Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia Security > Explain the importance of automation and orchestration related to secure operations > Flashcards

Explain the importance of automation and orchestration related to secure operations Flashcards

1
Q

incident response process

A

Preparation: In the preparation phase, organizations establish and maintain incident response plans. These plans should be regularly updated to address evolving threats. This is the stage at which the Cybersecurity Incident Response Team (CSIRT) is
Analysis: At the analysis stage, SIEM takes the lead, using correlation techniques to analyze the type of incident flagged, prioritizing its impact and category. To do this analysis, we can use tools such as the MITRE ATT&CK framework, the Cyber Kill Chain, or the diamond model of intrusion analysis

Containment: In the containment stage, the primary goal is to limit the incident’s impact. This often involves isolating affected systems or quarantining them to prevent the attack from spreading. Simultaneously, volatile evidence (such as running processes and network connections) should be collected for analysis, and any compromised user accounts or access credentials should be disabled.
Eradication: Eradication focuses on destroying the root cause of the incident. For example, if malware is detected, efforts should be made to remove it completely. This may involve patching systems, deleting infected files, or disabling unnecessary services to protect the environment against future attacks.
Recovery: In the recovery phase, the organization aims to restore its operations to a normal state. This includes activities like data restoration, in which essential systems (such as domain controllers) are brought back online once they are clean and secure. The goal is to achieve the Recovery Point Objective (RPO) as closely as possible. The RPO is the amount of time a company can operate without its systems.
Lessons Learned: After the incident has been effectively contained and resolved, it’s essential to conduct a post-incident analysis. This Lessons Learned phase involves reviewing how the incident was handled to identify the strengths and weaknesses of the organization’s response. The insights gained here help organizations refine their incident response plans and take preventive measures to reduce the likelihood of similar incidents in the future.
For an example of this process in action, imagine a scenario in which a do

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Stages of the Cyber kill chain

A

Reconnaissance

Calling employees, sending emails, social engineering, dumpster diving

Weaponization

Create malware payload

Delivery

Delivery medium, such as USB, email, web page

Exploitation

Executing code via a vulnerability

Installation

Installing malware on the asset

Command and Control

Infected system sends back information to the attacker

Action on Objectives

Hands-on keyboard—attack complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Kerberos Authentication

A

Kerberos authentication uses a process called a TGT session, in which the domain controller provides the user with a service ticket that is used to access resources such as the mail serverIn a TGT session, a user sends their credentials (username and password, or smart card and PIN) to a domain controller that starts the authentication process and, when it has been confirmed, will send back a service ticket with a 10-hour lifespan. This service ticket is encrypted and cannot be altered..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Lightweight Directory Access Protocol Secure (LDAPS) Secure port number

A

636

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Internet Message Access Protocol Secure (IMAPS)

A

993 TCP Secure version of IMAP that uses TLS for encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

VM sprawl

A

Unmanaged VMs installed on your network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

VM escape

A

While virtualization is designed to isolate VMs, the hypervisor (that is, the essential software managing these VMs) introduces an unexpected challenge. It can unintentionally create a path for lateral movement, known as moving east to west, and enable potential attackers to move from a secluded VM to the host system or other interconnected VMs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

port

A

acts as a virtual endpoint for communication between devices and applications over a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Insecure FTP

A

21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Post office protocol 3 insecure

A

110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Network Time Protocol (NTP) insecure

A

123

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

LDAP Insecure

A

389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SNMP Insecure

A

161

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Secure Kerberos

A

88

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

HTTP insecure

A

80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

HTTPS

A

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Remote Desktop Protocol (RDP) Secure

A

3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Session Initiated Protocol (SIP)

A

Connects internet-based cells
Port 5060/61

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SMTPS

A

587

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Server Message Block (SMB) Secure

A

445

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Secure Protocols

A

Protocol

UDP

Port

Use cases

Secure Shell (SSH)

22

Secure remote access

Secure Copy Protocol (SCP)

22

Secure copy to UNIX/LINUX

Secure File Transfer Protocol (SFTP)

22

Secure FTP download

DNSSEC

TCP/UDP

53

Secure DNS traffic

Kerberos

88

Secure authentication

Simple Network Management Protocol Version 3 (SNMP V3)

UDP

162

Secure status and reports of network devices

Lightweight Directory Access Protocol Secure (LDAPS)

636

Securely manages directory service information

Hypertext Transport Protocol Secure (HTTPS)

443

Secure web browser

TLS/SSL

443

Secure data in transit

Server Message Block (SMB)

445

File and Print Sharing

Internet Protocol Security (IPSec)

UDP

500

Secure session for VPN or between two hosts

SMTPS

587

Secure SMTP

Secure/Multipurpose Internet Mail Extensions (S/MIME)

993

Encrypt or digitally sign email

Secure IMAP 4

993

Secure IMAP4

Secure Post Office Protocol 3

995

Secure POP3

File Transfer Protocol Secure

989/990

Download large files securely

Remote Desktop Protocol (RDP)

3389

Microsoft remote access

Session Initiated Protocol (SIP)

5060/61

Connects internet-based cells

Secure Real-Time Protocol (SRTP)

5061

Secure voice traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Insecure

A

Protocol

UDP

Port

Use case

File Transfer Protocol (FTP)

21

File transfer – passive FTP

Telnet

23

Run commands on remote hosts (however, note that passwords are not encrypted)

Simple Mail Transport Protocol (SMTP)

25

Transport mail between mail servers

Domain Name System (DNS)

UDP

53

Host name resolution

53

Zone transfer

UDP

53

Name queries

Dynamic Host Configuration Protocol (DHCP)

UDP

67/68

Automatic IP address allocation

Trivial File Transfer Protocol (TFTP)

UDP

69

File transfer using UDP

Hypertext Transport Protocol (HTTP)

80

Web browser

Post Office Protocol 3

110

Pulls mail from a mail server; no copy is left on the mail server

Network Time Protocol (NTP)

123

Time synchronization

NETBIOS

UDP

137–139

NETBIOS to IP address resolution

Internet Message Access Protocol (IMAP 4)

143

Pulls mail from a mail server

Simple Network Management Protocol (SNMP)

UDP

161

Notifies the status and creates reports on network devices

Lightweight Directory Access Protocol (LDAP)

389

Stores X500 objects; searches directory services for users, groups, and other information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

smurf attack

A

smurf attack occurs when the attacker floods the target network with infinite ICMP request packets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Software Compostion analysis

A

Software composition analysis (SCA) is the correct tool for identifying vulnerabilities in third-party software components because it specifically scans and analyzes their codebases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

NAT translation

A

Network address translation (NAT) is optimal for allowing Internet access to a web server while securing the rest of the network. NAT masks internal IP addresses, funneling external requests specifically to public-facing services. Packet filtering is too basic, lacking the ability to translate addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Stateful Packet Inspection

A

Stateful packet inspection (SPI) is appropriate for protecting against IP spoofing and other complex network attacks. Unlike stateless packet filtering, which inspects each packet in isolation, SPI keeps track of ongoing connections, allowing it to distinguish between legitimate and malicious packets more effectively

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

E-Discovery

A

involves legally compliant data collection, distinct from general data retrieval methods. It’s specifically tailored to legal requests, ensuring data relevance and compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

IT goverance Owner role

A

owner in IT governance is key in shaping the organization’s cybersecurity strategy, particularly concerning the classification of assets and the approval of risk mitigation strategies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

DKIM

A

a protocol that allows an organisation to take responsibility for transmitting a message by signing it in a way that mailbox providers can verify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

DMARC

A

DMARC suggests what to do with mail that isn’t legitimate. Domain-based Message Authentication, Reporting and Conformance, a technical standard that helps protect email senders and recipients from advanced threats that can be the source of an email data breach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

File integrity monitoring

A

works by first creating a baseline, which acts as a reference point and is periodically analyzed to detect tampering or fraud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Decentralization

A

Unlike traditional centralized databases (in which a single entity controls the ledger), the open public ledger is decentralized. Multiple copies of the ledger are distributed across nodes (i.e., computers) within a blockchain network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Unified Threat Management Firewall (UTM)

A

A multi-tasker – malware inspection, content, and URL filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Purple Team

A

is a security methodology in which offensive security professionals (referred to as red teams) and Cyber Security Operations Centre (CSOC) professionals (referred to as blue teams) work closely together in order to enhance cyber capabilities through continuous feedback and knowledge transfer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Wardriving

A

cyber security is the act of looking for publicly accessible Wi-Fi networks, usually from a moving vehicle, using a laptop or smartphone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Warchalking

A

Warchalking is the drawing of chalk symbols in public places to indicate free Wi-Fi hotspots. Wi-Fi enthusiasts practice warchalking in rural and urban areas and usually draw warchalking symbols on objects near the Wi-Fi hotspot, like sidewalks, walls, or lamp posts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Active Reconnaissance

A

active reconnaissance involves more direct interaction with the target, albeit in a non-intrusive manner.21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Hash Function

A

A hash function is a computational method that can map an indeterminate size of data into a fixed size of data. Or more plainly, it provides a number quantity that represents the input data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

OSNIT

A

OSINT refers to the collection and analysis of free and publicly available threat intelligence information donated by multiple cybersecurity organizations and individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

white team

A

A white team is a group of IT specialists tasked with overseeing red vs blue exercises

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Telemetry

A

. Telemetry is the process you use to gather information about your IT infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

asymmetric encryption

A

Asymmetric encryption is the process of using a public key from a public/private key pair to encrypt plaintext, and then using the corresponding private key to decrypt the ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

asymmetric algorthims

A

RSA, Diffie–Hellman, and Elliptic Curve Cryptography (ECC).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

symmetric algorthim

A

Data Encryption Standard (DES—56 bit), the Triple Data Encryption Standard (3DES—168 bit), and the more popular Advanced Encryption Standard (AES—256 bit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Key Longevity

A

: Key longevity refers to the duration over which cryptographic keys remain secure and effective in protecting sensitive data, making it imperative to periodically update keys to stay ahead of potential security threats. This is typically between one to two years.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Key Length

A

The length of cryptographic keys is the measure of their resistance against attacks. A key’s length directly affects the complexity of deciphering encrypted data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Layer 1 Physical Layer

A

cabling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Layer 2 Data Link

A

Switch /VLAN

Wireless Access Point (WAP)

MAC addresses

00-1A-2B-3C-4D-5E

ARP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Layer 3 Network layer

A

Routers / Subnets

Layer 3 Switch

IP Addresses and routing of packets (e.g., 192.168.1.1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Layer 4 Transport

A

Layer 4 Transport Layer

Load Balancer

TCP/UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Layer 7 application

A

Layer 7 Application Layer

Web Application Firewall (WAF)

Network Intrusion Prevention System (NIPS)

Protocols: DNS, SMTP, HTT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Switch

A

: A switch is an internal network device that links all machines in the local area network (LAN), see the following figure), maintaining a table known as Content Addressable Memory (CAM) with MAC addresses to identify connected hosts. Figure 10.2 is a visual representation of this device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

router

A

A router is a device used to connect two different networks when setting up a host machine, known as the default gateway. It is used by your company to give you access to other networks—for example, the internet. It

54
Q

VLAN

A

A VLAN is established through the software on a network switch. It allows you to group multiple network ports together, effectively creating a distinct and separate network within the larger network. This method of network division aids in controlling traffic flow and segregating communications for distinct functions or device groups

55
Q

SDN struture

A

Management Plane: The management plane orchestrates network intelligence effortlessly by monitoring the network traffic.
Control Plane: The control plane, often embodied by an SDN controller, serves as the network’s “brain.” It is a centralized entity that makes high-level decisions about traffic routing, network policies, and resource allocation, based on a set of rules set by administrators. This abstraction provides network administrators with a global, bird’s-eye view of the network and a single point from which to apply changes.
Data Plane: The data plane consists of network devices such as switches, routers, and access points. It is responsible for forwarding data packets based on the instructions received from the control plane. Unlike traditional networking, where control and data planes are tightly integrated, SDN separates them, allowing for programmable and dynamic control over the network’s behavior, including that of both resource allocation and security.

56
Q

Virtual desktop infrastructure,

A

is IT infrastructure that lets you access enterprise computer systems from almost any device

57
Q

Directory Traversal

A

Directory traversal is where the attacker aims to traverse the directory structure and access sensitive or confidential files that they should not have access to.

58
Q

Examples DIrectory Traversal

A

/etc/passwd

This file contains user account information, including usernames and hashed passwords. Accessing this file could potentially allow attackers to further compromise user accounts.

/etc/shadow

This file contains the encrypted password hashes for user accounts. Accessing this file would provide attackers with information that could help them crack passwords offline.

/etc

This is the system configuration directory. It contains various configuration files for system services and applications.

/var/www/html

These are web application directories where source code, configuration files, and potentially sensitive data could be stored.

59
Q

traversal examples

A

../../../../../

or %2f..%2f..%2f

or ..2f..2f..2f

This is a traversal attack. Seeing this in a log file or URL means that the attacker is moving up the directory. Each ../ means that they have moved up one level. %2f or ..2f could replace ../.

/root

This is the home directory of the root user, which may contain system-related files and configurations.

60
Q

Collison attack

A

Cryptography relies on the creation of unique signatures or hashes for data to ensure authenticity and integrity. A collision attack shatters this notion of uniqueness by manipulating the hash function. The attacker creates both a malicious and a benign document with the same hash.

61
Q

Concurrent session usage

A

Monitoring the number of concurrent user sessions can reveal suspicious activity. Sudden spikes or a significantly higher number of concurrent sessions than usual might indicate unauthorized access or a breach in progress.

62
Q

Cross Site injection

A

type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

63
Q

WEP

A

WEP (Wired Equivalent Privacy) is the oldest and most common Wi-Fi security protocol. It was the privacy component established in the IEEE 802.11, a set of technical standards that aimed to provide a wireless local area network (WLAN) with a comparable level of security to a wired local area network (LA

64
Q

WPA

A

WPA (Wi-Fi Protected Access) is a wireless security protocol released in 2003 to address the growing vulnerabilities of its predecessor, WEP.

65
Q

Offline Password attacks

A

This attack is where the attackers have managed to gain access to a system’s password storage and then attempt to crack them offline. For instance, they may download a copy of the /etc/shadow file from a Linux server or %SystemRoot%\System32\config\SAM from a Windows computer. The attacker can now take this home and track and crack the passwords in their own time without alerting the security team

66
Q

Log files

A

This attack is where the attackers have managed to gain access to a system’s password storage and then attempt to crack them offline. For instance, they may download a copy of the /etc/shadow file from a Linux server or %SystemRoot%\System32\config\SAM from a Windows computer. The attacker can now take this home and track and crack the passwords in their own time without alerting the security team

67
Q

Temporal Key Integrity Protocol (TKIP)

A

which dynamically generates a new key for each packet, or unit of data. TKIP is much more secure than the fixed-key system used by WEP.

68
Q

VLSM

A

VLSM allows network designers to give each subnet a different number of IP addresses, ultimately resulting in less network congestion and wasted IPs.

69
Q

EAP

A

EAP methods protect a specific portal so that only users with an authentication key or password can get network access. EAP uses the 802.1x standard as its authentication mechanism over a local area network or a wireless LAN (WLAN)

70
Q

sticky mac port

A

Sticky MAC addresses simplify the port security process by storing the MAC addresses of authorized devices.

71
Q

EAP-TLS

A

-TLS is a specific, secure version of wireless authentication that requires a certificate stored on the endpoint (client or device) to verify identity and authorization.

72
Q

PEAP

A

PEAP is a version of Extensible Authentication Protocol (EAP) that encapsulates and encrypts the EAP data using a certificate stored on the server, making it more secure for Wireless Local Area Networks (WLANs).

73
Q

EAP-TTLS

A

EAP-TTLS uses two phases. The first is to set up a secure session with the server by creating a tunnel using certificates that are stored on the server, and seen by the client. The second is to authenticate the client’s credentials.

74
Q

EAP-FAST

A

T: EAP-FAST, developed by Cisco, is used in wireless networks and point-to-point connections to perform session authentication. It is the only one of these authentication protocols that does not use a certificate.

75
Q

RAS Protocols

A

A remote access service (RAS) is any combination of hardware and software to enable the remote access tools or information that typically reside on a network of IT devices.

76
Q

IDS

A

The IDS is passive as it uses sensors and collectors to detect suspicious or unauthorized activities, sounding the alarm when potential threats are discovered. Both the IPS and IDS can be network-based, though, in these instances, they are known as NIDS and NIPS and can protect the network but not the host. The host versions of these systems are HIDS and HIPS. As expected, they can only protect the host and not the network.

77
Q

what does tacas encrypt

A

TACACS+ encrypts the entire packet content, ensuring a higher level of security.

78
Q

RADUIS ENCRYPTS?

A

RADIUS encrypts only the password in the access request packet.

79
Q

CER

A

: A critical metric for evaluating biometric systems before making a purchase, the CER represents the point where the FAR and FRR are equal. A lower CER indicates that the biometric system produces fewer errors, because both the FAR and FRR are low, and would be the best biometric system to purchase.

80
Q

hard authentication

A

A hard token is an electronic device that generates one-time passwords for logging into a computer system.

81
Q

Raduis how does it work

A

RaDIUS is a cornerstone in network security, particularly in remote access scenarios. RADIUS clients encompass a variety of devices, including wireless access points, routers, and switches. As these clients forward authentication requests to a RADIUS server, they necessitate a shared secret. This secret, known to both the RADIUS client and server, safeguards the exchange of sensitive data, bolstering the integrity of the authentication process.

82
Q

KBA

A

static KBA, which is based on a pre-agreed set of shared secrets, and dynamic KBA, which is based on questions generated from a wider base of personal information.

83
Q

Bluesnarfing

A

. Bluesnarfing, in contrast, is a malicious act that involves gaining unauthorized access to a Bluetooth-enabled device’s data (such as contacts, messages, or files) without the owner’s knowledge or consent.

84
Q

Telenet Port

A

Port 23 is the default Telnet port, and it is used for remote terminal emulation of both computers and devices

85
Q

Remediation Server

A

Remediation server: Positioned within the boundary or quarantine network, the remediation server plays a pivotal role. When a non-compliant device is redirected to this network, it gains access to the missing updates and patches from the remediation server. Once the device achieves a fully patched status, it is then permitted to access the LAN without compromising security.

86
Q

Evil Twin Attack

A

In an evil twin attack, the attacker uses either the same or a similar SSID to the victim. The telltale signs of this attack are a slower internet connection and the inability to access corporate data. This error occurs because you are actually on the wrong wireless network—one created by the attacker.

87
Q

Tethering

A

: Tethering is a connection method for mobile devices that bridges the gap between a GPS-enabled smartphone and other devices (a laptop, for instance) by providing them with internet access.

88
Q

Log File

A

Log files are text files that reside on every device, recording events as they happen. They contain a wealth of information about system events, errors, user interactions, and security incidents, acting as an audit trail by which an event can be tracked

89
Q

Server Message Block (SMB)

A

Windows proprietary protocol built on NetBIOS. Allows users to remotely access servers. Originally used port 139 over UDP.

90
Q

Hex Dump

A

In computing, a hex dump is a textual hexadecimal view of computer data, from memory or from a computer file or storage device. Looking at a hex dump of data is usually done in the context of either debugging, reverse engineering or digital forensics.
Users can inspect raw data, addresses, and corresponding characters

91
Q

NetFlow

A

NetFlow defines traffic flows based on shared characteristics, known as keys, and groups them into flow labels

92
Q

MOA(Memorandum of Agreement)

A

An MOA is legally binding. It meticulously outlines the terms and conditions and detailed roles and responsibilities of the parties involved. The

93
Q

MOU

A

: An MOU is a formal acknowledgment of a mutual agreement between two or more parties. It is more substantial than an informal agreement, reflecting a serious commitment from all involved parties, but generally lacks the binding enforceability of a legal contract. It serves primarily as a statement of intent.

94
Q

MSA

A

The MSA articulates the general terms and conditions governing a contractual relationship between the involved entities. It typically addresses aspects such as payment terms, dispute resolution mechanisms, intellectual property rights, confidentiality clauses, and liability provisions.

95
Q

BPA

A

A BPA is used between two companies who want to participate in a business venture to make a profit. It sets out how much each partner should contribute, their rights and responsibilities, the rules for the day-to-day running of the business, who makes the decisions, and how the profits are shared. It also establishes rules for termination of the partnership, either at a given point in time or if one of the partners dies or is otherwise unable or unwilling to continue their partnership.

96
Q

integer overflow

A

integer overflow occurs when an arithmetic operation on integers attempts to create a numeric value that is outside of the range that can be represented with a given number of digits

97
Q

Allowlist

A

The application allow list has a clear purpose, which is to specify a roster of approved applications that are permitted to execute while blocking unauthorized or potentially malicious software from gaining a foothold. This can be done by creating a whitelist, which is a list of approved applications that will deny access to any application not on the list.

98
Q

Reverse Proxy

A

The flow of traffic from a reverse proxy is incoming traffic from the internet coming into your company network. The reverse proxy is placed in a boundary network called the screened subnet. It performs the authentication and decryption of a secure session to enable it to filter the incoming traffic.

99
Q

active reconnaissance

A

active reconnaissance, an attacker actively probes and interacts with the target system to gather information

100
Q

DMZ

A

: The DMZ is an area that is neither fully trusted nor fully untrusted. It’s an intermediate zone that allows controlled access to certain services from the external network. Communication between the DMZ and the internal network might be subject to more stringent controls. This is also commonly known as a screened subnet, where resources that are accessed by untrusted and trusted networks reside.

101
Q

offensive security assessment

A

Offensive security is the practice of actively seeking out vulnerabilities in an organization’s cybersecurity.

102
Q

Sideloading

A

Sideloading is generally associated with Android devices utilizing Android Application Package (APK) files. While applications can also be sideloaded on Apple devices, the practice directly violates Apple’s terms and conditions and voids the device’s warranty.

103
Q

Rooting

A

Rooting allows users to bypass manufacturer or operating system restrictions on Android devices, providing more control over a device. This is commonly known as unlocking a device. This freedom, however, exposes the device to significant security risks.

104
Q

Logical security controls

A

restrict the access capabilities of users of the system and prevent unauthorized users from accessing the system

105
Q

Compensating controls

A

Compensating controls are alternative measures implemented when primary controls are not feasible or sufficient

106
Q

SLA

A

Defines service expectations and responsibilities

107
Q

DCHP port

A

Dynamic Host Configuration Protocol (DHCP) 67/68 UDP This network management protocol is used to assign multiple local private IP addresses from one public IPv4 address.

108
Q

Internet Message Access Protocol (IMAP) port

A

993 E-mail protocol used by e-mail clients to communicate with e-mail servers. Provides two way communication unlike POP.

109
Q

SMTPS

A

Simple Mail Transfer Protocol Secure (SMTPS) 587

110
Q

FTPS

A

File Transfer Protocol Secure (FTPS) 989/ 990 TCP FTPS uses TLS for encryption. It can run on ports 20/21 but is sometimes allocated to ports 989/990.

111
Q

Purple Team

A

purple team is a security team that combines offensive and defensive tactics to identify, assess, and mitigate security risks

112
Q

What is Nessus?

A

A remote scanning tool that can identify vulnerabilities that hackers can exploit

113
Q

Subjects Data Plane

A

Subjects in the data plane are the entities that initiate data communication,

114
Q

Systems in data plane

A

systems represent the collective infrastructure, resources, and devices that are responsible for processing and forwarding data packets as they traverse the network

115
Q

Heat Map

A

A heat map is a valuable tool in the hands of a network administrator when addressing reports of inadequate coverage. By visually pinpointing areas with subpar coverage on the map, administrators can efficiently identify potential issues, including malfunctioning WAPs
red and orange areas indicate good coverage,

116
Q

PSK

A

: PSK refers to a passphrase or a pre-shared secret key that is used to authenticate and secure access to a wireless network

117
Q

WPS

A

WPS: WPS allows you to connect to a wireless network by simply pushing a button, negating the need to insert a password each time.

118
Q

EAP-FAST

A

EAP-FAST, developed by Cisco, is used in wireless networks and point-to-point connections to perform session authentication. It is the only one of these authentication protocols that does not use a certificate.

119
Q

Secure Coding Practices

A

Secure coding practices are a set of guidelines and principles that software developers follow to write code in a way that prioritizes security and reduces the risk of vulnerabilities or weaknesses that could be exploited by attackers.

120
Q

IMAP port number

A

Internet Message Access Protocol (IMAP) 143, 993

121
Q

POP

A

110

122
Q

SMTP

A

Simple Mail Transfer Protocol (SMTP) 25/587Internet mail protocol used to send outgoing mail from email clients to mail servers.

123
Q

POP3/IMAP/SMTP

A

POP3 and IMAP are protocols for retrieving emails from a server, while SMTP is for transmitting emails

124
Q

POP3/IMAP

A

POP3 downloads all the emails simultaneously, while IMAP shows you the message header before downloading the email. POP3 downloads an email from the server and then deletes it. IMAP stores the email on the server and syncs it across several devices to access over multiple channels.

125
Q

POP3/IMAP

A

POP3 downloads emails from a server to a single computer, making those emails only accessible on that specific computer. IMAP stores emails on a server and then syncs them across multiple devices. IMAP is more advanced than POP3 and allows you to access your email from anywhere, and on any device.

126
Q

SMTP

A

Simple Mail Transfer Protocol (SMTP) used port 25. Today, SMTP should instead use port 587

127
Q

Bluejacking

A

Bluejacking is a type of attack in which individuals send unsolicited messages or business cards to nearby Bluetooth-enabled devices, such as smartphones or laptops

128
Q

PSK shared key

A

refers to a passphrase or a pre-shared secret key that is used to authenticate and secure access to a wireless network. Any time you visit a restaurant and ask the host for the wireless password, the password they provide is the PSK. Remember there is also an admin password on the WAP that you should never share.

129
Q

Password Spraying vs Brute Force

A

Traditional brute-force attacks target a single account with multiple possible passwords. A password spraying campaign targets multiple accounts with one password at a time.

130
Q

Stateful vs stateless

A

Stateful firewalls are capable of monitoring and detecting states of all traffic on a network to track and defend based on traffic patterns and flows. Stateless firewalls, however, only focus on individual packets, using preset rules to filter traffic

Comptia Security (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions