Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ > Glossary C > Flashcards

Glossary C Flashcards

1
Q

C&C (command and control)

A

An infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets. Also known as C2.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CA (certificate authority)

A

A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

cable lock

A

Devices can be physically secured against theft using cable ties and padlocks. Some systems also feature lockable faceplates, preventing access to the power switch and removable drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CAC (common access card)

A

A smart card that provides certificate-based authentication and supports two-factor authentication. A CAC is produced for Department of Defense employees and contractors in response to a Homeland Security Directive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CAN bus (controller area network bus)

A

A serial network designed to allow communications between embedded programmable logic controllers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CAPTCHA (completely automated public turing test to tell computers and humans apart)

A

An image of text characters or audio of some speech that is difficult for a computer to interpret. CAPTCHAs are used for purposes such as preventing bots from creating accounts on web forums and social media sites to spam them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

captive portal

A

A web page or website to which a client is redirected before being granted full network access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

capture the flag

A

Training event where learners must identify a token within a live network environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

card cloning/skimming

A

Duplicating a smart card by reading (skimming) the confidential data stored on it. Also known as skimming.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

carving

A

The process of extracting data from a computer when that data has no associated file system metadata.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CASB (cloud access security broker)

A

Enterprise management software designed to mediate access to cloud services by users across all types of devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

cat command

A

Linux command to view and combine (concatenate) files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

CBC (cipher block chaining)

A

An encryption mode of operation where an exclusive or (XOR) is applied to the first plaintext block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CCMP (counter mode with cipher block chaining message authentication code protocol)

A

An encryption protocol used for wireless LANs that addresses the vulnerabilities of the WEP protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

CE (cryptographic erase)

A

A method of sanitizing a self-encrypting drive by erasing the media encryption key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

chain of custody

A

The record of evidence history from collection, to presentation in court, to disposal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

change control

A

The process by which the need for change is recorded and approved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

change management

A

The process through which changes to the configuration of information systems are implemented, as part of the organization’s overall configuration management efforts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CHAP (Challenge Handshake Authentication Protocol)

A

Authentication scheme developed for dial-up networks that uses an encrypted three-way handshake to authenticate the client to the server. The challenge-response is repeated throughout the connection (though transparently to the user) to guard against replay attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

checksum

A

The output of a hash function. chmod Linux command for managing file permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CIA triad (confidentiality, integrity, and availability)

A

The three principles of security control and management. Also known as the information security triad. or AIC triad.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

circuit-level stateful inspection firewall

A

A Layer 5 firewall technology that tracks the active state of a connection, and can make decisions based on the contents of network traffic as it relates to the state of the connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

CIS (Center for Internet Security)

A

A not-for-profit organization (founded partly by SANS). It publishes the well-known “Top 20 Critical Security Controls” (or system design recommendations).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

clean desk policy

A

An organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.

25
Q

cloud deployment model

A

Classifying the ownership and management of a cloud as public, private, community, or hybrid.

26
Q

Cloud Security Alliance

A

Industry body providing security guidance to CSPs, including enterprise reference architecture and security controls matrix.

27
Q

cloud service model

A

Classifying the provision of cloud services and the limit of the cloud service provider’s responsibility as software, platform, infrastructure, and so on. clustering A load balancing technique where a group of servers are configured as a unit and work together to provide network services.

28
Q

CN (common name

A

An X500 attribute expressing a host or user name, also used as the subject identifier for a digital certificate.

29
Q

COBO (corporate owned, business only)

A

Enterprise mobile device provisioning model where the device is the property of the organization and personal use is prohibited.

30
Q

code of conduct

A

Professional behavior depends on basic ethical standards, such as honesty and fairness. Some professions may have developed codes of ethics to cover difficult situations; some businesses may also have a code of ethics to communicate the values it expects its employees to practice. Also known as ethics.

31
Q

code reuse

A

Potentially unsecure programming practice of using code originally written for a different context.

32
Q

code signing

A

The method of using a digital signature to ensure the source and integrity of programming code.

33
Q

cold site

A

A predetermined alternate location where a network can be rebuilt after a disaster.

34
Q

collector

A

A network appliance that gathers or receives log and/or state data from other network systems.

35
Q

collision

A

In cryptography, the act of two different plaintext inputs producing the same exact ciphertext output

36
Q

community cloud

A

A cloud that is deployed for shared use by cooperating tenants.

37
Q

compensating control

A

A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.

38
Q

confidentiality

A

The fundamental security goal of keeping information and communications private and protecting them from unauthorized access. containerization A type of virtualization applied by a host operating system to provision an isolated execution environment for an application.

39
Q

content filter

A

A software application or gateway that filters client requests for various types of internet content (web, FTP, IM, and so on).

40
Q

context-aware authentication

A

An access control scheme that verifies an object’s identity based on various environmental factors, like time, location, and behavior.

41
Q

continuous delivery

A

Software development method in which app and platform requirements are frequently tested and validated for immediate availability.

42
Q

continuous deployment

A

Software development method in which app and platform updates are committed to production rapidly.

43
Q

continuous integration

A

Software development method in which code updates are tested and committed to a development or build server/code repository rapidly.

44
Q

continuous monitoring

A

The technique of constantly evaluating an environment for changes so that new risks may be more quickly detected and business operations improved upon. Also known as continuous security monitoring or CSM.

45
Q

control risk

A

Risk that arises when a control does not provide the level of mitigation that was expected.

46
Q

COPE (corporate owned, personally enabled)

A

Enterprise mobile device provisioning model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is permitted.

47
Q

corrective control

A

A type of security control that acts after an incident to eliminate or minimize its impact. correlation Function of log analysis that links log and state data to identify a pattern that should be logged or alerted as an event.

48
Q

counter mode (CTM)

A

An encryption mode of operation where a numerical counter value is used to create a constantly changing IV. Also referred to as CTM (counter mode) and CM (counter mode).

49
Q

credential stuffing

A

Brute force attack in which stolen user account names and passwords are tested against multiple websites.

50
Q

CRL (certificate revocation list)

A

A list of certificates that were revoked before their expiration date.

51
Q

crossover error rate

A

Biometric evaluation factor expressing the point at which FAR and FRR meet, with a low value indicating better performance.

52
Q

CSP (cloud service provider)

A

A vendor offering public cloud service models, such as PaaS, IaaS, or SaaS.

53
Q

CSR (certificate signing request)

A

A Base64 ASCII file that a subject sends to a CA to get a certificate.

54
Q

CTI (cyber threat intelligence)

A

The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources. Also known as threat intelligence.

55
Q

Cuckoo

A

Implementation of a sandbox for malware analysis

56
Q

curl command

A

Utility for command-line manipulation of URL-based protocol requests

57
Q

CVE (Common Vulnerabilities and Exposures)

A

Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.

58
Q

CVSS (Common Vulnerability Scoring System)

A

A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.

59
Q

CYOD (choose your own device)

A

Enterprise mobile device provisioning model where employees are offered a selection of corporate devices for work and, optionally, private use.

CompTIA Security+ (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions