Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Sec+701 > Fundamentals Of Security > Flashcards

Fundamentals Of Security Flashcards

1
Q

What does the C.I.A Triad stand for?

A

Confidentiality, Integrity, Availability

These are the 3 pillars of security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Confidentiality?

A

Ensures that information is only accessible to those with appropriate authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Integrity?

A

Ensures that data remains accurate and unaltered unless modifications are required.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Availability?

A

Ensures that information and resources are accessible and functional when needed by authorized users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does C.I.A.N.A stand for?

A

Confidentiality, Integrity, Availability, Non-repudiation, Authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Non-repudiation?

A

Guaranteeing that a specific action or event has taken place and cannot be denied by the parties involved.

Example: Digital signatures in emails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Authentication?

A

Process of verifying the identity of a user or system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does A.A.A stand for?

A

Authentication, Authorization, Accounting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Authorization?

A

Defines what actions or resources a user can access or perform.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Accounting?

A

Act of tracking user activities and resource usage, used for audit or billing purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Security Controls?

A

Measures put in place to mitigate risk and protect the confidentiality, integrity, and availability of information systems and data.

Example: Zero Trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the Zero Trust security model?

A

A security model that operates on the principle that no one, inside or out of the organization, should be trusted by default (verification required from anyone trying to gain access).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the Control Plane?

A

Consists of adaptive identity, threat scope reduction, policy-driven access control, and secured zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the Data Plane?

A

Focused on the subject/system, policy engine, policy administrator, and establishing policy enforcement points.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is needed to achieve Zero Trust?

A

Control Plane and Data Plane

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Information Security?

A

Act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, and corruption, and destruction.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Information Systems Security?

A

The act of protecting the systems that hold and process critical data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a threat?

A

Anything that could cause harm, loss, damage, or compromise to our information technology systems.

Threats can come from natural disasters, cyber-attacks, data integrity breaches, or disclosure of confidential information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are examples of sources of threats?

A

Natural disasters, cyber-attacks, data integrity breaches, and disclosure of confidential information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a vulnerability?

A

Any weakness in the system design or implementation.

Vulnerabilities can arise from internal factors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are examples of internal factors that can create vulnerabilities?

A

Software bugs, misconfigured software, improperly protected network devices, missing security patches, and lack of physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the three main reasons for confidentiality?

A
  1. To protect personal privacy
  2. To maintain a business advantage
  3. To achieve regulatory compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the five basic methods to ensure confidentiality?

A
  1. Encryption
  2. Access Controls
  3. Data Masking
  4. Physical Security Measures
  5. Training and Awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is encryption?

A

Process of converting data into a code to prevent unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are access controls?
Setting up strong user permissions to ensure that only authorized personnel can access certain types of data.
26
What is data masking?
Method that involves obscuring specific data within a database to make it inaccessible for unauthorized users while retaining the real data's authenticity and use for authorized users.
27
What are physical security measures?
Measures that ensure confidentiality for both physical types of data, such as paper records stored in a filing cabinet, and for digital information contained on servers and workstations.
28
What is the purpose of training and awareness in confidentiality?
Conducting regular training on security awareness best practices that employees can use to protect their organization’s sensitive data.
29
What are the three main reasons integrity is important?
1. To ensure data accuracy 2. To maintain trust 3. To ensure system operability
30
What are the five methods used to maintain data integrity?
1. Hashing 2. Digital Signatures 3. Checksums 4. Access Controls 5. Regular Audits
31
What is hashing?
Hashing is the process of converting data into a fixed-size value.
32
What do checksums ensure?
Checksums ensure both integrity and authenticity. ## Footnote They verify the integrity of data during transmission.
33
What is the purpose of access controls?
Access controls ensure that only authorized individuals can modify data, reducing the risk of unintentional or malicious alterations.
34
What do regular audits involve?
Regular audits involve systematically reviewing logs and operations to ensure that only authorized changes have been made, and any discrepancies are immediately addressed.
35
What is availability in cybersecurity?
Availability ensures that information, systems, and resources are accessible and operational when needed by authorized users.
36
Why do cybersecurity professionals value availability?
Availability helps with ensuring business continuity, maintaining customer trust, and upholding an organization's reputation.
37
What is the best strategy to maintain availability?
The best strategy is to use redundancy in your systems and network designs.
38
What is redundancy?
Redundancy is the duplication of critical components or functions of a system with the intention of enhancing its reliability.
39
What is server redundancy?
Server redundancy involves using multiple servers in a load balanced or failover configuration to support end users if one server fails.
40
What is data redundancy?
Data redundancy involves storing data in multiple places.
41
What is network redundancy?
Network redundancy ensures that if one network path fails, the data can travel through another route.
42
What is power redundancy?
Power redundancy involves using backup power sources, like generators and UPS systems.
43
What is non-repudiation?
Non-repudiation is focused on providing undeniable proof in the world of digital transactions. It ensures individuals or entities involved in a communication or transaction cannot deny their participation or the authenticity of their actions.
44
What are digital signatures?
Digital signatures are considered to be unique to each user in the digital domain. They are created by hashing a message and encrypting that hash digest with the user’s private key using asymmetric encryption.
45
Why is non-repudiation important?
Non-repudiation is important to confirm the authenticity of digital transactions, ensure the integrity of critical communications, and provide accountability in digital processes.
46
What is authentication?
Authentication is a security measure that ensures individuals or entities are who they claim to be during a communication or transaction.
47
What are the 5 commonly used authentication methods?
1. Something you know (Knowledge Factor) 2. Something you have (Possession Factor) 3. Something you are (Inherence Factor) 4. Something you do (Action Factor) 5. Somewhere you are (Location Factor)
48
What is Multi-Factor Authentication (MFA)?
MFA is a security process that requires users to provide multiple methods of identification to verify their identity.
49
Why is authentication critical?
Authentication is critical to prevent unauthorized access, protect user data and privacy, and ensure that resources are accessed by valid users only.
50
What is authorization?
Authorization pertains to the permissions and privileges granted to users or entities after they have been authenticated.
51
Why are authorization mechanisms important?
Authorization mechanisms are important to protect sensitive data, maintain system integrity, and create a more streamlined user experience.
52
What is accounting in security?
Accounting is a security measure that ensures all user activities during a communication or transaction are properly tracked and recorded.
53
What can a robust accounting system create?
A robust accounting system can create an audit trail, maintain regulatory compliance, conduct forensic analysis, perform resource optimization, and achieve user accountability.
54
What technologies are used for accounting?
Technologies used for accounting include Syslog Servers, Network Analysis Tools, and Security Information and Event Management (SIEM) Systems.
55
What are the 4 broad categories of security controls?
1. Technical Controls 2. Managerial Controls 3. Operational Controls 4. Physical Controls
56
What are the 6 basic types of security controls?
1. Preventive Controls 2. Deterrent Controls 3. Detective Controls 4. Corrective Controls 5. Compensating Controls 6. Directive Controls
57
What is gap analysis?
Gap analysis is the process of evaluating the differences between an organization's current performance and its desired performance.
58
What are the steps involved in conducting a gap analysis?
1. Define the scope of the analysis 2. Gather data on the current state 3. Analyze the data to identify areas of shortfall 4. Develop a plan to bridge the gap.
59
What are the two basic types of gap analysis?
1. Technical Gap Analysis 2. Business Gap Analysis
60
What is Zero Trust?
Zero Trust demands verification for every device, user, and transaction within the network, regardless of its origin.
61
What are the two planes used to create a Zero Trust architecture?
1. Control Plane 2. Data Plane
62
What is the Control Plane in Zero Trust?
The Control Plane defines, manages, and enforces policies related to user and system access within an organization.
63
What is the Policy Engine in Zero Trust?
The Policy Engine cross-references access requests with predefined policies.
64
What is the Policy Administrator in Zero Trust?
The Policy Administrator is used to establish and manage access policies.
65
What is the Policy Enforcement Point in Zero Trust?
The Policy Enforcement Point is where the decision to grant or deny access is executed.

Sec+701 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions