Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA security+ 701 > Exam9 > Flashcards

Exam9 Flashcards

1
Q

The practice of sending email to users with the purpose of tricking them into revealing personal information or clicking on a link a malicious version of spam.

A

Phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Uses the phone system to trick users into giving up personal and financial information. Often uses VoIP to make it look like the call is coming from a real company

A

Vishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A form of phishing that uses SMS instead of email. some attacks include malicious attachments and some try to convince a user to give up personal information.

A

Smishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Unwanted or unsolicited email. some is harmless advertisements while some is malicious including malicious links, code, or attachments.

A

Spam

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Unwanted messages sent over instant messaging (IM) channels. bypasses typical antivirus and spam filters.

A

Spam over internet messaging (SPIM)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A targeted form of phishing targeting a specific group of users or even one specific user. May attack employees within a company or customers of a company.

A

Spear Phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The practice of searching through trash or recycling containers to gain information from discarded documents.

A

Dumpster Diving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

looking over the shoulder of someone to gain unauthorized information by casual observation

A

Shoulder Surfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

an attack that manipulates the DNS name resolution process. either tries to corrupt the DNS server or the DNS client.

A

Pharming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The practice of one person following closely behind another without showing credentials

A

Tailgating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The act of getting information without asking for it directly. techniques include active listening, reflective questioning, false statements, and bracketing.

A

Eliciting Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A form of spear phishing that targets high level executives. Can target high level executives or impersonate high level executives to send messages to high level employees.

A

Whaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Used offensively by attackers to attempt to get a user to open a malicious email. Examples of prepending emails can be starting the subject with [SAFE] or [URGENT]

A

Prepending

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When someone steals personal information and uses it for fraudulent activity like opening bank accounts, falsifying tax returns, or applying for loans

A

Identity Fraud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attempting to trick people or organizations into paying for services that they did not order and probably did not receive

A

Invoice Scams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Any attempt to recover usernames and passwords from a user. This can be done via shoulder surfing, phishing or other means.

A

Credential Harvesting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Gathering as much information as possible on a target, usually thought open source sources

A

Reconnaissance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A message, often circulated via email, which tells of impending doom from a virus or other security threat that simply doesn’t exist.

A

Hoax

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Pretending to be someone with a certain level of authority in order to obtain access or information

A

Impersonation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Attempts to discover which websites a group of people are likely to visit and then infects those websites with malware that can infect the visitors

A

Watering Hole Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Also called URL hijacking, relies on mistakes, such as typos made by users inputting a website address into a web browser. When a user enters an incorrect website address, the squatter may lead them to any URL

A

Typo Squatting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A fictitious scenario added to a conversation to make a request more believeable

A

Pretexting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

User a variety of sources to influence public perception such as hybrid warfare and social media

A

Influence Campaigns

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A military strategy that blends conventional warfare with unconventional methods to influence people. Today a popular method uses social media

A

Hybrid Warfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The right to use power which is often adhered to in impersonation, whaling, and vishing attacks

A

Authority

26
Q

Most effective with impersonation and vishing attacks. Can involve bullying

A

Intimidation

26
Q

Attackers take advantage of this psychological state by creating websites with fake testimonials that promote a product. Sometimes called social proof. Often used with trojans and hoaxes.

A

Consensus

26
Q

Convincing someone that there is a limited quantity of an item. Used in phishing.

A

Scarcity

27
Q

Building rapport with the victim before launching the attack

A

Familiarity

27
Q

Convincing targets that they need to act now. Can be done using a timer. most effective with ransomware, phishing, vishing, and whaling.

A

Urgency

27
Q

Includes a wide range of software that has malicious intent. Installed on a system through devious means.

A

Malware

27
Q

Similar to familiarity. Used to build a relationship with a target before launching an attack. Often used with vishing.

A

Trust

28
Q

A self-replicating program is able to propagate itself across a network, typically having a detrimental effect.

A

Worms

28
Q

Software that cannot definitively be classed as malicious, but may not have been chosen by or wanted by the user.

A

Potentially unwanted programs (PUPs)

28
Q

Typically looks like something beneficial, but it’s actually something malicious. Can come as pirated software, a useful utility, or a game.

A

Trojans

29
Q

A type of malicious software designed to block access to a computer system until a sum of money is paid.

A

Ransomware

30
Q

A type of malicious software that runs in memory. Some techniques used are memory code injection, script-based techniques, and Windows registry manipulation.

A

Fileless virus

31
Q

A computer controlled by an attacker or cybercriminal, which is used to send commands to systems compromised by malware and receive stolen data from a target network.

A

Command and Control

32
Q

Software robots that function automatically. A botnet is a group of computers that are joined together. Attackers often use malware to join computers to a botnet, and then use the botnet to launch attacks.

A

Bots

33
Q

A string of code embedded into an application or script that will execute in response to an event.

A

Logic Bombs

34
Q

A special class of adware that collects data about the user and transmits it over the Internet without the user’s knowledge or permission

A

Spyware

35
Q

Software that tracks or logs the keys struck on your keyboard, typically in a covert manner so that you don’t know that your actions are being monitored.

A

Keyloggers

36
Q

A type of malware that allows attackers to control systems from remote locations. Often delivered by drive-by-downloads or malicious attachments in emails.

A

Remote Access Trojan (RATs)

36
Q

A set of programs that enables its user to gain administrator level access to a computer without the end user’s consent or knowledge.

A

Rootkit

37
Q

Provides another way of accessing a system; bypass normal authentication methods; allow attackers to access systems from remote locations

A

Backdoor

38
Q

A Special type of brute force or dictionary attack designed to avoid being locked out.

A

Spraying

39
Q

A type of password attack that automates
password guessing by comparing encrypted passwords against a predetermined list of possible password values.

A

Dictionary attack

40
Q

An attack on passwords or encryption that tries every possible password or encryption key.

A

Brute Force attack

41
Q

Attempts to discover a password from a captured database or a captured packet scan.

A

offline attack

42
Q

Attempts to discover a password from an online system.

A

Online attack

43
Q

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file.

A

Rainbow table

44
Q

A USB cable embedded with a Wi-Fi controller that can receive commands from a nearby device to send malicious commands to the connected mobile device.

A

Malicious USB cable

45
Q

a physical device that contains malicous PDFs, files, etc that could be harmful to your computer, older systems would automatically upload from this physical device without user consent

A

Malicious flash drive

46
Q

acquired information from a skimmer that can be made into a duplicate card, most commonly found when duplicating gift cards, can’t duplicate chips, only magnetic strips

A

Card cloning

47
Q

capturing credit card data at the point of sale

A

Skimming

48
Q

Attempts to fool AI models by supplying it with deceptive input. When successful it can cause an error or malfunction in the AI model.

A

Adversarial AI

49
Q

Providing bad data to a machine learning algorithm in order to force the algorithm to give inconsistent results

A

Tainted training data for machine learning

50
Q

An attempt to exploit a weakness/vulnerability in the process that produces a service.

A

supply chain attacks

51
Q

Cloud: Offsite, usually managed by third party, lower cost, no data centers, limited downtime
On-premises attack: On-site, full control of data, system check can occur at anytime, high cost and time consumption

A

cloud-based vs on-premises attacks

52
Q

A type of password attack that exploits weaknesses in the mathematical algorithms used to encrypt passwords, in order to take advantage of the probability of different password inputs producing the same encrypted output.

A

Birthday attack

53
Q

When the encrypted hashes of two different strings are the same

A

Collision

54
Q

An attack in which the system is forced to abandon the current higher security mode of operation and fall back to implementing an older and less secure mode.

A

downgrade attack

CompTIA security+ 701 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions