General Security Concepts

Question 1

Technical Controls

Answer 1

Controls implemented using hardware, software, and/or firmware.
Examples: Firewalls, anti-virus

Question 2

Managerial Controls

Answer 2

Relate to risk management, governance, oversight, strategic alignment and decision making Examples: risk assessments, project management

Question 3

Operational Controls

Answer 3

Aligned with a processes that are primarily implemented and executed by people.
Examples: change management, training, testing

Question 4

Physical Controls

Answer 4

Designed to address physical interactions like connected to buildings.
Examples: gates, barricades, fences

Question 5

Preventive Control

Answer 5

Stop a threat agent from being successful
Examples: Firewall rules, security policy, security guard, door locks

Question 6

Deterrent Control

Answer 6

Discourage a threat agent from acting
Examples: posted warning signs, threat of demotion, splash screen, reception desk,

Question 7

Detective Control

Answer 7

Identify and report a threat agent or action
Examples: System logs, review login reports, patrol the property, motion detectors

Question 8

Corrective Control

Answer 8

Minimize the impact of a threat agent or modify or fix a situation
Examples: Backups, fire extinguisher, policies for reporting issues, contact authorities

Question 9

Compensating Control

Answer 9

Controls implemented in lieu of a recommended control that provides comparable protection
Examples: Block instead of patch, separation of duties, require multiple security staff, power generator

Question 10

Directive Control

Answer 10

Proactive actions taken to cause/encourage a desirable event or outcome to occur
Examples: Trainings, policies, and authorized personnel only sign

Question 11

CIA Traid

Answer 11

Fundamentals of security
Confidentiality: prevents disclosure of information to unauthorized people or systems
Integrity: Information can’t be modified
Availability: Systems and networks must be up and running

Question 12

Access Controls

Answer 12

Selectively restrict access to a resource

Question 13

Hashing

Answer 13

Map data of a length to data of a fixed length

Question 14

Digital signatures

Answer 14

Math scheme to verify the integrity of data

Question 15

Certificates

Answer 15

Combine with a digital signature to verify an individual

Question 16

Non-Repuditation

Answer 16

Provides proof of integrity, can be asserted to be genuine.

Question 17

Redundancy

Answer 17

Build services that will always be available

Question 18

Fault tolerance

Answer 18

system will continue to run, even when a failure occurs.

Question 19

AAA

Answer 19

Authentication: Verifies a user and who they claim to be
Authorization: Determines if the user has permission to use a resource or access a file.
Accounting: Keeps track of a user’s activity on the system or network.

Question 20

Certificate Authority (CA)

Answer 20

Stores, signs, and issues digital certificates.

Question 21

Registration Authority (RA)

Answer 21

Verifies user requests for a digital certificate and tells the CA to issue it.

Question 22

Honeypot

Answer 22

Decoy server set up to trick an attacker

Question 23

Honeyfile

Answer 23

A decoy file deceptively named so it attracts the attention of an attacker

Question 24

Honeynet

Answer 24

A network of honeypots.

Question 25

Honeytoken

Answer 25

A beacon embedded somewhere that can bait and track an attacker

Question 26

Gap Analysis

Answer 26

The process of evaluating your organization’s current security posture and security framework