General Security Concepts: Quiz Revision Flashcards
Which of the following are accomplished through identity validation? (Select two.)
A) Authorization models
B) Authenticating people
C) Authenticating systems
D) Gap analysis
Authenticating people is the process of validating that the credential someone supplied, such as a username, account number or email address, actually belongs to that individual. Once the user has supplied the credential, that credential is validated against another piece of information, such as password, an answer to a secret question, or biometrics. Once the person has validated (authenticated) their identity (credential), the requested access is granted based on the identity’s authorization.
Authenticating systems, much like authenticating people, deals with validating the identity of such things as workstations, network devices, various servers, and even processes. In the case of servers, the process of identity validation can be accomplished with digital certificates.
Authentication, authorization, and accounting (AAA) is a term for controlling access to resources using authentication (identity validation), enforcing policies using authorization, and auditing usage to verify that no unauthorized actions or individuals are present.
What are the Authorization models?
Role-based access control (RBAC) – manages permissions according to the user’s role in the organization. Examples of roles might include members of departments, or job titles.
Rule-based access control (RuBAC) – uses rules to grant/deny access. One example is an Access Control List (ACL) used by a router or firewall.
Mandatory access control (MAC) – applies labels to users, otherwise known as subjects, and to files/folders, otherwise known as objects. When the subject label matches the object label, access is granted.
Attribute-based access control (ABAC) – is based on characteristics (attributes) of a user or a system. In the example of a college or university, a department chair or dean would have access to different resources than admissions representatives or financial aid administrators.
Discretionary access control (DAC) – allows the owner of the object (such as a file or folder), to make the decision as to who or what has access to the resource.
Which technique can tip off an investigator that data files have been altered from a previous version?
A) Nonce
B) Salting
C) Hashing
D) Sandboxing
Hashing is a cryptographic process that maintains the integrity of data. Hashes are created using hashing algorithms, which is a one-way process that converts the data of any size into a fixed length unique output. Once you create a hash, the only way to reproduce the same exact hash is to input the exact same text. If you change even just one character in the data, the hash value will completely change as well. This is how investigators can determine if a file has been altered. If the hash is different from the one created by the original version, the investigator knows that the data has been tampered with. If the hash is the same, that indicates that the integrity of the data was maintained and is safe to investigate.
What is Salting?
Salting is a form of key stretching. The practice of salting adds text to each password before the password is hashed to prevent stored passwords from being decrypted.
What is Sandboxing?
A sandbox is a non-production environment in which code or applications can be run without affecting live systems.
Which of the following security control types includes acceptable use policies, handbooks, and posted warning signs?
A) Directive controls
B) Detective controls
C) Compensating controls
D) Preventive controls
In general, directive controls provide behavioral guidance, guidelines, and policies to be followed. Examples of directive controls would include acceptable use policies (AUPs), handbooks, and standard operating procedures (SOPs), among other items. However, they do not do anything to prevent the behavior from occurring. They are used as suggestions to help users comply with security policies. Another example of a directive control could be a code of conduct policy.
What is the security control type of Preventive Controls?
Preventive controls are deployed to avoid a security breach or an interruption of the critical services before they can occur.
Examples of administrative preventive controls are security policies, monitoring and supervising, job rotation, information classification, and personnel procedures. Examples of technical preventive controls are routers, access control lists, encryption, antivirus software, firewalls, and smart cards.
Examples of physical preventive controls are lighting, biometric systems, fences, badge systems, mantrap doors, and security personnel.
What is the security control type of Compensating controls?
Compensating controls are put in place when the primary control is too costly or cumbersome to implement. As an example, if the ideal control was separation of duties, and you could not reassign duties due to a staffing shortage, one compensating control could be to increase the frequency of audits
What is the security control type of Detective controls?
Detective controls detect a security incident as it occurs. Examples of physical detective controls include security guards, motion detectors, CCTVs, and alarms.
Examples of administrative detection controls include monitoring and supervision. Event logs, IDs, and antivirus software are examples of technical detective controls.
What are the four categories of CompTIA’s Access Control?
Technical control – a category of controls that use software or hardware to restrict access, such as firewalls, encryption, network segmentation, and multi-factor authentication.
Physical control – a category of controls that are implemented in the physical realm, such as locks, fences, CCTV, backup media, and secured cabling.
Managerial (sometimes called administrative) control – a category of controls that dictate how management uses oversight to meet the company’s security goals. Managerial controls include risk assessments, performance reviews, background checks, personnel controls, a supervisory structure, security training, and auditing.
Operational control – a category of controls that provide employees with best practices to follow and actions to implement to meet security goals. Examples are standard operating procedures, incident response policies, and password policies.
What are the six different control types that are implemented across technical, physical operational and managerial categories?
Preventative – A preventative control stops security issues before they occur.
Deterrent – A deterrent control influences human behavior to make security issues less likely to occur.
Detective – A detective control finds indicators of security issues that are occurring or have occurred.
Corrective – A corrective control restores control and attempts to correct any damage that was inflicted during a security issue that occurred.
Compensating – A compensating control is put into place when the recommended primary control cannot be used.
Directive – A directive control provides behavioral guidance, guidelines, and policies to follow regarding potential, current, or past security issues.
Which of the following describes a recurring period when patches and configuration changes are performed?
A) Escalation
B) Service level objectives
C) Maintenance window
D) Maintenance exclusion
A maintenance window is a recurring period during which patches and configuration changes (maintenance) are performed. These maintenance windows are typically used for automatic patch deployment and configuration changes. When scheduling a maintenance window, it is important to consider the impact of downtime to the organization, customers, and operations.
What is a maintenance exclusion?
A maintenance exclusion (or maintenance exception) is a timeframe or instance when maintenance would be prohibited. This could be the case when a legacy application cannot be updated. Another example of a maintenance exclusion could be a retail organization that forbids configuration changes during a peak sale period. The maintenance exception should be submitted as a request that is subsequently approved by the change management team.
What are SLO’s?
Service level objectives (SLOs) are the critical metrics within a Service Level Agreement (SLA) that a provider must meet for a client. Policies, governance, and SLOs are key components of attack surface management. SLOs begin with a service level indicator (SLI), which is the item for which performance or service is tracked. An example of an SLI could be server uptime – this is the item for which you want service tracked. The corresponding SLO would be expressed as a percentage, such as a desired server uptime of 99.99%.
Escalation Priority Level?
Escalation is closely related to prioritization. It is important that an organization has a prioritization and escalation policy. When an incident occurs, it is important to assign it a priority level. The priority level determines the order in which the incident is addressed. In addition, the priority level is usually associated with the team or individual within the organization that is tasked with handling that incident level. If the situation changes, conditions deteriorate, or the effects of an event spread, the priority level can be changed, allowing for escalation to another team.
A perfect example of prioritization and escalation exists in the medical community. For example, a bus carrying many passengers crashed. First responders assign a priority level to each passenger according to the severity of their injuries. Those who can be treated at the scene are assigned a lower priority than those who must be transported to the hospital via ambulance. If a patient who is waiting for ambulance transport develops a life-threatening complication, that patient’s priority can be escalated for air transport.
ou must deploy the appropriate control to a section of the network shown in the exhibit. Because of budget constraints, you can only deploy one of each of the following controls:
Proximity access badges
Device encryption
Safe
CCTV
You need to deploy each of these controls to a single area on the diagram. The controls may be used to protect either the entire section or a single component within that section. Match the appropriate control to the best deployment location on the network exhibit. All four locations require a control. Each control should be used only once.
Data Center
Office
Customer WiFi Lounge
Remote Employees
Data Center - Proximity Badge
The proximity access badges will control access to the data center and limit access to approved employees.
Office - Safe
The safe will provide a location in the office to store the laptops and tablets when they are not in use
Customer WiFi Lounge - CCTV
The CCTV will provide a means to monitor activity in the customer wireless network lounge.
Remote Emplpoyees - Data Encryption
Device encryption will ensure that the data on the laptops cannot be accessed by attackers while the sales reps are in the field.
What is a physical barrier that acts as the first line of defense against an intruder?
A) a lock
B) a fence
C) an access control vestibule
D) a bollard
E) a turnstile
Fencing acts as the first line of defense against casual trespassers and potential intruders, but fencing should be complemented with other physical security controls, such as guards and locks, to maintain the security of the facility. A fence height of 6 to 7 feet is considered ideal for preventing intruders from climbing over the fence. In addition to being a barrier to trespassers, the fence can also control crowds. A fence height of 3 to 4 feet acts as a protection against casual trespassers. For critical areas, the fence should be at least 8 feet high with three strands of barbed wire.
List all of Physical security controls?
Physical security controls include the following:
Hardware locks
Access control vestibules
Video surveillance (CCTV)
Fencing
Proximity readers
Access lists
Proper lighting
Signs
Guards
Barricades
Biometrics
Alarms
Motion detectors
Gate/cages
Cameras
Protected cabling
When implementing a security solution for mobile devices, which two common use cases are of primary concern? (Choose two.)
A) Lower power devices
B) Non-repudiation
C) Authentication
D) Obfuscation
E) Low latency
Lower power devices and low latency are the primary concerns with mobile devices. Lower power devices should use cryptographic techniques that require less time to encrypt and decrypt data. As the time to encrypt or decrypt increases, the power requirements increase as well. Devices such as wireless devices, handheld computers, smart cards, and cellular phones have less processing power, storage, power, memory, and bandwidth than other systems, and would benefit from algorithms with shorter key lengths.
Low latency is a concern with any cipher. Latency refers to the delay between the time the plain text is input, and the cipher text is generated. Supporting authentication is validating that the message originator is indeed who they say they are, and not an imposter. This is often implemented using digital certificates. Authentication is not always possible or necessary for mobile devices. Supporting obfuscation is the most basic element in a cryptographic system. Obfuscation refers to hiding the data and is accomplished through encryption and steganography. While obfuscation may be important, it is not as important for mobile devices as low latency and lower power devices.
What is Non-Repudiation in the CIA structure?
Supporting non-repudiation would prevent an imposter from denying that a message was sent, but it does not address data security. Non-repudiation ensures that data’s origin is known. Digital Signatures are the most common method of ensuring non-repudiation. It is also important to determine resource versus security constraints. Resource constraints could include available bandwidth, environmental constraints, and financial constraints. Security constraints would deal with the limitations of the particular cryptographic system chosen.
Management wants you to provide full disk encryption for several of your organization’s computers. You purchase specialized chips that will be plugged into the computers’ motherboards to provide the encryption. Which security protocol, practice, or mechanism does this represent?
A) RipeMD
B) PAP
C) TwoFish
D) GPG
E) TPM
Trusted Platform Module (TPM) is a specialized chip that you install on a computer’s motherboard to assist with full disk encryption. TPM has a storage root key that is embedded into the chip. The storage root key is created when you take ownership of the TPM. If you clear the TPM and a new user takes ownership, a new storage root key is created.
What is a TwoFish method?
TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It does not provide full disk encryption.
What is GPG?
GNU Privacy Guard (GPG) is an alternative to Pretty Good Privacy (PGP). PGP is a data encryption mechanism that provides privacy and authentication for data communication. PGP is often used for signing or encrypting and decrypting texts, e-mail, files, directories, and whole disk partitions to increase the security of e-mail communications. GPG also provides this function and is a FREE alternative to PGP. GPG and PGP do not involve the use of a specialized chip
What is RipeMD?
RipeMD is a 160-bit message digest algorithm. There are 128, 256, and 320-bit versions of this algorithm, called RIPEMD-128, RIPEMD-256, and RIPEMD-320, respectively.
What is a PAP?
Password Authentication protocol (PAP) is an encryption technology in which a user’s name and password are transmitted over a network and compared to a table. Typically, the passwords stored in the table are encrypted.
Which of the following encryption tools is also known as a trusted execution environment (TEE)?
A) Key management system
B) Secure enclave
C) HSM
D) TPM
A secure enclave is also known as a trusted execution environment or TEE. The secure enclave carves out an area in an application or a system, often an isolated area, so that sensitive data can be processed securely. Examples include Apple’s Secure Enclave and Titan M from Google.
What is HSM used for?
A hardware security module (HSM) is typically a removable device that is used in key management systems. HSM can generate cryptographic keys, as well as storing them and managing them. You will often see HSM used with servers.
What is TPM used for?
Trusted Platform Model (TPM) is a chip that is embedded on a motherboard. One of the most common implementations of a TPM is for full-disk encryption (FDE).
What is Key Management System used for?
Key management systems provide centralized management and storage of cryptographic keys.
Which type of controls are an example of a detective control? Choose three.
A) log files
B) lighting
C) fences
D) IR sensors
E) firewalls
F) closed-circuit television (CCTV)
Closed-circuit television (CCTV), log files, and infrared (IR) sensors are detective controls. CCTV is used by guards to prevent unauthorized access to the facility. CCTVs increase visibility by allowing guards to monitor different zones of the facility from a centralized location and find unauthorized access or a security breach. Infrared sensors detect motion, heat, or other anomalous events, and raise an alarm or alert. Logs and log files provide evidence of intrusions, suspicious network traffic, or other anomalous activities that occurred in the system.
Which of the following network architecture concepts consists of a policy engine, a policy administrator, and a policy enforcement point?
A) Hybrid
B) Zero-trust
C) Secure Access Service Edge
D) Cloud
Zero-trust architecture consists of a policy engine, a policy administrator, and a policy enforcement point. The goal of zero trust is to continuously monitor the authentication and authorization of devices, users, and processes. The policy engine is responsible for granting or denying access based primarily on policy, but other factors can be taken into consideration. The policy administrator decides to open or close the communication path from the requestor to the resource, based on the decision of the policy engine. The policy enforcement point establishes and terminates the connections.
What is Secure Access Service Edge (SASE)?
Secure Access Service Edge (SASE) is used to ensure security in a software-defined wide area network (SD-WAN) environment, particularly in a cloud environment. SASE is often associated with the zero-trust model.
Which element is created to ensure that your company is able to resume operation after unplanned downtime in a timely manner?
A) disaster recovery plan
B) vulnerability analysis
C) business continuity plan
D) business impact analysis (BIA)
The disaster recovery plan is created to ensure that your company is able to resume operation in a timely manner. As part of the business continuity plan, it mainly focuses on alternative procedures for processing transactions in the short term. It is carried out when an emergency occurs and immediately following the emergency. The disaster recovery plan (DRP) should include a hierarchical list of critical systems. The first step in the development of the DRP is identification of critical systems.
Is Vulnerability analysis apart of BCP?
A vulnerability analysis identifies your company’s vulnerabilities. It is part of the business continuity plan.
What is a BCP?
A business continuity plan is created to ensure that policies are in place to deal with long-term outages and disasters to sustain operations. Its primary goal is to ensure that the company maintains its long-term business goals both during and after the disruption, and mainly focuses on the continuity of the data, telecommunications, and information systems infrastructures. Multiple plans should be developed to cover all company locations. The business continuity plan is broader in focus than the disaster recovery plan.
What steps are included in BCP?
Policy statement initiation – includes writing the policy to give business continuity plan direction and creating business continuity plan committee, roles, and role definitions.
Business impact analysis (BIA) creation – includes identifying vulnerabilities, threats, and calculating risks. The risk management process is one of the core infrastructure and service elements required to support the business processes of the organization. This stage should also identify potential countermeasures associated with each threat. Recovery point objectives and recovery time objectives directly relate to the BIA.
Recovery strategies creation – includes creating plans to bring systems and functions online quickly.
Contingency plan creation – includes writing guidelines to ensure the company can operate at a reduced capacity.
Plan testing, maintenance, and personnel training – includes a formal test of the plan to identify problems training the parties who have roles in the business continuity plan to fulfill their role, and updating the plan as needed. The company should quantitatively measure the results of the test to ensure that the plan is feasible. This step ensures that the business continuity plan remains a constant focus of the company.
One of the most critical elements in a business continuity plan is management support.
Why is BIA so important?
The major elements of the business continuity plan are the disaster recovery plan, BIA, risk management process, and contingency plan. Although a business continuity plan committee should be created, it is not considered a major element of the plan.
A BIA is created to identify the company’s vital functions and prioritize them based on need. It identifies vulnerabilities and threats and calculates the associated risks but does not include suggestions for how to address the risks.
Which type of deception and disruption technology contains decoy data that the attacker exfiltrates from the system?
A) Honeyfile
B) Honeynet
C) Honeypot
D) Honeytoken
A honeytoken contains specific data that the attacker exfiltrates from the system. Decoy data, such as a bogus email address, bad database data, fake passwords, and other types of ‘planted’ information, make it easier to spot an attack when the data is carried back to the attacker’s system. The purpose of a honeytoken is to alert the IT security team that an attacker has made their way inside the network and removed data, even if the data is valueless to the organization.
