Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ISYS 4013 - PRINCIPLES DATA/CYBERSECURITY > Exam 2 (Material from Chapters 5 - 9ish) > Flashcards

Exam 2 (Material from Chapters 5 - 9ish) Flashcards

1
Q

What are the layers of the OSI model?

A

Layer 7: Application
Layer 6: Presentation
Layer 5: Session
Layer 4: Transport
Layer 3: Network
Layer 2: Data Link
Layer 1: Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Explain the function of each layer of the OSI model?

A

Layer 7: Application - User interface
Layer 6: Presentation - Data format; encryption
Layer 5: Session - process-to-process communication
Layer 4: Transport - end-to-end communication
Layer 3: Network - routing data; logical addressing; WAN delivery
Layer 2: Data Link - Physical addressing; LAN delivery
Layer 1: Physical - Signaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between a WAN and a LAN?

A

Wide area networks (WANs)
- Connect systems over a large geographic area
Local area networks (LANs)
- Provide network connectivity for computers located in the same geographic area

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some WAN Connectivity Options?

A

Cable modem
Digital subscriber line (DSL)
Fiber optics
Satellite
Dialup
Cellular 3G/4G/5G networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the Ethernet standard?

A
  • Defines how computers use Media Access Control (MAC) addresses to communicate with each other on the network
  • Governs both the Physical and Data Link layers of the OSI Reference Model
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a hub?

A
  • Contain a number of plugs, or ports, where you can connect Ethernet cables for different network systems
  • Echo incoming packets to all ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a switch?

A
  • Perform intelligent filtering
  • Know the MAC address of the system connected to each port
  • When a switch receives a packet on the network, they look at the destination MAC address and send the packet only to the port where the destination system resides
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a virtual LAN?

A
  • A collection of logically related network devices that are viewed as a partitioned network segment
  • Give administrators the ability to separate network segments without having to physically separate the network cabling
  • Can be used to isolate logical groups of devices to reduce network traffic and increase security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Transmission Control Protocol/Internet Protocol (TCP/IP) and How It Works

A
  • A suite of protocols that operate at both the Network and Transport layers of the OSI Reference Model
  • Governs all activity across the Internet and through most corporate and home networks
  • Developed by the Department of Defense to provide a highly reliable and fault-tolerant network infrastructure (security was not a focus)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Internet Protocol version 4 (IPv4) addresses
are how many bytes long?

A

Four bytes or 32bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Internet Protocol version 6 (IPv6) addresses
are how many bits long?

A

128 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Are IPv4 or IPv6 addresses more secure?

A

IPv6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is DHCP?

A

Dynamic Host Configuration Protocol (DHCP)
- Allows each computer to get its configuration information dynamically from the network instead of manually
- Provides a computer with an IPv4 address, subnet mask, and other essential communication information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is port 20?

A

File Transfer Protocol (FTP) data transfer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is port 21?

A

File Transfer Protocol (FTP) control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is port 22?

A

Secure Shell (SSH)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is port 25?

A

Simple Mail Transfer Protocol(SMTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is port 53?

A

Domain Name System(DNS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is port 80?

A

Hypertext Transport Protocol (HTTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is port 110?

A

Post Office Protocol v3 (POP3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is port 139?

A

Network Basic Input/Output System (NetBIOS) Session Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is port 143?

A

Internet Message Access Protocol (IMAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is port 443?

A

HTTP over Secure Sockets Layer (SSL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is port 989?

A

File Transfer Protocol over SSL/Transport Layer security (FTPS) for data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is port 53?

A

Domain Name Service (DNS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is port 990?

A

File Transfer Protocol over SSL/Transport Layer security (FTPS) for control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is port 161?

A

Simple Network Management Protocol (SNMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is ICMP?

A

Internet Control Message Protocol (ICMP)

  • A management and control protocol for IP
  • Delivers messages between hosts about the health of the network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Attackers can use ICMP to create a _____ attack against a network

A

denial of service (DoS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What tools use ICMP?

A

Ping and Traceroute

  • Ping sends a single packet to a target IP address (ICMP echo request)
  • Traceroute uses ICMP echo request packets to identify the path that packets travel through a network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is reconnaissance?

A

The act of gathering information about a network for use in a future attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is Eavesdropping?

A

When an attacker taps the data cable to see all data passing through it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is DoS

A

Flooding a network with traffic and shutting down a single point of failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Distributed DoS (DDoS)?

A

Uses multiple compromised systems to flood the network from many different directions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Telephony denial of service (TDoS)

A

Attempts to prevent telephone calls from being successfully initiated or received by some person or organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are three basic Network Security Defense tools?

A
  • Firewalls
  • VPNs
  • Network access control (NAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is a firewall?

A

A firewall controls the flow of traffic by preventing unauthorized network traffic from entering or leaving a particular portion of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are three important firewall security features and explain them.

A

Flood guard
Loop protection
Network segmentation

Flood guard: Rules can limit traffic bandwidth from hosts, reducing the ability for any one host to flood a network

Loop protection: Firewalls can look at message addresses to determine whether a message is being sent around an unending loop (for example, from another form of flooding)

Network segmentation: Filtering rules enforce divisions between networks, keeping traffic from moving from one network to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are three types of firewalls?

A

Packet filtering
Stateful inspection
Application proxy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are four firewall deployment techniques?

A

Border firewalls
Screened subnet (or demilitarized zone [DMZ]) firewalls
Multilayered firewalls
Unified threat management

*Images of these in Chapter 5 slides number 25-26

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What are URL filters?

A

Filters web traffic by examining the Uniform Resource Locator (URL) as opposed to the IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is content inspection?

A

The device looks at some or all network packet content to determine if the packet should be allowed to pass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Malware inspection ?

A

A specialized form of content inspection, the device looks at packet content for signs of malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are some major VPN technologies in use today?

A

Point-to-Point Tunneling Protocol (PPTP)
Secure Sockets Layer (SSL)/ Transport Layer Security (TLS)
Secure Socket Tunneling Protocol (SSTP)
Internet Protocol Security (IPSec)
OpenVPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is a NAC?

A

Enables you to add more security requirements before allowing a device to connect to your network
Performs authentication and posture checking
IEEE 802.1x standard governs how clients may interact with a NAC device to gain entry to the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is SIP?

A

Securing Session Initiation Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Voice and Video in an IP Network

A

Securing Session Initiation Protocol (SIP) and Voice over IP (VoIP)
- Patch all SIP/VoIP software and network component firmware
- Use virtual LANs (VLANs) to separate voice and video from other network use (i.e., workstations and printers)
- Enforce encrypted VPN use for all remote access (including SIP/VoIP)
- Require end-to-end encryption for all voice or video calls using TLS or Secure Real-Time Transport Protocol (SRTP)
- Enforce strong authentication for all network users
- Use firewalls to protect all SIP/VoIP devices and services
- Harden all SIP/VoIP devices and software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are WAPs?

A

Wireless access points(WAPs)
A radio that sends and receives networking information over the air between wireless devices and the wired network

  • Anyone with a wireless device who is within radio range of a WAP can communicate with and attempt to connect to the network via the device
  • Anyone within radio range of wireless network can capture all data sent on that network if not encrypted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Additional Wireless Security Techniques: Hardware

A

Antenna types
Antenna placement
Power-level controls
Captive portals
Site surveys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Wireless Network Security Controls

A

VPN over wireless
Wireless encryption
WEP (insecure and flawed)
Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)
Wi-Fi Protected Access (WPA), WPA2, WPA3
Service set identifier (SSID) broadcast
MAC address filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is an Access Control?

A

The process of protecting a resource so that it is used only by those allowed to use it
Prevents unauthorized use
Mitigations put in place to protect a resource from a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the Four-Part Access Control?

A

Identification
Authentication
Authorization
Accountability

Identification - Who is asking to access the asset?
Authentication - Can their identities be verified?
Authorization - What, exactly, can the requestor access? And what can they do?
Accountability - How are actions traced to an individual to ensure the person who make data or system changes can be identified?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Policy definition phase

A

Who has access and what systems or resources can they use?
Tied to the authorization phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Policy enforcement phase

A

Grants or rejects requests for access based on the authorizations defined in the first phase
Tied to identification, authentication, and accountability phases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the two types of access controls?

A

Physical and Logical

Physical: Controls entry into buildings, parking lots, and protected areas
Logical: Controls access to a computer system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

A smart card is an example of what type of access control?

A

physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Explain Logical Access Controls

A

Deciding which users can get into a system
Monitoring what each user does on that system
Restraining or influencing a user’s behavior on that system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

The Security Kernel

A

Enforces access control for computer systems
Central point of access control
Implements the reference monitor concept
Mediates all access requests
Permits access only when appropriate rules or conditions are met

  • Image of this on slide 10 of chapter 6
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are the four central components of access controls?

A

Users: People who use the system or processes (subjects)

Resources: Protected objects in the system

Actions: Activities that authorized users can perform on resources

Relationships: Optional conditions that exist between users and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is authorization?

A

The process of deciding who has access to which resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

In most organizations, authorization is based on what?

A

job roles
background screening
and government requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Conditions or policies are decided by what?

A

Individual users (user is assigned privileges; most detailed and difficult to maintain)
Group membership policy
Authority-level policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are some methods used for identification?

A

Username
Smart card
Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are some guidelines for identificaiton?

A

Nonrepudiation
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What are some processes and requirements for authentication?

A

Knowledge: Something you know
Ownership: Something you have
Characteristics: Something unique to you (something you are)
Action/performance: Something you do/how you do it
Behavior: Some observable trait or behavior that is unique to you
Location: Somewhere you are
Relationship: A trusted individual with whom you have a relationship/someone you know

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Authentication by Knowledge examples

A

Password
- Weak passwords easily cracked by brute-force or dictionary attack
- need password best practices
Passphrase
- Stronger than a password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Authentication by Ownership

A

Synchronous token
- Calculates a number at both the authentication server and the device
– Time-based synchronization system
– Event-based synchronization system
– Continuous authentication

Asynchronous token
- Uses challenge-response technology
– Key-fob sized device
– Token software installed on a validated mobile device
– USB token
– Smart card

*image of this on slide 17 on chapter 6 slides

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Authentication by Characteristics/Biometrics

A

Static (physiological) measures
What you are
Examples: Fingerprint patterns, iris granularity, retina blood vessels
Dynamic (behavioral) measures
What you do
Examples: Voice inflections, keyboard strokes, signature motions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What are some concerns surrounding biometrics?

A
  • Accuracy
  • Acceptability
  • Reaction time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are some types of biometrics?

A

Fingerprint
Palm print
Hand geometry
Vein analysis
Retina scan
Iris scan
Facial recognition
Voice pattern
Keystroke dynamics
Signature dynamics
Gait analysis

68
Q

What are some advantages of biometrics?

A
  • Person must be physically present to authenticate
  • There is nothing to remember
  • Biometrics are difficult to fake
  • Lost IDs or forgotten passwords are not problems
69
Q

What are some disadvantages of biometrics?

A
  • Physical characteristics might change
  • Physically disabled users might have difficulties
  • Not all techniques are equally effective
  • Response time may be too slow
  • Required devices can be expensive
  • Privacy issues
70
Q

What is an example of an authentication by action?

A

Recording typing patterns

71
Q

What is Single Sign On?

A
  • Sign on to a computer or network once and then be allowed into all computers and systems where authorized
  • Reduces human error
  • Difficult to put in place
72
Q

What are some advantages of Single Sign On?

A

Logon process is efficient
Users are generally willing to use stronger passwords
Provides continuous, clear reauthentication
Provides failed logon attempt thresholds and lockouts
Provides centralized administration

73
Q

What are some disadvantages of Single Sign On?

A

Compromised passwords grants access to an intruder
Static passwords provide very limited security
Difficulty adding SSO to unique computers or legacy systems
Scripts can expose data and do not provide two-factor authentication
Authentication server can become a single point of failure

74
Q

What are some processes used for Single Sign On (SSO)?

A

Kerberos
Secure European System for Applications in a Multi-vendor Environment (SESAME)
Lightweight Directory Access Protocol (LDAP)

75
Q

What are the formal models of access control?

A

Discretionary access control (DAC)
Mandatory access control (MAC)
Nondiscretionary access control
Rule-based access control

76
Q

______ denies access based on context or content through the application by presenting only options that are authorized for the current user.

A

Application-based DAC

77
Q

___ permission levels are:
- User based
- Job-based, group-based, or role-based access control (RBAC)
- Project based
- Task based

A

DAC

78
Q

Operating systems-based ___ policy considerations:
- Access control method
- New user registration
- Periodic review

A

DAC

79
Q

True or False: MAC is stronger than DAC

A

True

80
Q

What determines the level of restriction by sensitivity of resource (classification label)
and individuals then formally authorized (i.e., obtain clearance) to access sensitive information?

A

MAC

81
Q

Which is more secure? Nondiscretionary Access Control or DAC?

A

Nondiscretionary Access Control

82
Q

Access rules are closely managed by security administrator, not system owner or ordinary users in this access control.

A

Nondiscretionary Access Control

83
Q

Sensitive files are write-protected for integrity and readable only by authorized users in this access control.

A

Nondiscretionary Access Control

84
Q

___ ensures that system security is enforced and tamperproof.

A

Nondiscretionary Access Control

85
Q

Explicit rules grant access in this access control.

A

Rule-based access control

86
Q

Linux and macOS Access Control List (share and security permissions)

A
  • Permissions
    – Read, write, execute
  • Applied to
    – File owners, groups, global users
87
Q

Windows Access Control List (share and security permissions)

A

Share permissions
- Full, change, read, deny
Security permissions
- Full, modify, list folder contents, read-execute, read, write, special, deny

88
Q

What are some methods of constraining users

A

Menus
Database views
Physically constrained user interfaces
Encryption

89
Q

Microsoft offers _____ to help administrators manage access controls

A

Group Policy and Group Policy Objects (GPOs)

90
Q

Which centralized authentication, authorization, and accounting (AAA) servers are the most popular and have two configuration files?

A

RADIUS

91
Q

Which centralized authentication, authorization, and accounting (AAA) servers is an Internet Engineering Task Force (IETF) standard and has one configuration file

A

TACACS+

92
Q

Which centralized authentication, authorization, and accounting (AAA) servers has base protocol and extensions, uses User Datagram Protocol (UDP) in peer-to-peer (P2P) mode rather than client/server mode

A

DIAMETER

93
Q

Which centralized authentication, authorization, and accounting (AAA) servers is an open standard based on XML for exchanging both authentication and authorization data

A

SAML

94
Q

What access control handles access control decisions and administration locally; access control is in hands of the people closest to the system users?

A

Decentralized Access Control

95
Q

Password Authentication Protocol (PAP) and Challenge-Handshake Authentication Protocol (CHAP) are what common access protocols?

A

Decentralized access control

96
Q

What are some advantages of cloud computing?

A

No need to maintain a data center
No need to maintain a disaster recovery site
Outsourced responsibility for performance and connectivity
On-demand provisioning

97
Q

What are some disadvantages of cloud computing?

A

More difficult to keep private data secure
Greater danger of private data leakage
Greater demand for constant network access
Greater need for clients to trust outside vendors

98
Q

What is the goal of cryptography?

A

Make the cost or the time required to decrypt ciphertext without the key exceed the value of the protected information

99
Q

____ is the number of possible keys to a cipher.

A

Keyspace

100
Q

What is the most scrutinized cipher in history?

A

Data Encryption Standard (DES)

101
Q

_____ is the art of breaking code.

A

Cryptanalysis

102
Q

True/False: Cryptography was used in World Wars I and II

A

True

103
Q

What year was symmetric and asymmetric key cryptography introduced in?

A

1976

104
Q

____ cryptography uses photons, particles, or waves of light, and their unique properties transmitted across an optical fiber channel to create an unbreakable cryptosystem

A

Quantum

105
Q

What enables you to prevent a party from denying a previous statement or action

A

Nonrepudiation

106
Q

Many symmetric ciphers operate as either a ____ cipher or a ____ cipher.

A

stream, block

107
Q

What is a keyword mixed alphabet cipher?

A

Uses a cipher alphabet that consists of a keyword, minus duplicates, followed by the remaining letters of the alphabet

108
Q

What is a simple substitution cipher

A

Allows any letter to uniquely map to any other letter

109
Q

What is a product cipher?

A

Combination of multiple ciphers, each of which could be a transposition or substitution cipher

110
Q

What is an example of a product cipher?

A

Data Encryption Standard (DES)

111
Q

What is an example of an exponentiation cipher?

A

Involves computing exponentials over a finite mathematical field and relies on the difficulty of factoring large numbers

112
Q

What is an example of an exponentiation cipher?

A

Rivest–Shamir–Adelman (RSA)

113
Q

In asymmetric key ciphers when given some random input, you can generate associated key pairs that are _____ of each other.

A

inverses

114
Q

What is a checksum?

A

Summary information appended to a message to ensure that the values of the message have not changed

115
Q

Digital signatures require _____ key cryptography

A

asymmetric

116
Q

____ bind the identity of an entity to a particular message or piece of information and ensure the integrity of a message and verify who wrote it.

A

Digital Signatures

117
Q

Is DES symmetric key or asymmetric key cryptography?

A

symmetric

118
Q

Is 3DES symmetric key or asymmetric key cryptography?

A

symmetric

119
Q

Is International Data Encryption Algorithm (IDEA) symmetric key or asymmetric key cryptography?

A

symmetric

120
Q

Is CAST symmetric key or asymmetric key cryptography?

A

symmetric

121
Q

Is Blowfish symmetric key or asymmetric key cryptography?

A

symmetric

122
Q

Is AES symmetric key or asymmetric key cryptography?

A

symmetric

123
Q

Is RC2 symmetric key or asymmetric key cryptography?

A

symmetric

124
Q

Is RSA symmetric key or asymmetric key cryptography?

A

asymmetric

125
Q

Is ECC symmetric key or asymmetric key cryptography?

A

asymmetric

126
Q

A ___ is a key storage method that allows some authorized third-party access to a key under certain circumstances.

A

key escrow

127
Q

The ______ Handshake Protocol consists of two phases: server authentication and an optional client authentication.

A

Secure Sockets Layer (SSL)

128
Q

_____ verify a person’s identity or that person’s association with a message.

A

Digital signatures

129
Q

A ______ vouches for the validity of a credential, and maintains a list of invalid, or revoked, certificates in either a certificate revocations list (CRL) or by maintaining the data to support the newer Online Certificate Status Protocol (OCSP).

A

certificate authority (CA)

130
Q

This hash takes an input of any arbitrary length and generates a 128-bit message digest that is computationally infeasible to match by finding another input

A

MD5 message digest algorithm

131
Q

This hash produces a 160-bit hash from a message of any arbitrary length

A

Secure Hash Algorithm (SHA-1)

132
Q

This is a hash function that uses a key to create the hash, or message digest

A

Hash message authentication code (HMAC)

133
Q

This is a collection of functions that provide hash values for a wide range of applications

A

RACE Integrity Primitives Evaluation Message Digest (RIPEMD)

134
Q

_____ are a combination of a strong hash of a message, which acts as a fingerprint

A

Digital signatures

135
Q

____ is any program that contains instructions that run on a computer system and perform operations that the user does not intend

A

Malware

136
Q

Malicious code attacks what?
A: Confidentiality
B. Integrity
C. Availability
D. All of the above

A

D. All of the above

137
Q

What are the 3 types of viruses?

A

System infectors, File infectors, Data infectors

138
Q

Explain the difference between system infectors, file infectors, and data infectors.

A

System infectors
– Target computer hardware and software startup functions

File infectors
– Attack and modify executable programs (COM, EXE, SYS, and DLL files in Microsoft Windows)

Data infectors
– (Also called macro infectors) Attack document files containing embedded macro programming capabilities

139
Q

What is a rootkit?

A

Malware that modifies or replaces one or more existing programs to hide the fact that a computer has been compromised

Modify parts of the operating system to conceal traces of their presence

Provide attackers with access to compromised computers and easy access to launching additional attacks

140
Q

____ consumes computing resources bandwidth and central processing unit (CPU) time.

A

Spam

141
Q

True/False: Opt-out (unsubscribe) features in spam messages can represent a new form of reconnaissance attack to acquire legitimate target addresses

A

True

142
Q

____ are self-contained programs designed to propagate from one host machine to another using the host’s own network communications protocols

A

Worms

143
Q

____ are unlike viruses, do not require a host program to survive and replicate

A

Worms

144
Q

___ usually probe network-attached computers to exploit a specific vulnerability

A

Worms

145
Q

What is the largest class of malware?

A

Trojan Horses

146
Q

What are programs that masquerade as useful programs while hiding malicious intent?

A

Trojan Horses

147
Q

These programs rely on social engineering to spread and operate; spread through email messages, website downloads, social networking sites, and automated distribution agents (bots)

A

Trojan Horses

148
Q

_____ are programs that execute a malicious function of some kind when they detect certain conditions

A

Logic bombs

149
Q

Once in place, these programs wait for a specified condition or time, which, when it occurs, causes ______ to activate and carry out its tasks

A

logic bombs

150
Q

_______ typically originate with organization insiders because people inside an organization generally have more detailed knowledge of the IT infrastructure than outsiders

A

Logic bombs

151
Q

___ are robotically controlled networks.

A

botnets

152
Q

Controllers communicate with other members of the botnet using ______ channels

A

Internet Relay Chat (IRC)

153
Q

Attackers can use botnets to distribute malware and spam and to launch ______ attacks against organizations or even countries

A

denial of service (DoS)

154
Q

____ are attacks that overwhelm a server or network segment to the point that the server or network becomes unusable

A

Denial of Service (DoS)

155
Q

_____ attacks crash a server or network device or create so much network congestion that authorized users cannot access network resources

A

Denial of Service (DoS)

156
Q

______ attacks are when an attacker uses Internet Protocol (IP) spoofing to send a large number of packets requesting connections to the victim computer

A

Synchronize (SYN) Flood

157
Q

______ attacks are when attackers forge Internet Control Message Protocol (ICMP) echo request packets to IP broadcast addresses from remote locations to generate DoS attacks

A

Smurf

158
Q

____ is any unsolicited background process that installs itself on a user’s computer and collects information about the user’s browsing habits and website activities

A

Spyware

159
Q

Spyware affects ______ and ______.

A

privacy and confidentiality

160
Q

______ cookies are cookies that share information across sites. Some cookies are persistent and are stored on a hard drive indefinitely without user permission.

A

Spyware

161
Q

______ triggers nuisances such as popup ads and banners when user visits certain websites

A

Adware

162
Q

_______ affects productivity and may combine with active background activities. It collects and tracks information about application, website, and Internet activity.

A

Adware

163
Q

_____ tricks users into providing logon information on what appears to be a legitimate website but is actually a website set up by an attacker to obtain this information

A

Phishing

164
Q

_____is when an attacker supplies information about victim that appears to come from a legitimate company

A

Spear Phishing

165
Q

___ is the use of social engineering to obtain access credentials such as usernames and passwords

A

Pharming

166
Q

_____ capture keystrokes or user entries and forwards information to attacker. This enables the attacker to capture logon information, banking information, and other sensitive data.

A

Keystroke Loggers

167
Q

What motivates attackers?

A
  • money
  • fame
  • political beliefs or systems
  • anger or revenge
  • cyberwarfare or espionage
168
Q

____ are the group of individuals responsible for planning, designing, implementing, and monitoring an organization’s security plan

A

Security administration

169
Q

The physical location where security administration work is often referred to as the
_____?

A

security operations center (SOC)

170
Q
A

ISYS 4013 - PRINCIPLES DATA/CYBERSECURITY (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions