exploits applications that are commonly used for legitimate
and justified activity to execute malicious code in resident memory.

36
Q

COMMAND AND CONTROL

A

a computer controlled by an attacker or cybercriminal which is used to send
commands to systems compromised by malware and receive stolen data
from a target network.

37
Q

REMOTE ACCESS TROJAN

A

a malware program that gives an intruder administrative control over a
target computer.

38
Q

RANSOMWARE

A

infects a target machine and then uses encryption
technology to encrypt documents, spreadsheets,
and other files stored on the system with a key
known only to the malware creator.
user is then unable to access their files and receives
an ominous pop up message warning that
the files will be permanently deleted unless a
ransom is paid within a short period of time.

  • Ransomware is a trojan variant.
39
Q

RANSOMWARE OCUNTERMEASURES

A
  • Back up your computer
  • Store backups separately
  • File auto
    versioning
40
Q

RANSOMWARE PREVENTION

A
  • Update and patch computers
  • Use caution with web links
  • Use caution with email attachments
  • Verify email senders
  • Preventative software programs
  • User awareness training (Most important defense).
41
Q

PASSWORD ATTACKS

A
  • Dictionary Attacks
  • Password Spraying
  • Offline
  • Online
  • Plaintext/unencrypted
  • Brute Force Attack
  • SALTS Cryptographic
42
Q

DICTIONARY ATTACKS

A

Use programs with built in dictionaries.
They attempt all dictionary words to try and find the
correct password, in the hope that a user would have
used a standard dictionary word.

43
Q

PASSWORD SPRAYING

A

Attacker tries a password against many different
accounts to avoid lockouts that typically come when
brute forcing a single account.
Succeeds when admin or application sets a default
password for new users

44
Q

OFFLINE

A

Attempt to discover passwords from a captured database or
captured packet scan.

45
Q

ONLINE

A

Attempts to discover a password from an online system. For
example, an attacker trying to log on to an account by trying to
guess a user’s password.

*Most web and wi-fi attacks are online attacks.

46
Q

PLAINTEXT/UNENCRYPTED

A

Protocols and authentication methods that leave credentials unencrypted,
like basic authentication and telnet.

47
Q

BRUTE FORCE ATTACK

A

Attempts to randomly find the correct cryptographic key
attempting all possible combinations (trial and error).
Password complexity and attacker resources will determine
effectiveness of this attack.

48
Q

SALTS Cryptographic

A

Attackers may use
rainbow tables , which contain
precomputed values of cryptographic hash
functions to identify commonly used passwords
A
salt is random data that is used as an additional
input to a one way function that hashes data, a
password or passphrase.
Adding salts to the passwords before hashing
them reduces the effectiveness of rainbow table
attacks.

49
Q

MULTI-FACTOR AUTHENTICATION

A
  • Something you KNOW (pin or password)
  • Something you HAVE (trusted device)
  • Something you ARE (biometric)

*Multi-factor Authentication prevents:

  • Phishing
  • Spear phishing
  • Keyloggers
  • Credential stuffing
  • Brute force and reverse brute force attacks
  • Man-in-the-middle (MITM) attacks
50
Q

BOTS, BOTNETS, AND BOT HERDERS

A

Represent significant threats due to the massive
number of computers that can launch attacks

51
Q

BOTNET

A

a collection of compromised computing devices
(often called bots or zombies).

52
Q

BOT HERDER

A

criminal who uses a command
and control server
to remotely control the zombies
often use the botnet to launch attacks on other
systems, or to send spam or phishing emails.

53
Q

PHYSICAL ATTACKS

A
  • Malicious Flash Drive
  • Malicious USB cable
  • Card cloning
  • Skimming
54
Q

MALICIOUS FLASH DRIVE

A

Attack c
omes in two common forms
Drives dropped where they are likely to be
picked up.
Sometime effectively a trojan, shipped with
malware installed after leaving the factory.

55
Q

MALICIOUS USB CABLE

A

Less likely to be noticed than a
flash drive.
May be configured to show up as a human
interface device (e.g. keyboard).

56
Q

CARD CLONING

A

Focuses on capturing
info from cards used for
access, like RFID and magnetic stripe cards.

57
Q

SKIMMING

A

Involve fake card readers or social
engineering and handheld readers to
capture (skim) cards, then clone so
attacker may use for their own purposes.

*Device (
skimmer) often installed at
POS devices like ATM and gas pumps.

58
Q

ADVERSARIAL ARTIGICIAL INTELLIGENCE

A

A rapidly developing field targeting AI and Machine Learning (ML).

59
Q

TAINTED TRAINING DATA FOR MACHINE LEARNING (ML)

A

Data poisoning that supplies AI and ML algorithms with adversarial
data that serves the attackers purposes, or attacks against privacy.

60
Q

SECURITY OF MACHINE LEARNING ALGORITHMS

A

Validate quality and security of the data sources.
Secure infrastructure and environment where AI and ML is hosted.
Review, test, and document changes to AI and ML algorithms.

61
Q

ARTIFICIAL INTELLIGENCE

A

Focuses on accomplishing “smart” tasks
combining machine learning and deep
learning to emulate human intelligence

62
Q

MACHINE LEARNING

A

A subset of
AI, computer algorithms that
improve automatically through experience
and the use of data.

63
Q

DEEP LEARNING

A

a subfield of machine learning concerned with
algorithms inspired by the structure and function
of the brain called artificial neural networks.

64
Q

SUPPLY CHAIN ATTACKS

A

a cyber-attack that seeks to damage an organization
by targeting less-secure elements in the supply chain. Often attempt to compromise devices, systems, or software
before it reaches an organization.

65
Q

CLOUD-BASED ATTACKS

A

Data center is often more secure and less
vulnerable to disruptive attacks (like DDoS)
On the downside, you will not have facility
level or physical system level audit access.

66
Q

ON-PREMISES ATTACKS

A

You do not benefit from the cloud’s shared
responsibility model.
You have more control but are responsible for
security of the full stack.

67
Q

COLLISION ATTACK

A

attack on a cryptographic hash to find
two inputs that produce the same
hash value
beat with collision resistant hashes

68
Q

DOWNGRADE ATTACK

A

when a protocol is downgraded
from a higher mode or version to a
low quality mode or lower version.

*Commonly targets
TLS.

69
Q

BIRTHDAY ATTACK

A

an attempt to find collisions in hash
functions.

*Commonly targets digital signatures

70
Q

REPLAY ATTACK

A

an attempt to reuse authentication
requests.

*Targets authentication (
often
Kerberos).

71
Q

APPLICATION ATTACKS

A

A security hole created when code is
executed with higher privileges than
those of the user running it.

72
Q

PRIVILEGE ESCALATION

A

a type of injection using malicious scripts

73
Q

CROSS-SITE SCRIPTING (XXS)

A

A type of injection, in which malicious scripts are injected into
otherwise benign and trusted websites.
Occur when an attacker uses a web application to send
malicious code to a different end user.

74
Q

CROSS-SITE REQUEST FORGERY (XSRF OR CSRF)

A

similar to cross-site scripting attacks but exploits a different
trust relationship.
exploits trust a website has for your browser to execute code
on the user’s computer.

75
Q

DYNAMIC-LINK LIBRARY (DLL)

A

Is a situation in which the malware tries to inject code into the memory process
space of a library using a vulnerable/compromised DLL.

76
Q

LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL (LDAP)

A

exploits weaknesses in LDAP implementations.
This can occur when the user’s input is not properly filtered, and the result can be
executed commands, modified content, or results returned to unauthorized queries.

77
Q

EXTENSIBLE MARKUP LANGUAGE (XML)

A

when users enter values that query XML (known as XPath) with values that take
advantage of exploits, it is known as an XML injection attack.
XPath works in a similar manner to SQL, except that it does not have the same levels
of access control, so exploits can return entire documents.

78
Q

INJECTIONS (INJECTION ATTACKS)

A

used to compromise web front-end and backend databases.

79
Q

SQL INJECTION ATTACKS

A

Use unexpected input to a web application to gain
unauthorized access to an underlying database.

*NOT new and can be prevented
through good code practices.

80
Q

POINTER/OBJECT DEREFERENCE

A

An attack that consists of finding null references in a target program
and dereferencing them, causing an exception to be generated.

*Dereferencing means taking away the reference and
giving you what it was actually referring to.
*GOOD coding is the best protection.

81
Q
A

COMPtia Security + (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions