Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA security+ 701 > Exam2 > Flashcards

Exam2 Flashcards

1
Q

An agreement between a company and a vendor that stipulates performance expectations, such as minimum uptime and maximum downtime levels.

A

Service Level Agreement (SLA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Expresses an understanding between two or more parties indicating their intention to work together toward a common goal

A

Memorandum of Understanding (MOU)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Evaluates the processes and tools used to make measurements. Uses various methods to identify variations within a measurement process that can result in invalid results.

A

Measurement System Analysis (MSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A written agreement that details the relationship between business partners, including their obligations toward the partnership.

A

Business partnership Agreement (BPA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Refers to the date when a product will no longer be offered for sale

A

End of Life (EOL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Indicates the date when you expect a lack of vendor support because vendors no longer create patches or upgrades to resolve vulnerabilities for the product.

A

End of Service Life (EOSL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Used between two entities to ensure that proprietary data is not disclosed to unauthorized entities.

A

NDA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

System of organizing data according to its sensitivity. Common classifications include public, confidential, secret, and top secret.

A

Data Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Refers to the processes an organization uses to manage, process, and protect data.

A

data governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Identifies how long data is retained and sometimes specifies where it is stored

A

Data Retention Policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q
  • An account on a computer associated with
    a specific person
  • The computer associates the user with a specific
    identification number
  • Storage and files can be private to that user
  • Even if another person is using the same computer
  • No privileged access to the operating system
  • Specifically not allowed on a user account
  • This is the account type most people will use
  • Your user community
A

Credential policies: personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q
  • Access to external third-party systems
  • Cloud platforms for payroll, enterprise resource planning, etc.
  • Third-party access to corporate systems
  • Access can come from anywhere
  • Add additional layers of security
  • 2FA (two factor authentication)
  • Audit the security posture of third-parties
  • Don’t allow account sharing
  • All users should have their own account
A

Credential policies: Third-party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q
  • Access to devices
    • Mobile devices
  • Local security
    • Device certificate
    • Require screen locks and unlocking standards
    • Manage through a Mobile Device Manager (MDM)
  • Add additional security
    • Geography-based
    • Include additional authentication factors
    • Associate a device with a user
A

Credential policies: Devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q
  • Used exclusively by services running on a computer
  • No interactive/user access (ideally)
  • Web server, database server, etc.
  • Access can be defined for a specific service
  • Web server rights and permissions will be
    different than a database server
  • Commonly use usernames and passwords
  • You’ll need to determine the best policy for
    password updates
A

Credential policies: service accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q
  • Elevated access to one or more systems
    • Super user access
  • Complete access to the system
    • Often used to manage hardware, drivers, and
      software installation
  • This account should not be used for normal
    administration
    • User accounts should be used
  • Needs to be highly secured
    • Strong passwords, 2FA
    • Scheduled password changes
A

Credential policies: Administrator/Root Accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Process of making sure changes are made smoothly and efficiently and do not negatively affect systems reliability, security, confidentiality, integrity, and availability.

A

Change Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The procedures used to identify, document, approve, and control changes to the project baselines

A

Change Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The process of tracking valuable assets throughout their life cycles

A

Asset management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Any risks from outside an organization. This includes and threats from external attackers It also includes and natural threats, such as hurricanes, earthquakes, and tornadoes. Sometimes predictable, often not.

A

Risk types: External

20
Q

Any risks from within an organization. This includes employees and all the hardware and software used within the organization. These risks are generally predictable and can be mitigated with standard security controls.

A

Risk Types: Internal

21
Q

occur when an organization contracts with an external organization for goods or services. If the third-party suffers an attack it may expose the contracting organization to additional threats.

A

Risk Types: Multiparty

22
Q
  • Acceptance
  • Avoidance
  • Transference
  • Mitigation
A

Risk Management Strategies

23
Q

When the cost of a control outweighs the risk, an organization will often accept the risk.

A

Acceptance

23
Q

An organization can avoid a risk by not providing a service or not participating in a risky activity.

A

Avoidance

24
Q

The organization transfers the risk to another entity or at least shares the risk with another entity. The most common method is by purchasing insurance.

A

Transference

25
Q

The primary risk is that vendors do not support these systems. If vulnerabilities become known, the vendor doesn’t release patches, and anyone using the system is at risk.

A

Risk Types: Legacy Systems

26
Q

Intellectual Property (IP) includes things like copyrights, trademarks, patents, and trade secrets. Intellectual Property is valuable to an organization and IP theft represents a significant risk.

A

Risk Types: IP theft

27
Q

If individuals or organizations use software without buying a license, the development company loses money. Similarly, an organization can lose money if it buys licenses but does not protect them.

A

Risk Types - Software Compliance/Licensing

28
Q

The organization implements controls to reduce risks. These controls either reduce the vulnerabilities or reduce the impact of the threat.

A

Mitigation

29
Q

helps protect businesses and individuals from losses related to cybersecurity incidents such as data breaches and network damage.

A

Cybersecurity Insurance

30
Q

identifies potential issues that could negatively impact an organization’s goals and objectives.

A

Risk Analysis

31
Q

Encryption, antivirus, IDS/IPS, firewalls

A

Technical controls

32
Q

Risk assessment, vulnerability assessment, pen testing

A

Administrative controls

32
Q

Security guards etc

A

Physical controls

33
Q

Hardening, Security training, and security guards, change management

A

Preventative controls

34
Q

Log monitoring, trend analysis, security audits, cctv (can also act as deterrent control)

A

Detective controls

35
Q

IPS detects attack and then modify environment to stop attack. Backups and system recovery allows recovery from incidents or failure.

A

Corrective controls: attempt to reverse impact of incident.

35
Q

Cable and hardware locks deter thieves.

A

Deterrent controls (can also be described as preventative controls)

36
Q

Alternate controls used instead of primary ones, when they are not available

A

Compensating controls

37
Q

Time-based one-time password, uses a timestamp instead of a counter, and expire within 30 sec.

A

TOPT

38
Q

remains active until it is used, so someone can shoulder surf and steal it.

A

HOPT

39
Q

Network authentication protocol within a microsoft windows active directory, providing mutual authentication to prevent man in the middle and replay attacks (attacker attempts to impersonate user after intercepting data).

A

Kerberos

40
Q

You can use the same account that has been created with google/fb etc, so you can do things like pay a website with paypal.

A

OAuth

41
Q

Works with OAuth 2.0, and allows verification without handling credentials.

A

OpenID Connect

42
Q
A

CompTIA security+ 701 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions