Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Lessons 20-24 > Flashcards

Lessons 20-24 Flashcards

1
Q

SCRIPTING TOOLS

A
  1. python- A high-level, versatile programming language. ( Writing scripts, building websites, data analysis, automation, machine learning.)
  2. Powershell- A task automation and configuration management framework from Microsoft, consisting of a command-line shell and scripting language. ( Managing Windows systems, automating administrative tasks.)
  3. Bash- A Unix shell and command language. ( Running commands and scripts on Unix/Linux systems, automating tasks.)
  4. Macro- A set of instructions that automate repetitive tasks within software applications. (Automating tasks in applications like Microsoft Excel or Word.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

SCRIPTING

A

A set of instructions used to automate a sequence of repetitive tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

VBA ATTACK

A

Visual Basic for Applications) attack is a type of cyber attack that exploits the VBA programming language used in Microsoft Office applications like Excel, Word, and Access. Attackers embed malicious VBA code into Office documents, and when the document is opened and macros are enabled, the code executes, potentially compromising the user’s system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security orchestration automation and response (SOAR)-

A

an automation tool that reduces response times, improves consistency and amplifies the productivity of incident response teams.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

INCIDENT MANAGEMENT

A

Is Inclusive of roles and responsibilities, strategies, and procedures for preparing for, responding to, and managing security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Security incident-

A

an event or action that endangers the confidentiality, integrity, or availability of information or information systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data breach

A

when data is exfiltrated or extracted, or there is a loss of control. A data breach may trigger reporting and notification requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident prevention & Incident preparation-

A
  1. threat modeling, risk assessment, controls implementation, monitoring, and assurance activities.
  2. planning, documenting, assigning responsibilities, training, and practicing response capabilities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Incident detection & Incident response

A
  1. monitoring incident reporting, analysis, and participation in threat intelligence and information-sharing activities.
  2. validation, containment, mitigation, eradication, recovery, and evaluation activities.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

INCIDENT PLAYBOOK

A

Is a set of instructions for planning for, and responding to, a specific type of event, attack or scenario

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Categorization

A

the process of classifying incidents based on severity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Escalation thresholds

A

the point at which an incident or issue requires a higher level of attention or response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

INCIDENT RESPONSE TEAM
IRT

A

a group of experts who are responsible for managing and responding to cybersecurity incidents within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Walkthrough

A

personnel or departments review (walkthrough) their plans and procedures for completeness. Accuracy is the objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tabletop

A

scenario-based group workshop focuses on the application of plans and procedures as well as participant readiness. Objectives are familiarity, coordination, and accuracy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Simulation-

A

a localized scenario that simulates an actual event. A pre-planned simulation is scheduled, and attendees are invited. Surprise simulation, attendees are notified “at the moment” objective: readiness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

VALIDATION

A

Determine whether an incident has occurred and, if so, the type, extent, and magnitude of the problem

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Indicator-

A

tells us that something is happening or has happened

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PRIORITIZATION

A

The process of determining the order of importance or urgency. It is the most critical decision point in the incident handling process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CONTAINMENT

A

A short-term approach to limiting or reducing the impact of an incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ERADICATION

A

Is inclusive of the steps taken to correct and or eliminate the root cause (not just the symptoms) that led to the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Root cause analysis (RCA)

A

a method of problem-solving used to investigate known problems and identify what happened and the underlying causes
The main goal of RCA is to prevent the problem from recurring by eliminating the root cause

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CYBER INVESTIGATIONS

A

Can be triggered by a variety of incidents. (intrusion, extortion, insider activity)

3 types of investigations: criminal, civil, and internal (administrative)
Evidence collection is the first step of the investigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Direct evidence

A

supports the truth of an assertion directly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Circumstantial evidence

A

relies on inference to connect it to a conclusion of fact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

E-DISCOVERY

A

Refers to any process in which digital data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal law case.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

A legal hold

A

an order that suspends the modification, deletion, or destruction of records or media. Can be issued to avoid evidence spoliation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

evidence spoliation

A

the intentional, reckless, or negligent withholding, hiding, altering, fabricating, or destroying evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

EVIDENCE COLLECTION

A

Collection of digital evidence is the first step of a forensic investigation.

Governed by 2 main rules
Admissibility of evidence- whether the evidence can be used in court
Weight of evidence- the quality and completeness of the evidence

There is tension between response(find and fix) teams and evidence collectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

VOLATILITY

A

The acquisition of evidence before it disappears is overwritten or is no longer useful

The goal is to create a snapshot of the environment as it existed at the time of the attack or incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Persistent data-

A

data that does not change and is preserved when the device is turned off

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Volatile data

A

data that easily degrade and can be lost when the device is turned off.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

chain of custody

A

is chronoligiacl documentation that records the collection, control, transfer, analysis, and disposition of evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Factual witness

A

a person who is knowledgeable about the facts of the case through direct participation or observations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Expert witness

A

a person who has knowledge beyond that of an ordinary person. Experts can give opinions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

DIGITAL FORENSICS

A

The application of science to the identification, collection, examination, and analysis of data (evidence) while preserving the integrity of the information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

CHECKSUM INTEGRITY

A

A checksum is a single value derived from a block of digital data to detect errors that may have been introduced during its transmission or storage

Checksums are like hashes as they are used to verify data integrity however, they use simpler algorithms and are smaller than hashes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

FILE RECOVERY TERMINOLOGY

A

Cluster- a fixed length block of disk space indexed in a file allocation table or equivalent

Slack space- The space between the end of a file and the end of a cluster. Slack spaces can contain data from RAM or segments of deleted files

Unallocated (free) space- are clusters that are not allocated to a file. Clusters can contain deleted file fragments.

Carving is the process by which deleted files or fragments are recovered

Metadata- data about data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

write blocker

A

used to intercept inadvertent drive writes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

clone

A

exact copy of the entire physical hard drive.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

DATA BREACH

A

an incident where unauthorized individuals or entities gain access to legally protected or confidential information stored by an organization, resulting in the potential misuse, loss, theft, or exposure of that data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

THE DARK WEB

A

Is part of the internet that in not indexed by search engines and is known for its anonymity. Compromised data often ends up on the dark web after a data breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Disclosure

A

the requirements to reveal the situation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Notification

A

the act of informing affected parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

INFORMATION SHARING

A

Describes a means of conveying information or experience from one trusted party to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

An information sharing and analysis center (ISAC)

A

is a trusted sector-specific entity that facilitates sector-specific and or geographic-specific information sharing about vulnerabilities, threats, and incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Structured threat information expression STIX-

A

is a standardized language developed by MITRE and the OASIS cyber threat intelligence (CTI) technical committee for describing cyber threat information. STIX is structured to describe a threat in terms of motivations, abilities, capabilities, and response.

47
Q

Trusted automated exchange of intelligence information TAXII

A

defines how cyber threat information can be shared via services and message exchanges by defining an API. it is designed specifically to support STIX information.

48
Q

three principal models for TAXII include:

A
  1. Hub and spoke- one single source of information
  2. source/subscriber- one single source of information
  3. Peer-to-peer- multiple groups share information
49
Q

downstream liability

A

is responsibility for damages that result from a security compromise in your business

50
Q

DATA SOURCES

A

Incident investigation often requires analysis of several data sources in order to draw a defensible conclusion

51
Q

log data

A

log data is a record of events or activities that occur within a computer system, network, or application.

52
Q

METADATA

A

Data about data; it is machine-readable and searchable

53
Q

PACKET CAPTURE

A

The process of intercepting and logging traffic for analysis

54
Q

Protocol analyzer (sniffer)

A

a tool used to capture and analyze network packets( data can also be imported for analysis)

55
Q

A port mirror

A

captures network traffic from one or several ports of a switch and forwards a copy of the traffic to an analysis device

56
Q

Network tap

A

a dedicated hardware device that is inserted between network devices, like a switch and routers, and makes copies of the traffic and forwards to an analysis device.

57
Q

ENTERPRISE GOVERNANCE

A

The system by which entities are directed, controlled, and held to account

58
Q

SECURITY LEADERSHIP AND GOVERNANCE

A

As applied to information/cybersecurity, governance is the responsibility of leadership to determine and articulate the organization’s desired (future) state of security.

59
Q

A role

A

is a specific position or job title that an individual occupies within an organization or group

60
Q

Stewardship

A

is a responsible oversight and protection of something entrusted to one’s care

61
Q

Responsibility

A

refers to the specific duties or tasks that an individual is expected to fulfill within a given role

62
Q

Strategy-

A

determine the desired (future) state of information/cybersecurity. Codify in strategy and policy. Provide funding

63
Q

Due care

A

a legal construct defined as exercising the standard of care that a prudent person would have exercised under the same or similar conditions.

64
Q

Fiduciary-

A

a person or organization who holds a position of trust. Being a fiduciary requires being bound both legally and ethically to act in the trustor’s best interest.

65
Q

Oversight

A

oversight and authorization of organizational activities

66
Q

Privacy Officer

A

is responsible for developing, implementing, and administering all aspects of an organization’s privacy program

67
Q

Compliance officer-

A

responsible for identifying applicable statutory, regulatory, and contractual requirements, as well as ensuring compliance with thereof

68
Q

Physical security officer-

A

responsible for ensuring that appropriate physical security procedures have been established and controls implemented.

69
Q

Internal audit-

A

responsible for providing independent, objective assurance services.

70
Q

Owners, Custodians & Users-

A
  1. are responsible for oversight and decisions related to classification access control, and protection
  2. are responsible for advising, implementing, managing, and monitoring data protection controls
  3. are responsible for treating data and interacting with information systems in accordance with organizational policy and handling standards
71
Q

POLICY

A

The objective of a policy is to communicate and codify management requirements, and to provide direction.

72
Q

Information security policies

A

codify the high-level requirements for protecting information and information assets, and ensuring confidentiality, integrity, and availability.

73
Q

Agreements-

A

are used to enforce policies and related governance publications legally.

74
Q

Standards & Baselines & Guidelines

A
  1. serve as precise specifications for the implementation of policy and dictate mandatory requirements. Standards must be unambiguous
  2. are the aggregate of standards for a specific category or group such as a platform device type, ownership, or location
  3. help people understand and conform to a standard. Guidelines are customized to the intended audience and are not mandatory.
75
Q

Policy

A

multifactor authentication is required for access to data and systems classified as confidential

76
Q

Standard-

A

multifactor authentication requirements for data and systems classified as confidential. Factor 1: 8-digit numeric PIN, no repeating characters, changed every 90 days. Factor 2: biometric fingerprint

77
Q

ACCEPTABLE USE POLICY (AUP)

A

Details user community obligations about information and information systems
An AUP contains rules that specifically pertain to acceptable behavior, activities that are required, and actions that are prohibited

78
Q

RISK

A

Is broadly defined as uncertainty of outcome.

79
Q

Low-risk volatility

A

means that the level of risk is relatively stable and predictable over time

80
Q

High-risk volatility

A

means that the level of risk is likely to fluctuate significantly over time

81
Q

RISK VELOCITY

A

Measures how fast an exposure can impact an organization

Is the time that passes between the occurrence of an event and the point at which the organization first feels its effects

82
Q

CASCADING RISK

A

Is the principle that, often, risks are linked, and failing to address one risk could cause a chain reaction

The cascading risk is divided into 3 categories
Parallel risk
Serial risk
Mixed risk

83
Q

RISK APPETITE

A

The level of risk that an organization is comfortable engaging in

84
Q

RISK MANAGEMENT

A

Implies that actions are being taken to either mitigate the impact of an unfavorable outcome and or enhance the likelihood of a positive outcome

85
Q

RISK ASSESSMENT

A

A structured method of understanding risk

86
Q

RISK ANALYSIS

A

The process by which the likelihood, impact, and level of risk are determined

Inherent risk- the level of risk before controls or safeguards have been implemented

Residual risk- the level of risk after controls or safeguards have been implemented

87
Q

QUALITATIVE RISK ANALYSIS

A

Uses well-defined descriptive terminology to indicate likelihood, impact, and residual risk.

88
Q

Qualitative

A

uses narrative to describe likelihood and impact. outcome is a descriptor.

89
Q

Quantitative-

A

assigns numeric and monetary values to likelihood and impact. Outcome is monetary

90
Q

ALE annualized loss expectancy

A

the financial impact on an annualized basis

91
Q

ARO annualized rate of occurrence

A

how many times in a single year the event is expected to occur

92
Q

SLE single loss expectancy t

A

the financial impact of a single event

93
Q

Risk response

A

the responsibility to determine how to respond to the outcome of a risk analysis

94
Q

Risk treatment-

A

to select one or more options for addressing an identified risk.

95
Q

Risk tolerance

A

tactical and specific to the target being evaluated.

96
Q

Risk appetite

A

a strategic construct broadly defined as the level of risk an entity is willing to accept in pursuit of its mission

97
Q

Risk exception

A

a formal acknowledgment that a risk has been identified, but it is not feasible or practical to implement standard risk treatment or control measures. Workarounds may be implemented

98
Q

Expectation handling-

A

the process of approving an exception on either a temporary or permanent basis

99
Q

Risk exemption-

A

a formal decision not to address risk at all. Generally implemented when the potential impact of a risk is low, and the cost and effort required to mitigate the risk are disproportionate to the potential impact.

100
Q

Risk monitoring

A

a continuous activity that is used to identify trends, failures, or opportunities and respond in an efficient and appropriate manner

101
Q

Risk reporting

A

the process of communicating real-time risk and performed data to stakeholders.

102
Q

Risk register

A

a dynamic, central repository for all risk-related documentation, tracking, and accountability including acceptance exceptions and exemptions.

103
Q

Heat maps

A

a visualization tool to convey likelihood and impact

104
Q

Dashboards

A

a visualization tool to convey security posture.

105
Q

Metrics

A

predefined measures usually in the form of Key Risk Indicators KRIs.

106
Q

KEY RISK INDICATORS KRIs

A

Are predictors (early warning signs) of unfavorable events that can adversely impact an organization

107
Q

A leading indicator

A

looks forward at future outcomes and events. Leading KRIs are measures that are considered predictive in nature. They are derived from metrics that can help to forecast future occurrences.

108
Q

Lagging indicator-

A

looks back at what happened. Lagging KRIs are metrics based on historical measures and are used to identify trends.

109
Q

BUSINESS IMPACT ANALYSIS

A

Characterize the system components, supporting business processes, and interdependencies.

110
Q

MAXIMUM TOLERABLE DOWNTIME MTD

A

Represents the amount of time the system owner is willing to accept for a service/process outage or disruption and includes all impact considerations.

111
Q

Service delivery objective (SDO)-

A

the acceptable level of operations in alternate processing mode

112
Q

RPO

A

recovery point objective is the acceptable data loss. This translates to the point in time, prior to the disruption that data can be recovered.

113
Q

RTO

A

recovery time objective is the amount of time allocated for system recovery before negatively impacting other systems

114
Q

MTTR

A

mean time to repair is the average time it takes to repair a failed component or device

115
Q

MTBF

A

mean time between failures is a measure of reliability (usage stated in hours)

Security+ 701 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions