Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sy0-601 > Main > Flashcards

Main Flashcards

1
Q

Prepending

A

Two seperate definitions
1. Making a message appear more trustworthy by adding text before the message. E.g adding [SAFE] to the subject of an email.
2. Url high hijacking technique where the attacker puts text at the beginning of their typosquatted URL https://pprofessormesser.com/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Pharming

A

Similar to phishing but attacking DNS in order to redirect to your malicious site in order to harvest credentals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Pretexting

A

A fictitious scenario added to a conversation to make a request more believable. Used by attackers in social engineering.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Hoaxes

A

A threat that doesn’t actually exit.
e.g Email chain about fake cyber attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Methods for identifying spam

A
  1. Allowed list, trusted senders
  2. SMTP standards checking, block emails that don’t meet RFC standards
  3. rDNS, reverse DNS, block email where sender’s domai doesn’t match IP address
  4. Tarpitting, intentionally slow down server conversation
  5. Recipient filtering, block all email not addressed to valid recipient email address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Credential harvesting

A

Grabbing all the credentials stored on a PC, phone, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Principles of Social Engineering

A
  1. Authority
  2. Intimidation
  3. Consesus / Social Proof
  4. Scarcity
  5. Urgency
  6. Familiarity / Liking
  7. Trust
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Types of malware

A
  1. Virus
  2. Crypto-malware
  3. Ransomware
  4. Worms
  5. Trojan horse
  6. Rootkit
  7. Keylogger
  8. Adware/Spyware
  9. Botnet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Virus

A

Malware that can reproduct itself through file systems or network. Key difference between worms: Virus requires user input to spread, like opening a malicious file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Worms

A

Malware that self-replicates across a network with no user interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Crypto-malware

A

Newer generation of ransomware, pay the bad guys for your data back. This is what you think of when you think “ransomware”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ransomware

A

Malware that attempts to extort money from the target. May or may not encrypt data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Trojan horse

A

Malware that pretends to be something else, e.g Rouge AV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Rootkit

A

Malware that modifies core system files, can be invisible to the operating system and traditonal AV
e.g Malicious kernel drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Rainbow tables

A

Optimized pre-built set of hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Salt

A

Random data added to password when hashing. Every user gets own random salt. Stops rainbow tables. Slow down brute force process. Same password will create different hashes depending on the salt.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Machine learning attacks

A
  1. Poison the training data
  2. Find ways to evade the AI. E.g Holes in an AI based IPS or IDS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Birthday attack

A

Find a collison through brute force. Generate multiple versions of plaintext to match hashes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Downgrade attack

A

Attacker forces the system use a worse form of encryption if it is supported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Replay attack

A

Gather network information with a tap ARP poisoning, malware, or protocol analyzer. Then resend the information collected to the server, maybe it will be accepted as valid.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

SSRF

A

Server side request forgery. Attacker tells the web server to do something, and it does it. Caused by bad programming and not checking for who sent the request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Shimming

A

Code that acts as an adapater for backwards compatibility. Often written by malware developers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Metamohpric Malware

A

Refactors itself to make it appear different each time. Intelligently redesigns itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SSL Stripping / HTTP Downgrade

A

Attacker sits in middle of conversation between victim and server. Attacker essentially has all the encryption keys, so it can decrypt the HTTPs data, giving plaintext. Attacker reads everything, but the victim thinks he’s running HTTPS the entire time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Bluejacking

A

Sending unsolicited messages to another device via bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Bluesnarfing

A

Access a bluetooth-enabled device and transfer data
e.g Contact list, calendar, email, pictures, video, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Cryptographic nonce

A

Arbitrary number that is used only once in a cryptograhic process. Usually a random or psuedo-random number or a counter. A salt is an example of a nonce.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Initalization Vector (IV)

A

Type of nonce. Used for randomizing an encryption scheme.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

MAC Flooding

A

Filling up the MAC table on a switch, forcing ou tthe legitmate MAC addresses. The switch will begin to flood out on all interfaces, turning the switch into a hub. Attacker can then easily capture all network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

DNS poisoning

A

Modify the DNS server, change it so that DNS lookups give the responses that the attacker desires. Can be used to highjack domains, get victims to go to your malicious site, DOS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

URL Highjacking Techniques

A
  1. Typosquatting / brandjacking, takes advantage of poor spelling
  2. Outright mispelling
  3. Typing error
  4. Different phrase in URL
  5. Different top-level domain, e.g .org instead of .com
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Types of threat actors

A
  1. Insiders
  2. Nation states
  3. Hackitivst
  4. Script kiddies
  5. Hackers
  6. Shadow IT
  7. Organized crime
  8. Competitors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Broad categories of threat intelligence

A
  1. Open source
  2. Closed/proprietary
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Threat intelligence sources

A
  1. Vulnerability databases
  2. Information-sharing centers
  3. Automated indicator sharing (AIS)
  4. Indicators of compromise (IOC)
  5. Predictive analysis
  6. Dark web intelligence
  7. File/code repos
  8. Threat maps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Automated Indicator sharing (AIS)

A

Enables real-time exchange of machine-readable cyber threat indicators through a server/client architecture for communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

TTP

A

Tactics, techniques, procedures used by adversaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Threat hunting

A

Find the attacker before they find you

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Types of vulnerability scans

A
  1. Non-intrusive
  2. Intrusive
  3. Credentialed
  4. Non-credentialed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Syslog

A

Standard for message logging, needs a lot of disk space, used on central log collector integrated into the SIEM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

SOAR

A

Security orchestration, automation, and response

  1. Orchestration - Connect many different tools together
  2. Automation - Handle security tasks automatically
  3. Response - Make changes immediately
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Pentester’s process

A
  1. Recon / footprinting
  2. Inital exploitation
  3. Lateral movement
  4. Persistence
  5. Pivoting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Security teams

A
  1. Red team
  2. Blue
  3. Purple - Red and blue working together
  4. White - Refs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Baseline configuration

A

Established reference point for integrity measurement checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Data masking

A

Techniques used to obfuscate sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Data states

A
  1. At rest
  2. In transit - Over network
  3. In use - Ram
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Tokenization

A

Replace sensitive data with non-sensitive placeholder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

IRM

A

Information Rights Management.

Technology used to limit the scope of what users can do with data. e.g Preventing copy past, screenshotting, printing, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Site resilliency: Types of sites

A
  1. Hot - Exact replica
  2. Warm - Between hot and cold
  3. Cold - Electricity, building, not much else
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

DNS Sinkhole

A

DNS that hands out incorrect IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Types of cloud models

A
  1. IaaS Infrastructure as a service - Sometimes called hardware as a service
  2. PaaS Platform - Someone else handles the platform you handle development, no servers, no software, no maintenance team, no HVAC
  3. SaaS Software - On demand software, no local installation
  4. XaaS Anything - Broad description of all cloud models
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

0 octal

A

000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

1 octal

A

001

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

2 octal

A

010

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

3 octal

A

011

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

4 octal

A

100

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

5 octal

A

101

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

6 octal

A

110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

7 octal

A

111

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Data governance

A

Processes used by an organization to manage, process, and protect data. Used to ensure availability, readability, integrity, and security of data. Also, used to comply with external laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

HIPAA

A

Health insurance portability and accountability act. A data governance regulation. Mandates that organizations protect health information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

GLBA

A

Gramm-leach Bliley act. Data governance regulation that requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

SOX

A

Sarbanes-oxley act. Data governance regulation that requires that executives take individual responsibility for the accuracy of financial reports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

GDPR

A

General data protection regulation. Data governance regulation that mandates the protection of privacy data for individuals who live in the EU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Data retention policy

A

Specifies how long data is retained and sometimes specifies where it is stored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Blank

A

TCP 21, 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

SSH Port

A

TCP 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

DNS Port

A

53 tcp for zone transfers
53 udp for name resolution queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

NTP Port

A

UDP 123

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

BGP

A

Border gateway protocol
Enables exchange of routing information between autonomous systems
TCP 179

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

IPSec port

A

Uses internet key exchange (IKE) over port 500 UDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

RDP port

A

TCP 3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

POP3, secure POP ports

A

TCP 110 unencrypted
TCP 995 encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Imap4 and encrypted imap ports

A

TCP 143 unencrypted
TCP 993 encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Smtp and smtp-over-TLS port

A

TCP 25 unencrypted
TCP 587 for email encrypted with tls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Telnet port

A

TCP 23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

FTP ports

A

Active mode: TCP 21 control signals, TCP 20 for data
Passive mode: TCP 21 control signals, random TCP port for data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Sftp

A

TCP 22
Secure FTP
Inherently secure. Unlike FTPS, which just adds a layer of security with TLS. Both are secure though.
Used by SSH for file transfers. Not FTPS!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

LDAP, LDAPS

A

Lightweight Directory Access Protocol
LDAP TCP 389
LDAPS TCP 636
LDAP specifies the formats and methods used to query directories. Commonly is used to store information for authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

SSTP ports

A

Secure socket tunneling protocol
Encrypts VPN traffic using tls on port TCP 443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

TFTP Port

A

Trivial file transfer protocol
UDP 69

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Kerberos port

A

UDP 88

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Ping

A

Ping -t 172.26.5.1, continuous
Ping -c 4 172.26.5.1, 4 times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Ipconfig

A

Ipconfig /all
Ipconfig /flushdns, flush dns cache
Ipconfig /displaydns, show dns cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Ifconfig

A

Ifconfig -a, similar to ipconfig /all
Ifconfig eth0, show conf. eth0
Ifconfig eth0 promisc, enable promisc mode, process all traffic
Ifconfig eth0 allmulti, enable multicast mode, process all multicast traffic
Ifconfig eth0 -allmulti, disable multicase mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Ip (tool)

A

Ip link show, show interfaces
Ip link set eth0 up, enable eth0
Ip -s link, show network stats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Netstat

A

Netstat -a, show all tcp udp ports being listened on
Netstat -r, show routing table
Netstat -e, show network stats
Netstat -s, show net stats for specific protocols
Netstat -n, show addresses and ports in numerical order
Netstat -p protocol, show stats on specific protocol
Netstat, show open TCP connections

You can combine options. E.g netstat -anp tcp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Tracert

A

Windows
tracert google.com, show hops between system and Google
racert -d google.com, don’t resolve IP addresses to host names, makes command faster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Traceroute

A

Linux
Traceroute -n google.com, don’t resolve IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Pathping

A

Sends pings to hops on routes. Computes statistics depending on responses to pings.
Pathping -n google.com

If a hop has 100% packet loss. Chances are it is just blocking icmp. If it really is bad, then all other hops from that point on in the path must also be dropping 100%.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Arp

A

Windows and Linux
Arp, help on windows, arp cache linux
Arp -a google.com, show arp cache entry for specified ip
Arp -a, show entire cache on windows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Tail

A

Tail -n 15 /var/log/messages, show last 15 lines.
Tail /var/log/messages, show last 10 lines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Logger

A

Linux
Add entires to /var/log/syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Journalctl

A

Linux
Query linux system logging utility called journald.
Journalctl – since “1 hour ago”, show logs only in journals.
Journalctl –list-boots, show boot logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

FAR

A

False acceptance rate
Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

FRR

A

False rejection rate
Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

CER

A

Crossover error rate
Point on graph of sensitivity (x), error percentage (y), where FAR and FRR intersect. Increasing or decreasing sensitivity at this point will cause one of the error rates to go up and the other to go down. Lower CER means a better biometric accuracy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Role-BAC

A

Role based access control
Uses roles to manage rights and permissions for users. Roles are often implemented as groups. Think Microsoft security groups.

Admins have complete access
Executives have access to data on any project on server but can’t change server settings
Project managers have full control over their own projects but not any other teams projects
Team members can do work that project managers assign them but have little access outside of it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Rule-BAC

A

Rule based access control
Uses rules. Common example is rules in routers and firewalls, which use access control lists to contain and organize the rules. Some rules are static, others might be modified on the spot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

DAC

A

Discretionary access control
Objects (files, folders, etc) have an owner, the owner establishes access for the objects. Example is NTFS used in windows, which allows users and administrators to restrict access to files and folders with permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

SID

A

Security identifier. Used in windows discretionary access control. Long string of characters used to identify users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

MAC (not network)

A

Mandatory access control
Uses labels to determine access. Admins assign labels to objects and users. If the labels match, then the user has access. Example SELinux. A lattice chart is used to layout the scheme.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

ABAC

A

Attribute-based access control
Evaluates attributes and grants access based on the value of these attributes. Example, Homer has attributes employee, inspector, nuclear aware. A file server has a share called inspector, that grants access to the folder for any user that has the attributes employee, inspector, nuclear aware.

Many SDNs use ABAC schemes instead of rules on physical routers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Conditional access

A

Used with traditional access control schemes but adds additional capabilites with if then statements. Policies in conditional access use signals which are similar to attributes in an ABAC scheme. Implemented in Microsoft azure active directory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Jump server

A

Hardened server used to access and manage devices in another network with a different security zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

Screened subnet

A

Aka DMZ. Buffered zone between a private network and the internet. Will contain some internet facing servers surrounded by firewalls such that the internal network is protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Network address translation gateway

A

Hosts NAT and provides internal clients with private IPs a path to the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Zero trust network

A

Doesn’t trust any device by default even if the device was previously verified. Security model based on the principle of Zero trust. Can be implemented by requiring multifactor authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

UTM

A

Unified threat management
Single solution that combines multiple security controls. An appliance that performs URL filtering, malware inspection, content inspection, DDoS mitigation, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

MSP

A

Managed Service provider. A cloud service provider that provides network connectivity managment, backup and disaster ecovery, growth management and planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

MSSP

A

Managed Security Service Provider. A cloud service provider for firewall management, patch managemnt, security audits, emergency response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Fog computing

A

Cloud that’s close to your data. Cloud + IOT = Fog computing. Immeditate data stays local so no latency. No bandwith requirements. Privdate data never leaves - minimizes security concerns. Local decisons made from local data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Eslasticity

A

Scale up, down, out and in as it is required (automatically)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

FaaS

A

Function as a service. Applications are seperated into indvividual, autonomous functions. Remove operating system from the equation. Runs in stateless compute container.

114
Q

VPC

A

Virtual private cloud. Pool of resources created in a public cloud.

115
Q

SDN

A

Software Defined Networking. (Infrastructure as code)

116
Q

SDV

A

Software Defined Visibility. (infrastructure as code)

117
Q

Deployment stages

A
  1. Test - Still in development
  2. QA
  3. Staging - Looks and feels like a production environment
  4. Production
118
Q

SQL Secure coding

A
  1. Stored procedures
119
Q

Software diversity

A

Using alternative compiler paths to result in a different binary each time compiled. An exploit for one version of the binary should not affect many others.

120
Q

Continuous Integration

A

Code constantly written and merged int ocentral repo everyday.

121
Q

CD

A

Continuous delivery/deployment. Continuous delivery means automate the testing and release process, cllick and button and deploy the application. Continuous deployment means automatically deploy to production with no human integration or manual checks.

122
Q

Federation

A

Providing network access to thrid parties such as partners, suppliers, customers, etc. A federated network allows authentication between two organization.

123
Q

Attestation

A

Prove the hardware is really yours.

124
Q

TOTP

A

Time based one time password. Secret key and time of day, no counter.

125
Q

HOTP

A

HMAC based one time password. Based on secret key and counter.

126
Q

Biometric authentication methods

A
  1. Fingerprint
  2. Retinal
  3. Iris
  4. Voice recognition
  5. Facial
  6. Gait anlysis
  7. Veins
127
Q

AAA

A

Idebtification, Authetication, authorization, accounting

128
Q

Factors of authentication

A
  1. Something you are
  2. Somewhere you are
  3. Something you can do - Handwriting analysis, you’re special
  4. Something you know
  5. Something you have
129
Q

Disk redundancy techniques

A
  1. Multipath I/O
  2. RAID
  3. Multiple drives
130
Q

RAID types

A
  1. RAID 0 - Striping without parity, high performance, no fault tolerance
  2. RAID 1 - Mirrioring, Duplicates data for fault tolerance but requires twice the disk space
  3. RAID 5 - Striping with parity, Fault tolerant and only requires an additonal disk for redunancy
  4. RAID 0+1, RAID 1+0, RAID 5+1, Multiple raid types, Combine raid methods to increase redundancy
131
Q

Network redundancy techniques

A
  1. Load balancing
  2. NIC teaming
132
Q

Power redundancy techniques

A
  1. UPS
  2. Generator
  3. Dual pwoer supply
  4. PDU - Power distribution unit, provides power to multiple power outlets usually in a rack
133
Q

Backup types

A
  1. Full
  2. Incremental - All changes since last incremental
  3. Differential - All changes since last full
134
Q

NAS

A

Network attached storage. Connect to a shared storage device across the network and get file-level access to it.

135
Q

SAN

A

Storage area network. Looks and feels like a local stroage device. Block level access, very efficient reading and writing.

136
Q

HA

A

High availability

137
Q

SoC

A

System on a chip. Multiple components running on a single chip, common with embedded systems.

138
Q

FPGA

A

Field Programmable gate array Integrated circuit that can be configured after manufacturing. Common in firewall logic and routers.

139
Q

ICS

A

Industrial control systems. Like SCADA

140
Q

RTOS

A

Real time operating system. OS with a deterministic processing schedule. No time to wait for other processes. Found in industrial equipment, automobiles, and military environments. Extremely sensitive to security issues.

141
Q

SIM

A

Subscriber identity module. SIM card.

142
Q

Narrowband

A

Form of embedded system communication. Communicate analog signals over a narrow range of frequencies.

143
Q

Baseband

A

Form of embedded systems communication. Generally a single cable with digital signal, copper or fiber. Uses all bandwith, utilization either 0% or 100%.

144
Q

Air gap

A

Physical seperation between networks.

144
Q

Zigbee

A

IOT Networking open standard. Alternative to WiFi or bluetooth. Longer distances than bluetooth, less power consumption than WiFi.

144
Q

Cipher

A

Algorithm uses to encrypt and/or decrypt

145
Q

Ciphertext

A

Encrypted message

146
Q

Key strengthing techniques

A
  1. Key streching - Larger keys tend to be more secure
147
Q

HE

A

Homomorphic encryption. Perform calculations on data white it’s encrypted.

148
Q

Symmetric vs asymmetric encryption

A
  1. Symmetric - Doesn’t scale well
  2. Symmetric is faster
149
Q

ECC

A

Eliptic curve cryptography. Asymmetric.

150
Q

Digital signature

A

Prove message was not changed - Integrity. Prove source of message - Authentication. Make sure signature isn’t fake - Non-repudiation.

151
Q

PFS

A

Perfect forward secrecy. Refers to encryption system that changes the keys used to encrypt and decrypt.

152
Q

Stream cipher

A

Encryption is done one bit or byte at a time. High speed, low hardware complexity. Used with symmetric encryption. Starting state should never be the same twice. Often combined with an IV

153
Q

IV

A

Initalization vector

154
Q

Block cipher

A

Encrypt fixed-length groups. Used with symmetric encryption. Different modes of operations. e.g ECB, CBC, CTR, GCM

155
Q

ECB

A

Electronic code block. Block cipher mode of operation. Simplest mode. Each block encrypted with same key, identical plaintext blocks create identical ciphertext blocks.

156
Q

CBC

A

Cipher block chaining. Mode of block cipher operation. Each plaintext block is XORed with the pevious ciphertext block.

157
Q

CTR

A

Counter. Mode of block cipher operation. Block cipher acts like a stream cipher, encrypts successive values of a counter.

158
Q

GCM

A

Galois/Counter mode. Mode of block cipher operation. Combines counter mode with galois authentication. Very efficient encryption and authentication. Commonly used with packetized data such as in TLS.

159
Q

SRTP

A

Secure Real-Time transport protocol.
Secure protocol for audio and video traffic.

160
Q

S/MIME

A

Secure/Multipurpose Internet mail extensions
Public-private key encryption mechanism that allows for the protection of the information within emails. As well as digital signatures for integrity. Requires PKI.

161
Q

SNMPv3

A

Simple Network Management protocol version 3. Secure protcol for managing network devices.

162
Q

EDR

A

Endpoint detection and response. Detecting threats on an endpoint, investigating, and responding.

163
Q

DLP

A

Data loss prevention

164
Q

TPM

A

Trusted platform module. Specification for cryptographic functions. Hardware to help with cryptographic functions.

165
Q

East-west and North-south traffic

A

East-west traffic - Traffic between devices in the same data center.
North south traffic - Ingress/egress to an outside device

166
Q

L2TP

A

Layer 2 tunneling protocol. Commonly implemented with IPSec. Can be used as a tunneling protocol for VPNs.

167
Q

AH

A

Authentication header. Member of the IPSec protocol suite.

168
Q

ESP

A

Encapsulating security payload. Member of the IPSec protocol suite.

169
Q

IPSec modes

A

Transport mode. Tunnel mode.

170
Q

QoS

A

Quality of service. Describes process of controlling traffic flows.

171
Q

FIM

A

File integrity monitoring. Some files should never change.

172
Q

Stateless firewall

A

Does not keep track of traffic flows.

173
Q

Stateful firewall

A

Keeps track of traffic flows. Remembers the “state” of the session.

174
Q

WAF

A

Web application firewall.

175
Q

COPE

A

Corporate owned personally enabled. Device deployment model. Employees free to use device as if it was their personally owned device. But the organization purchases it and owns it.

176
Q

BYOD

A

Bring your own device. Device deplyoment model. Employees can being their own mobile device to work and attach them to the network. Employee is responsible for selecting and supporting the device, typically must comply with a BYOD policy when connecting to the network.

177
Q

CYOD

A

Choose your own device. Device deplyoment model. Employees selects a device from a list of acceptable devices. Employee purchases and brings the device to work.

178
Q

HSM

A

Hardware security module. High end cryptographic hardware.

179
Q

CEO Fraud

A

Sending fake emails from senior executives.

180
Q

Invoice fraud

A

Impersonating a trusted colleague or vender to request payment or money transfer,

181
Q

Footprinting

A

Gathering information about computer systems and their entities.

182
Q

Virus hoax

A

Typically harmless messages that spread through social engineering often using sensational claims and urging users to forward the message to warn others about a fake cyber threat.

183
Q

Watering hole attack

A

Attempts to discover which websites a group of people are likely to visit and then infects those websites with malware that can infect the visitors/

184
Q

Influence campaign

A

Hacking public opinion. Often run by nation state actors to divide individuals or persuade them. Frequently performed using social media with lots of fake or bot accounts, and relies on real users to spread the misinformation.

185
Q

Change control meetings

A

Discussing changes to IT infrastructure. Important to use standaridzed naming and numbering conventions in ensure efficient communication during such meetings.

186
Q

Confusion (encryption)

A

Ensures ciphertext is very different from the original plaintext.

187
Q

Diffusion (encryption)

A

Ensures that a small change in the plaintext results in a significant change in the ciphertext.

188
Q

DNSSEC

A

Domain Name System Security Extension. Provides a means of validating the information recieved from a DNS server so that it really did come from the server that was requested and that the information was not changed as it went through the network.

189
Q

FTPS

A

TCP 989, 990
File transfer protocol secure.
Uses TLS or SSL to encrypt FTP. Unlike SFTP, not inherently secure, just an added layer of security with TLS/SSL.

190
Q

Phishing

A

Creating a fake website or communication that closely resembles an authentic one to deceive users.

191
Q

Principles of social engineering

A
  1. Authority
  2. Scarcity
  3. Familiarity
  4. Intimidation
  5. Consensus
  6. Urgency
  7. Trust
192
Q

TAXII

A

Trusted Automated eXchange of Indicator Information.
An open standard that defines a set of services and messages exchanges used to share information. Provides a standard way for organizations to exchange cyber threat information.

193
Q

STIX

A

Structured Threat Information eXpression.
An open standard that indentifies what cyber threat information organizations should share. Provides a common language for addressing a wide range of cyber threat information. STIX data is shared via TAXII.

194
Q

Known-plaintext attack

A

Attacker knows both plaintext and its corresponding ciphertext. He uses this information to determine the encryption/decryption method and perhaps reveal keys. He can then decrypt all messages.

195
Q

Chosen plaintext attack

A

Attacker knows the ciphertext but not all of the plaintext, only a “chosen” part of it. He then uses various techniques to attempt to decrypt the chosen part, which will allow him to decrypt all messages.

195
Q

Ciphertext only attack

A

Attacker doesn’t have any information on the plaintext. He must work with the ciphertext only.

196
Q

DHCP Starvation

A

Attacker floods network with IP address lease requests. DHCP server runs out of IPs.

197
Q

Horizontal Priv esc

A

Attacker gains access to resources that would only normally be available to a user of a higher privledge level. Does not necessarily have to be an administrator or root account.

198
Q

Veritcal Priv esc

A

Attacker gets administrative or root access to a system via a vulnerability

199
Q

TOCTOU

A

Time of check to time of use attack
Attacker exploits a race condition in order to do somethign malicious with data after the operating system verifies access is allows (time of check) but before the operating system performs a legitmate action (time of use)

200
Q

Rogue AP

A

An AP placed wthin a network without official authorization. Might be used to bypass security and gain access to the network or to sniff traffic. 802.1X authentication can prevent this by requiring users to provide a username, password or other type of authentication before being allowed access to the network.

201
Q

EAP

A

Authentication method for wireless networks. However, it can also be used anywhere an 802.1x server is used. Provides method for two systems to create a secure encryption key called pairwise master key. Systems then use the key to encrypt data between them.

202
Q

PEAP

A

Protected EAP
Extra layer of protection for EAP. Encapsulates the EAP conversation in TLS tunnel. Requires certificate on the server but no on the clients.

203
Q

EAP-FAST

A

EAP-Flexible Authentication via Secure Tunneling
Built by Cisco. Supports certificates but they are optional.

204
Q

EAP-TLS

A

Requires certificates on both the 802.1X server and the clients.

205
Q

EAP-TTLS

A

EAP-Tunneling TLS
Extension of PEAP that allows systems to use older authentication methods such as PAP. Requires certificate on the 802.1X server but not the clients.

206
Q

IEEE 802.1X

A

Requires users to authenticate when connecting to a wireless AP or plugging into a port. Can be implemented as a RADIUS or Diameter server. Supports usernames and passwords as well as certificates.

207
Q

Enterprise mode

A

WPA2 mode. Forces users to authenticate with unique credentials when connecting to the network. Uses an 802.1X server, often implemented as a RADIUS server.

208
Q

SAE

A

Simultaneous authentication of equals. Used in WPA3, variant of dragonfly key exchange which is based on diffie hellman.

209
Q

RADIUS Federation

A

Creating a federation using 802.1X and RADIUS servers

210
Q

WPS

A

Wi-fi protected setup.
Press a button on the printer to connect to its Hotspot. Enter a pin to connect your phone to the AP.

211
Q

IV attacks

A

Discover the initialization vector and use it to discover the pre-shared key.

212
Q

Bluebugging

A

Blursnarfing, but the attacker installs a backdoor. Allowing them to listen to comms, send messages, etc remotely from the victims device.

213
Q

VPN Tunneling Protocols

A
  1. IPSEC in tunnel mode
  2. SSL/TLS
  3. L2TP - Layer 2 tunneling protocol
214
Q

IPSec tunnel mode

A

Used as a tunneling protocol to encrypt VPN comms. In this mode both the payload and headers of the IP packet are encrypted.

215
Q

IPSec transport mode

A

Only the payload of the IP packet, not headers. Not used for VPNs usually unless you don’t care about internal IPs being exposed.

216
Q

ESP

A

Encapsulating security payload
Protocol number 50
Encrypts data in IPSec. Includes AH.

217
Q

AH

A

Authentication header.
Protocol number 51.
Allows hosts in an IPsec communication to authenticate with each other before exchanging data.

218
Q

VPN: Full tunnel

A

When connected to the VPN, all traffic regardless of destination will be tunneled through the VPN.

219
Q

VPN: split tunnel

A

Admin determines which specific traffic should be tunneled through the VPN. Perhaps he will restrict it to traffic destined for the internal network only.

220
Q

Site-to-site VPN

A

Uses two VPN servers to act as gateways for two geographically separated networks. The process of accessing resources in the remote network is seemless from the user’s perspective.

221
Q

Direct/remote access VPN

A

Allows users to access private networks via a public network. Process is NOT seemless to the user, as the user has to manually connect to the VPN server.

222
Q

Always-on VPN

A

The VPN connection is established and maintained always. This opposes an on-demand connection. Can be used with both site to site VPN and direct access VPN.

223
Q

HTML5 VPN Portal

A

Allows users to connect to the VPN using their web browser. Uses TLS to encrypt the session. Tends to be very resource intensive.

224
Q

NAC

A

Network Access Control
Methods to ensure that devices connecting to a network meet certain predetermined characteristics. NAC will perform host health checks. Possibly via an agent. A VPN server will query the NAC (assuming there is one) and query the client for a health report before allowing the client to connect to the internal network.

225
Q

VPN authentication methods

A

VPN should ensure that only authorized users access it.
1. PAP - Password Authentication Protocol
2. CHAP - Challenge Handshake Authentication Protocol
3. RADIUS
4. TACACS+

226
Q

PAP

A

Password Authentication Protocol
Used in VPNs for authentication. Used with Point to point protocol (PPP) to authenticate clients. PAP allows users to authenticate with a password or PIN. However, it is sent over the network in cleartext, so it’s not secure.

227
Q

CHAP

A

Challenge Handshake Authentication Protocol.
Used by VPNs for authentication. Uses point to point protocol (PPP). CHAP allows users to authenticate with a shared secret. The client hashes the shared secret combining it with a nonce, and then sends it to the server. More secure than PAP because the shared secret is NOT sent in plaintext.

228
Q

TACACS+

A

Terminal Access Controller Access-Control System Plus
Authentication system that is an alternative to RADIUS. Can be used by VPNs for authentication. Can be used with kerberos. Two essential security benefits over RADIUS: 1. Encrypts the entire authentication process. 2. Uses multiple challenges and responses between the client and the server.

229
Q

AAA Protocols

A

Protocols that provide authentication, authorization, and accounting
1. RADIUS
2. TACACS+
3. Diameter

230
Q

MDM

A

Mobile device management
Includes technologies to manage mobile devices.

231
Q

UEM

A

Unified endpoint management
Ensure systems are up to date with patches, AV, and are secured with standard security practices. Can be used to manage mobile devices or any device.

232
Q

NIST RMF

A

Mandatory framework for US federal agencies and organizations that handle federal data.

Six step process
1. Categorize: define the environment
2. Select: pick the appropriate controls
3. Implement: define proper implementation
4. Assess: determine if controls are working
5. Authorize: make a decision to authorize a system
6. Monitor: check for ongoing compliance

233
Q

NIST CSF

A

NIST cybersecurity framework

Framework core
Identify, protect, detect, respond, and recover

234
Q

ISO/IEC 27001

A

Information security management

Framework that provides information on infosec management system (ISMS) requirements. Three stage certification process for an organization to become compliant.

235
Q

ISO 27002

A

Information technology security techniques
Complement to ISO 27001. While ISO 27001 identifies requirements to become certified, ISO 27002 provides organizational with be practices guidelines.

236
Q

ISO 27701

A

Privacy information management system (PIMS)
Based on ISO 27001, outlines a framework for managing and protecting PII. Provides organizations with guidance to comply with global privacy standards, such as European General Data Protection Regulation (EU GDPR)

237
Q

ISO 31000

A

Family of standards related to risk management. Provides guidelines that organizations can adopt to manage risk

238
Q

SOC 2 Type I

A

A report that describes an organization’s systems and covers the design effectiveness of security controls on a specific date. Design effectiness refers to how well the security controls address risks but not necessarily how well they work when mitigating risks.

239
Q

SOC 2 Type II

A

Report that describes an organization’s systems and covers security controls’ operational effectiveness over a range of dates, e.g 12 months. Operational effectiveness refers to how well the controls worked when mitigating risks during the range of dates.

240
Q

NIST SP 800-87

A

Risk Management Framework for Information Systems and Organizations

Covers the Risk Management Framework (RMF). Provides organizations a 7 step process to identify and mitigate risks.

  1. Prepare
  2. Categorize information systems
  3. Select security controls
  4. Implement security controls
  5. Assess security controls
  6. Authorize information systems
  7. Monitor security controls
241
Q

SLE

A

Single Loss Expectancy

Cost of any single loss.

242
Q

ARO

A

Annual rate of occurrence

Indicates how many times the loss will occur annually.

243
Q

ALE

A

Annual Loss Expectancy

How much loss is accrued from failures during the entire year.

ALE = SLE * ARO

244
Q

Risk register

A

Detailed document listing information about risks. Typically includes risk scores along with recommended security controls to reduce the risk scores.

245
Q

Risk matrix

A

Plots risk on a graph.

246
Q

RPO

A

Recovery Point Objective

Identifies a point in time where data loss is acceptable, refers to databases.

247
Q

MTBF

A

Mean Time Between Failures
Provides a measure of a system’s reliability, usually represented in hours.

248
Q

MTTR

A

Mean Time To Recover
Identifies the arithmetic mean time it takes to recover a failed system.

249
Q

BIA

A

Business Impact Analysis
Important part or a Business Continuity Plan (BCP). Helps an organization identify critical systems and components that are essential to an organization’s success.

250
Q

BCP

A

Business Continuity Plan
Plan that includes disaster recovery elements that provide steps used to return critical functions to operation after an outage.

251
Q

RTO

A

Recovery Time Objective
Maximum amount of time it can take to restore a system after an outage.

252
Q

CA

A

Certificate Authority
Issues, manages, validates, and revokes certificates. Can be public like a large organization e.g Symantec or can be a single service running on a server within a private network.

253
Q

Root certificate

A

First certificate created but the CA that Identifies it. If the root certificate is placed into the trusted root CA store, then all certificates issued by the CA will be trusted.

254
Q

Intermediate CA

A

A CA that is created by a root CA to create certificates on the root CA’s behalf.

255
Q

Child CA

A

A CA that has certificates issued to it by an intermediate CA. The child CA then gives these certificates to end users and devices.

256
Q

CSR

A

Certificate Signing Request
A request you send to a CA to have the CA create/sign a certificate on your behalf.

257
Q

RA

A

Registration authority
Assists in the certificate registration process. Sometimes, it is found in large organizations. RA never issues certificates it only assists the registration process.

258
Q

CRL

A

Certificate revocation list
Used by the CA to revoke a certificate before its expiration date.

259
Q

OCSP

A

Online certificate status protocol
Allows client to query the CA with the serial number of the certificate. The CA will then respond with an answer of good, revoked, or unknown. Unknown could indicate that the certificate is a forgery.

260
Q

Stapling

A

Part of Online Certificate Status Protocol (OCSP). The certificate presenter receives a time stamped OCSP response from the CA signed with a digital signature. The certificate presenter then appends/staples the timestamped OCSP response to the certificate during the TLS Handshake process. Which eliminates the need for clients to query the CA.

261
Q

Public key pinning

A

Security mechanism designed to prevent attackers from impersonating a website using fraudulent certificates. When configured, the web server responds to HTTPS requests with an extra header which includes a list of hashes derviced from valid public keys used by the web site. When clients connect to the web server they recalculate the hashes and then compare the calculated hashes with the ones they have stored from before. If they match then the client knows this is the same web server.

262
Q

Key escrow

A

Placing a copy of a private key in a safe environment. E.g giving the key to a third party

263
Q

CER

A

Cannocial Encoding Rules
One of the base formats for certificates. E.g cert.cer

264
Q

DER

A

Distinguished Encoding Rules
One of the base formats for certificates. E.g cert.der

265
Q

PEM

A

Privacy Enhanced Mail
Certificate format, despite name can be used for anything.

266
Q

P7B

A

Certificate format using PKCS version 7.

267
Q

P12

A

Certificate format using PKCS version 12.

268
Q

PFX

A

Personal Information Exchange
Certificate format, predecessor to P12.

269
Q

CIRT

A

Computer Incient Response Team

270
Q

AAAA Record

A

Holds hostname and IPv6 address, similar to A record but for IPV6

271
Q

A record

A

Holds hostname and IPv4 address

272
Q

PTR Record

A

Pointer record
Opposite of an A record. For when client queries DNS with an IP.

273
Q

MX Record

A

Mail exchange record
Identifies a mail server used for email. Linked to A or AAAA record of the mail server. When there is more than one mail server, the one with the lowest preference number in the MX record is the primary mail server.

274
Q

CNAME Record

A

Canonical name record
Allows single system to have multiple names associated with a single IP address.

275
Q

SOA record

A

Start of authority record
Includes information about the DNS zone and some of its settings which are useful for clients to know. E.g TTL

276
Q

Cyber kill chain

A
  1. Reconnaissance
  2. Weaponization
  3. Delivery
  4. Exploitation
  5. Installation
  6. C2
  7. Actions on Objectives
277
Q

Diamond model of intrusion analysjs

A
  1. Adversary
  2. Capabilities
  3. Infrastructure - domain names, email addresses, ips, etc used by the adversary
  4. Victim
278
Q

MITRE ATT&CK

A

Adversarial Tactics, Techniques, and Common Knowledge
Knowledge base of tactics and techniques used in real-world attacks.

Sy0-601 (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions