Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + > Fundamentals of Security > Flashcards

Fundamentals of Security Flashcards

1
Q

Protecting data and information from unauthorized access, modification, disruption, disclosure, and destruction

A

Information Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Protecting the systems (e.g., computers, servers, network devices) that hold and process critical data

A

Information Systems Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

CIA Triad

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ensures information is accessible only to authorized personnel (e.g.,
encryption)

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Ensures data remains accurate and unaltered (e.g., checksums)

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Ensures information and resources are accessible when needed (e.g.,
redundancy measures)

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Guarantees that an action or event cannot be denied by the involved parties
(e.g., digital signatures

A

Non-Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An extension of the CIA triad with the addition of non-repudiation and
authentication

A

CIANA Pentagon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Triple A’s of Security

A

Authentication
Authorization
Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Verifying the identity of a user or system (e.g., password checks)

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Determining actions or resources an authenticated user can access (e.g.,
permissions)

A

Authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Tracking user activities and resource usage for audit or billing purposes

A

Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security Control Categories

A

■ Technical
■ Managerial
■ Operational
■ Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security Control Types

A

■ Preventative
■ Deterrent
■ Detective
■ Corrective
■ Compensating
■ Directive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Operates on the principle that no one should be trusted by default. To achieve zero trust, we use the control plane and the data plane.

A

Zero Trust Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Adaptive identity, threat scope reduction, policy-driven access
control, and secured zones

A

Control Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Subject/system, policy engine, policy administrator, and
establishing policy enforcement points

A

Data Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Anything that could cause harm, loss, damage, or compromise to our information
technology systems. Can come from the following:
● Natural disasters
● Cyber-attacks
● Data integrity breaches
● Disclosure of confidential information

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Any weakness in the system design or implementation. Come from internal factors like the following:
● Software bugs
● Misconfigured software
● Improperly protected network devices
● Missing security patches
● Lack of physical security

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Finding different ways to minimize the likelihood of an outcome and achieve the
desired outcome.

A

Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Refers to the protection of information from unauthorized access and disclosure. Ensure that private or sensitive information is not available or disclosed to
unauthorized individuals, entities, or processes.

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Confidentiality is important for 3 main reasons

A

■ To protect personal privacy
■ To maintain a business advantage
■ To achieve regulatory compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

To ensure confidentiality, we use five basic methods

A

Encryption
Access Controls
Data Masking
Physical Security Measures
Training and Awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Process of converting data into a code to prevent unauthorized access

A

Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

By setting up strong user permissions, you ensure that only authorized
personnel can access certain types data

A

Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Method that involves obscuring specific data within a database to make it
inaccessible for unauthorized users while retaining the real data’s
authenticity and use for authorized users

A

Data Masking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Ensure confidentiality for both physical types of data, such as paper
records stored in a filing cabinet, and for digital information contained on
servers and workstations

A

Physical Security Measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Conduct regular training on the security awareness best practices that
employees can use to protect their organization’s sensitive data

A

Training and Awareness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Helps ensure that information and data remain accurate and unchanged from its
original state unless intentionally modified by an authorized individual. Verifies the accuracy and trustworthiness of data over the entire lifecycle

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Integrity is important for three main reasons

A

■ To ensure data accuracy
■ To maintain trust
■ To ensure system operability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

To help us maintain the integrity of our data, systems, and networks, we usually utilize
five methods

A

Hashing
Digital Signatures
Checksums
Access Controls
Regular Audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Process of converting data into a fixed-size value

A

Hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Ensure both integrity and authenticity

A

Digital Signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Method to verify the integrity of data during transmission

A

Checksums

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Ensure that only authorized individuals can modify data and this reduces
the risk of unintentional or malicious alterations

A

Access Controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Involve systematically reviewing logs and operations to ensure that only
authorized changes have been made, and any discrepancies are
immediately addressed

A

Regular Audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Ensure that information, systems, and resources are accessible and operational
when needed by authorized users

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

As cybersecurity professionals, we value availability since it can help us with the
following:

A

■ Ensuring Business Continuity
■ Maintaining Customer Trust
■ Upholding an Organization’s Reputation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

To overcome the challenges associated with maintaining availability, the best strategy is to us ____________ in your systems and network designs

A

Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Duplication of critical components or functions of a system with the intention of enhancing its reliability.

A

Redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

There are various types of redundancy you need to consider when designing your
systems and networks

A

Server Redundancy
Data Redundancy
Network Redundancy
Power Redundancy

42
Q

Involves using multiple servers in a load balanced or failover configuration
so that if one is overloaded or fails, the other servers can take over the
load to continue supporting your end users

A

Server Redundancy

43
Q

Involves storing data in multiple places

A

Data Redundancy

44
Q

Ensures that if one network path fails, the data can travel through
another route

A

Network Redundancy

45
Q

Involves using backup power sources, like generators and UPS systems

A

Power Redundancy

46
Q

■ Focused on providing undeniable proof in the world of digital transactions
■ Security measure that ensures individuals or entities involved in a
communication or transaction cannot deny their participation or the authenticity
of their actions

A

Non-repudiation

47
Q

■ Considered to be unique to each user who is operating within the digital domain
■ Created by first hashing a particular message or communication that you want to
digitally sign, and then it encrypts that hash digest with the user’s private key
using asymmetric encryption

A

Digital Signatures

48
Q

Non-repudiation is important for three main reasons

A

■ To confirm the authenticity of digital transactions
■ To ensure the integrity of critical communications
■ To provide accountability in digital processes

49
Q

Security measure that ensures individuals or entities are who they claim to be
during a communication or transaction

A

Authentication

50
Q

5 commonly used authentication methods

A

Something you know (Knowledge Factor)
Something you have (Possession Factor)
Something you are (Inherence Factor)
Something you do (Action Factor)
Somewhere you are (Location Factor)

51
Q

Relies on information that a user can recall

A

Something you know (Knowledge Factor)

52
Q

Relies on the user presenting a physical item to authenticate themselves

A

Something you have (Possession Factor)

53
Q

Relies on the user providing a unique physical or behavioral characteristic
of the person to validate that they are who they claim to be

A

Something you are (Inherence Factor)

54
Q

Relies on the user conducting a unique action to prove who they are

A

Something you do (Action Factor)

55
Q

Relies on the user being in a certain geographic location before access is
granted

A

Somewhere you are (Location Factor)

56
Q

Security process that requires users to provide multiple methods of identification
to verify their identity

A

Multi-Factor Authentication System (MFA)

57
Q

Authentication is critical to understand because of the following

A

■ To prevent unauthorized access
■ To protect user data and privacy
■ To ensure that resources are accessed by valid users only

58
Q

Pertains to the permissions and privileges granted to users or entities after they
have been authenticated

A

Authorization

59
Q

Authorization mechanisms are important to help us with the following

A

■ To protect sensitive data
■ To maintain the system integrity in our organizations
■ To create a more streamlined user experience

60
Q

Security measure that ensures all user activities during a communication or
transaction are properly tracked and recorded

A

Accounting

61
Q

Your organization should use a robust accounting system so that you can create the
following

A

Create an audit trail
Maintain regulatory compliance
Conduct forensic analysis
Perform resource optimization
Achieve user accountability

62
Q

Provides a chronological record of all user activities that can be used to
trace changes, unauthorized access, or anomalies back to a source or
point in time

A

Create an audit trail

63
Q

Maintains a comprehensive record of all users’ activities

A

Maintain regulatory compliance

64
Q

Uses detailed accounting and event logs that can help cybersecurity
experts understand what happened, how it happened, and how to
prevent similar incidents from occurring again

A

Conduct forensic analysis

65
Q

Organizations can optimize system performance and minimize costs by
tracking resource utilization and allocation decisions

A

Perform resource optimization

66
Q

Thorough accounting system ensures users’ actions are monitored and
logged , deterring potential misuse and promoting adherence to the
organization’s policies

A

Achieve user accountability

67
Q

To perform accounting, we usually use different technologies like the following

A

Syslog Servers
Network Analysis Tools
Security Information and Event Management (SIEM) Systems

68
Q

Used to aggregate logs from various network devices and systems so that
system administrators can analyze them to detect patterns or anomalies
in the organization’s systems

A

Syslog Servers

69
Q

Used to capture and analyze network traffic so that network
administrators can gain detailed insights into all the data moving within a
network

A

Network Analysis Tools

70
Q

Provides us with a real-time analysis of security alerts generated by
various hardware and software infrastructure in an organization

A

Security Information and Event Management (SIEM) Systems

71
Q

4 Broad Categories of Security Controls

A

Technical Controls
Managerial Controls
Operational Controls
Physical Controls

72
Q

Technologies, hardware, and software mechanisms that are implemented
to manage and reduce risks

A

Technical Controls

73
Q

● Sometimes also referred to as administrative controls
● Involve the strategic planning and governance side of security

A

Managerial Controls

74
Q

● Procedures and measures that are designed to protect data on a
day-to-day basis
● Are mainly governed by internal processes and human actions

A

Operational Controls

75
Q

Tangible, real-world measures taken to protect assets

A

Physical Controls

76
Q

6 Basic Types of Security Controls

A

Preventive Controls
Deterrent Controls
Detective Controls
Corrective Controls
Compensating Controls
Directive Controls

77
Q

Proactive measures implemented to thwart potential security threats or
breaches

A

Preventive Controls

78
Q

Discourage potential attackers by making the effort seem less appealing
or more challenging

A

Deterrent Controls

79
Q

Monitor and alert organizations to malicious activities as they occur or shortly thereafter

A

Detective Controls

80
Q

Mitigate any potential damage and restore our systems to their normal
state

A

Corrective Controls

81
Q

Alternative measures that are implemented when primary security
controls are not feasible or effective

A

Compensating Controls

82
Q

● Guide, inform, or mandate actions
● Often rooted in policy or documentation and set the standards for
behavior within an organization

A

Directive Controls

83
Q

Process of evaluating the differences between an organization’s current
performance and its desired performance

A

Gap Analysis

84
Q

There are several steps involved in conducting a gap analysis

A

■ Define the scope of the analysis
■ Gather data on the current state of the organization
■ Analyze the data to identify any areas where the organization’s current
performance falls short of its desired performance
■ Develop a plan to bridge the gap

85
Q

2 Basic Types of Gap Analysis

A

Technical Gap Analysis
Business Gap Analysis

86
Q

● Involves evaluating an organization’s current technical infrastructure
● identifying any areas where it falls short of the technical capabilities
required to fully utilize their security solutions

A

Technical Gap Analysis

87
Q

● Involves evaluating an organization’s current business processes
● Identifying any areas where they fall short of the capabilities required to
fully utilize cloud-based solutions

A

Business Gap Analysis

88
Q

● Outlines the specific measures to address each vulnerability
● Allocate resources
● Set up timelines for each remediation task that is needed

A

Plan of Action and Milestones (POA&M)

89
Q

_____________demands verification for every device, user, and transaction within the
network, regardless of its origin

A

Zero Trust

90
Q

Refers to the overarching framework and set of components responsible
for defining, managing, and enforcing the policies related to user and
system access within an organization

A

Control Plane

91
Q

Control Plane typically encompasses 4 key elements

A

Adaptive Identity
Threat Scope Reduction
Policy-Driven Access Control
Secured Zones

92
Q

Relies on real-time validation that takes into account the
user’s behavior, device, location, and more

A

Adaptive Identity

93
Q

Entails developing, managing, and enforcing user access
policies based on their roles and responsibilities

A

Policy-Driven Access Control

93
Q

Limits the users’ access to only what they need for their
work tasks because this reduces the network’s potential
attack surface. Focused on minimizing the “blast radius” that could occur
in the event of a breach

A

Threat Scope Reduction

94
Q

Isolated environments within a network that are designed
to house sensitive data

A

Secured Zones

95
Q

Ensures the policies are properly executed

A

Data Plane

96
Q

Data plane consists of the following

A

Subject/System
Policy Engine
Policy Administrator
Policy Enforcement Point

97
Q

Refers to the individual or entity attempting to gain access

A

Subject/System

98
Q

Cross-references the access request with its predefined
policies

A

Policy Engine

99
Q

Used to establish and manage the access policies

A

Policy Administrator

99
Q

Where the decision to grant or deny access is actually
execute

A

Policy Enforcement Point

Security + (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions