Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Lessons 15-19 > Flashcards

Lessons 15-19 Flashcards

1
Q

Asset

A

An asset is any device, data or other components of value to an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Owners-

A

are responsible for decisions related to classification, and access control, as well as oversight of protection mechanisms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Custodians

A

are responsible for implementing, managing, and monitoring controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Network mapping

A

used to create physical and logical diagrams. Popular network mapping tools include Solarwinds, Spiceworks, ManageEngine, and Nmap.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Network Enumeration

A

discover and document devices and characteristics. DumpSec and Nessus.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

End-of-sale

A

when the product, service, or subscription, is no longer for sale.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

End-of-life & End-of-support

A
  1. when the product, service, or subscription is deemed obsolete. Once obsolete the product is not sold, improved, or maintained.
  2. the last date to receive service and support. After this date, updates are no longer available.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Fixed lifecycle-

A

products with defined dates at the time of release.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Continuous (modern) lifecycle-

A

products with continuous support and servicing. Generally, customers must take the latest update to remain supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ARCHIVING

A

The process of securely storing original, unmodified files for later potential retrieval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

LEGAL HOLD

A

Is the requirement of an organization to preserve all forms of relevant information when litigation, audit, or government investigation is anticipated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DATA REMANENCE

A

Refers to the residual traces of data that remain on a storage medium even after attempts have been made to erase or delete the information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

TRIM

A

is a command used by OS to inform solid state drives which blocks of data are no longer in use. When TRIM is executed, the SSD may immediately erase the associated data, reducing the likelihood of remanence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DATA SANITIZATION

A

Aka disk wiping- is a clearing technique that overwrites all addressable storage and indexing locations multiple times.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Shredding (shearing), Pulverizing, Pulping, Burning

A
  1. physically breaking media into pieces
  2. reducing media to dust
  3. chemically altering media
  4. incinerating media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CERTIFICATE OF DESTRUCTION

A

Is issued by the commercial services upon the destruction of media
Certificates should include at minimum: date of destruction, description of media(including serial number), method of destruction, witnesses, company name and address with contact information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Exposure-

A

a system of software configuration issue, or lack of control that could contribute to a successful exploit or compromise.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

BUG BOUNTY PROGRAM

A

Aka A vulnerability rewards program (VRP) is an incentive program that compensates individuals for identifying and reporting vulnerabilities or bugs
Open bug bounty program- offered by hundreds of companies like Google, Microsoft, and Facebook
Closed bug program- invitation only.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CVE PROGRAM

A

Is an international, community-driven effort to catalog hardware and software vulnerabilities for public access.
A CVE is a standardized identifier for a given vulnerability or exposure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

COMMON VULNERABILITY SCORING SYSTEM
CVSS

A

CVSS is an open frame for communicating the characteristics and severity of hardware and software vulnerabilities.
There 5 ratings: none, low, medium, high, and critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

VULNERABILITY SCANNING

A

The automated activity that relies on a database of known vulnerabilities such as CVE/NVD, designed to identify vulnerabilities in the target environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Vulnerability assessment-

A

identify host attributes and known common vulnerabilities and exposures CVE. find the report.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Penetration testing

A

evaluate the security of a target by identifying and providing proof of concept of flaws and vulnerabilities or by performing compromise exploitation. Find then exploit then report.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PATCH MANAGEMENT

A

The process of identifying, acquiring, installing, and verifying patches (updates)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Dynamic application security testing - DAST

A

a type of security testing that analyzes a running application to find vulnerabilities by simulating attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

AUDIT AND EVENT LOGS

A

Are a chronological record of events and actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

SYSLOG

A

System logging protocol is a standard protocol used to send system log or event messages to a Syslog server.
* Syslog is used to collect logs from different devices to store in a central location for monitoring and review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SIEM-

A

security information and event management is an automation tool for real-time data capture event correlation analysis, and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

TIP

A

threat intelligence platform is an automation tool that combines multiple threat intelligence feeds and integrates with existing SIEM solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

UEBA

A

User and Entity Behavior Analytics is an automation tool that models the behavior of humans and machines to identify normal and abnormal behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

SOAR

A

security orchestration automation, and response is an automation tool that responds to the alerts, triages the data, and takes remediation steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Orchestration

A

he integration of disparate tools and platforms for an automated response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP)

A

Is a widely used network management protocol that allows administrators to monitor and manage network devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

SNMP agents

A

software modules installed on managed devices. They collect and store information about the device’s performance and respond to queries from SNMP management systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

SNMP managers

A

send SNMP queries to agents to retrieve information and can also issue configuration commands to the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

NETFLOW

A

A network protocol developed by Cisco Systems that allows the collection and analysis of network traffic data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

IPFIX-

A

is an industry-standard protocol based on NetFlow v9 that provides a vendor-agnostic format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

cve- Common Vulnerabilities and Exposures

A

is a database of publicly known cybersecurity vulnerabilities and exposures. Each vulnerability is assigned a unique identifier, making it easier for organizations to share and reference security issues consistently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

CCE (Common Configuration Enumeration)

A

a standard that provides unique identifiers for system configuration settings to help organizations manage and assess their security configurations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

CPE (Common Platform Enumeration

A

is a standardized method of naming and identifying software applications, operating systems, and hardware devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

CVSS (Common Vulnerability Scoring System)

A

is a standardized framework for rating the severity of security vulnerabilities. It provides a numerical score from 0 to 10, with higher scores indicating more severe vulnerabilities, helping organizations prioritize their responses to security issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

OVAL (Open Vulnerability and Assessment Language)

A

is a standardized language used to describe and share information about the security vulnerabilities and configuration issues of computer systems. It helps automate the assessment, reporting, and remediation of these security issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

IDS/IPS-

A

analyze and monitor for suspicious traffic. IPS can deny traffic access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

DLP

A

detect and prevent unauthorized transfer and exfiltration of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

NAC

A

enforce endpoint access privileges based on pre-admission and post-admission policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Web filters

A

enforce restrictions to websites based on predefined criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

EDR/XDR

A

advanced integrated platforms that monitor, report on, and respond to security threats.

48
Q

Browser extensions (client-side)

A

plugins or addons used on individual devices to filter internet access. Small-scale use.

49
Q

INTERNET PROTOCOL IP

A

A set of rules for routing and addressing packets of data- it is the language of the internet

50
Q

IP convergence

A

is the use of the IP as the standard transport for transmitting all information

51
Q

Extensibility-

A

is additional functionality or the modification of existing functionality without altering the original structure or data flow.

52
Q

Open standard

A

a standard that is publicly available and can be freely adopted and extended.

53
Q

Address Resolution Protocol ARP

A

IP address to MAC address mapping. IPv6 uses a neighbor discovery protocol

54
Q

Internet Control Messaging Protocol ICMP

A

Error control and troubleshooting (ping, tracert)

55
Q

Internet Group Management Protocol IGMP

A

Multicasting IPv6 uses multicast listener discovery

56
Q

Transmission Control Protocol TCP

A

3-way handshake connection- delivery

57
Q

User Datagram Protocol UDP

A

Connectionless delivery

58
Q

IPv4

A

deployed in 1981, was the first publicly used version (i-3 was experimental) of 32-bit address in dotted decimal form, IP address scarcity, and limited security options.

59
Q

IPv6-

A

deployed in 1999 (adoption phase)
128-bit address in hexadecimal form
2^128 addresses (340 trillion trillion trillion)
Integrated IPsec
Stateful and stateless auto-configuration capabilities
Scans less effective because of the largest address space
Sniffing is more difficult because of mandated IPSec

60
Q

QUALITY OF SERVICE QoS

A

Is a feature of network devices which prioritizes traffic
Controls and manages network resources by setting priorities for specific types of data on the network

61
Q

APPLICATION LAYER PORTS

A

*The path of communication from the transport layer to the application layer is through a port
*Port- is an identifier for an application whining a computer
*Applications listen for connections on a port dedicated to that service
*A port is associated with either UDP or TCP
65,535 available ports are broken into 3 ranges
*Ports 1-1,203- assigned by the Internet Assigned Number Authority (IANA) well-known ports
*Ports 1,024-49,151 can be registered with IANA
*Ports 49,151-65,535- ary dynamic or private ports

62
Q

Some Common Ports

A
  1. Port 20/21: FTP (File Transfer Protocol) - Used for transferring files.
  2. Port 22: SSH (Secure Shell) - Used for secure remote login and command execution.
  3. Port 23: Telnet - Used for unencrypted text communications.
  4. Port 25: SMTP (Simple Mail Transfer Protocol) - Used for sending emails.
  5. Port 53: DNS (Domain Name System) - Used for resolving domain names to IP addresses.
  6. Port 80: HTTP (HyperText Transfer Protocol) - Used for web traffic.
  7. Port 110: POP3 (Post Office Protocol 3) - Used for retrieving emails.
  8. Port 143: IMAP (Internet Message Access Protocol) - Used for retrieving emails with more features than POP3.
  9. Port 443: HTTPS (HTTP Secure) - Used for secure web traffic.
  10. Port 3389: RDP (Remote Desktop Protocol) - Used for remote desktop access.
63
Q

secure protocol

A

is to ensure confidentiality, integrity, authentication, nonrepudiation, or any combination thereof.

64
Q

SECURE COMMUNICATIONS AND MANAGEMENT PROTOCOLS

A

HTTPS (80)- HTTP + TLS
FTPS (989,990)- FTP + TLS
Secure SHell (22)- secure channel between a local and remote device. Telnet replacement
SFTP (22)- Secure file transport packaged with SSH
SRTP (5601)- Used for securely sending audio and video messages over IP networks
S/MIME- Used to send digitally signed and encrypted email messages
DNSSec (53)- an extension to the DNS protocol that enables origin authentication, authenticated denial of existence, and data integrity.

65
Q

SECURE EMAIL COMMUNICATIONS

A

Refers to the use of various measures and protocols to protect the confidentiality, integrity, and authenticity or email messages exchanged between parties.

66
Q

SPF- sender policy framework-

A

email authentication method designed to prevent email spoofing and protect against forged or unauthorized use of domain names in email messages.

67
Q

DKIM- DomainKeys Identified mail-

A

an email authentication method designed to verify the authenticity and integrity of email messages.

68
Q

DMARC- Domain-based message authentication, reporting, and conformance

A

an email authentication protocol that helps protect against email spoofing and phishing attacks.

69
Q

SPF Record-

A

The domain owner creates an SPF record and publishes it in the DNS settings of their domain. The SPF record contains information about the authorized email servers that are allowed to send emails on behalf of the domain.

70
Q

Server-to server encryption

A

establishes an encrypted connection to protect the email data in transit between the senders and recipient servers.

71
Q

End-to-end encryption-

A

ensures that the email message is encrypted on the sender’s device and can only be decrypted by the intended recipient. This means that not even the email service provider has access to the decrypted content.

72
Q

TLS-

A

transport layer security is a cryptographic protocol used to encrypt communication between email servers during transmission.

73
Q

S/MIME-

A

Secure/Multipurpose internet mail extensions is a standard for secure email messaging that provides encryption and digital signatures.

74
Q

WINDOWS GROUP POLICY

A

Provides centralized management and configuration of OS, applications, and users settings in a Microsoft Windows Active Directory environment.

75
Q

Group policy object GPO

A

a group of settings. They can be associated with single or numerous active directory containers, including sites, domains, or organizational units (OUs)

76
Q

Group policy management console GPMC

A

snap-in provides a single administrative tool for managing group policy across the enterprise

77
Q

SECURITY-ENHANCED LINUX (SELinux )

A

Is the Linux kernel access control security module
Created by the US national security agency NSA and Red Hat. This security module is available for most Linux distributions but is mainly used on RHEL and Fedora
SELinux operates on the principle of least privilege. By default, everything is denied and the policy is written that gives each element of the system only the permissions it needs to function

78
Q

Targeted policy

A

the most common type of policy is targeted policy where only selected processes are protected.

79
Q

Strict policy

A

the more stringent policy where all processes are protected.

80
Q

Enforcing-

A

the default and most secure SELinux mode, SELinux enforces the access control policies and does not allow users to override them.

81
Q

Permissive

A

SELinux does not enforce the policies but logs events when a user or process attempts to access a resource blocked off by the policies. This enables monitoring for potential issues

82
Q

IDENTITY AND ACCESS MANAGEMENT

A

IAM is a business process of enabling the right individuals to access the right resources at the right times and for the right reasons.

83
Q

Provisioning & Deprovisioning

A
  1. the process of creating and managing digital identities
  2. the process of removing and deleting digital identities
84
Q

onboarding

A

Account creation requests, User agreements are signed (NDA/AUP), user accounts are created, and group/role memberships are established.
Credentials then assigned
Orientation and training

85
Q

Authorization

A

Authorization is granted by data/resource owners or a “need to know” is established
Rights and permissions are assigned by the custodian
User training

86
Q

Change Requests

A

User accounts are audited
User access is audited
Change requests submitted based on personnel requirements
Change requests are audited
Security education, training and awareness (SETA)

87
Q

Termination/ offboarding

A

Termination tasks include reclaiming physical assets and access control assets, and removing/disabling accounts and access.
Reassigning file and folder permissions and ownership
Users should be reminded of any agreements that extend beyond employment.

88
Q

Authorization creep

A

the accumulation of unnecessary rights and permissions over time

89
Q

SINGLE SIGN-ON SSO

A

Users can access multiple applications within the same organization or domain using a single set of credentials.

90
Q

Federated identity

A

It enables users to access applications or platforms across multiple enterprise domains (that are apart of a federated configuration) using a single set of credentials (portable identity)

91
Q

FEDERATED IDENTITY MANAGEMENT

A

FIM refers to the process and technologies involved in managing user identities, access rights, and permissions across federated systems.

92
Q

SAML - security assertion markup language

A

An XML-based open standard for exchanging authentication and authorization data between a SP and an IdP

93
Q

Authorization server API/ resource

A

the server that authenticated the user and issued an access token to the resource server.

94
Q

OAUTH 2.0

A

An open standard protocol and framework designed to provide secure, delegated access to resources without sharing credentials

95
Q

BIOMETRICS

A

Physical or behavioral human characteristics that can be used to digitally identify a person

96
Q

PHYSIOLOGICAL MARKERS AND BEHAVIORAL TRAITS

A
  1. Fingerprint- a unique pattern of finger ridges.
  2. Retinal- unique structure of capillaries that supply the retina with blood
  3. Iris- unique color and iris patterns
  4. Vein- unique vein pattern in palm and fingers
  5. Facial- based on facial features
  6. Voiceprint- unique vocal attributes
  7. Handwriting- analysis of speed, shape, and stroke of the pen
  8. Gait- walking traits such as step length, width, speed, and angle
97
Q

ACCESS CONTROL

A

Is a security process that enables organizations to manage who is authorized to access data and resources and what they are allowed to do

98
Q

Physical access control

A

focuses on facilities, equipment, devices, and paper

99
Q

Logical access control

A

focuses on systems, applications, and data

100
Q

Rights

A

are entitlements granted to users that determine their level of control and access within a system: change system time, create a user, install software.

101
Q

Permissions

A

specific authorizations and define what a user can do with specific files or system resources: read, write, delta, modify

102
Q

Dual control

A

requires more than one subject or key to complete a specific task.

103
Q

Separation of duties

A

implies breaking a task into separate processes, so no one subject is in complete control or has overriding decision-making power.

104
Q

Subjects

A

are active entities, generally in the form of a person, process, or device that causes information to flow among objects, or changes the system. State.

105
Q

Objects

A

passive entities(resource) that contain or receive information or instructions
Authorization can be static(hard-coded) or dynamic (influenced by situational factors)

106
Q

Role-based (RBAC)-

A

access is based on the subject’s assigned roles.

107
Q

Mandatory (MAC)

A

MAC access is based on the relationship between subject clearance( and need to know), and object classification level

108
Q

Attribute- based (ABAC)

A

access is determined by a combination of attributes.
* Is a logical access control model that controls access to objects by evaluation rules against the attributes of the subject and object, operations, and the environment

109
Q

Discretionary (DAC)

A

determined by the data owner

110
Q

PRIVILEGED ACCOUNTS

A

Is any account that provides rights and permission above and beyond those of non-privileged (standard) accounts

111
Q

Standing privileged

A

is defined as accounts that have persistent privileged access 24x7x365

112
Q

ZERO-STANDING PRIVILEGE (ZSP)

A

Aims to minimize the standing privileges granted to users or accounts within a system
In practice, ZSP means continuous reauthentication (explicit validation), and granting to authorized users the privileged access they need for the minimum time and only the minimum rights that they need (least privilege)

113
Q

Administrator-

A

generally have the highest level of access and control over an OS, device, application, database, or network

114
Q

Root/sudo

A

have complete control over the UNIX/LINUX systems

115
Q

PRIVILEGED ACCESS MANAGEMENT (PAM)

A

A set of practices, technologies, and policies designed to manage and secure privileged accounts and access to critical systems and sensitive data within an organization

116
Q

Just-in-time privileged access-

A

is provided only for a limited duration and specific tasks

117
Q

Privileged elevation and delegation

A

mechanisms for granting temporary or restricted privileges to non-privileged users when needed, reducing the dependency on persistent privileged accounts

Security+ 701 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions