Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Module 1: General Security Concepts > Flashcards

Module 1: General Security Concepts Flashcards

1
Q

What is a vulnerability?

A

A weakness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a threat?

A

A potential danger.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is an exploit?

A

When a threat actor successfully takes advantage of a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a threat actor?

A

An adversary with malicious intent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are controls?

A

Tactics, mechanisms, or strategies that proactively minimize risk in one or more ways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In what ways do controls proactively minimize risk? (Hint: 3 ways)

A

Reduce/eliminate vulnerabilities; reduce/eliminate the likelihood of vulnerability exploitation by threat actors; reduce/eliminate the impact of an exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are countermeasures?

A

Controls implemented to address specific threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Controls are ______ and countermeasures are _______.

A

Proactive/Reactive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Countermeasures are ______ effective but ______ broadly efficient.

A

More/Less

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Controls should be ________.

A

Verifiable (trustworthy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is control functionality?

A

What a control does.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is control effectiveness?

A

How well a control works.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What makes up “effectiveness” for a control?

A

Consistent, complete, reliable, timely operation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is control assurance?

A

A measure of confidence that intended security controls are effective in their application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a control objective?

A

A statement of desired result/purpose to be achieved.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Defense-in-Depth also known as?

A

Layered security or layered controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Defense-in-Depth/layered security?

A

The design and implementation of multiple overlapping layers of diverse controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Controls should not be subject to __________ and should maintain _______.

A

A cascade effect/independence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Diversity in controls refers to what?

A

Type(s) of controls and associated vendor(s).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a security control baseline?

A

The minimum standard for a given environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control baselines must strategically align with what?

A

The needs of the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Control baselines are what?

A

A starting point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Control baselines should be proportionate to the ______ and _____ of the asset.

A

Criticality/sensitivity

24
Q

What is the principle of proportionality?

A

Control baselines should be proportionate to the criticality and sensitivity classifications of the asset being protected.

25
Q

What is scoping?

A

Eliminating unnecessary baseline recommendations that are not applicable.

26
Q

What is tailoring?

A

Customizing baseline recommendations to align with organizational requirements.

27
Q

What is compensating?

A

Substituting a recommended baseline with a similar control.

28
Q

What is supplementing?

A

Augmenting the baseline recommendations.

29
Q

What is the baseline modification process?

A

Identify control baseline, apply scoping considerations, tailor controls, select compensating controls (if needed), supplement baseline controls (if needed), publish, implement, assess, monitor.

30
Q

What is a cost-benefit analysis?

A

The process of comparing the estimated costs and benefits to determine whether it makes sense to proceed from a business perspective.

31
Q

What are the control categories?

A

Technical, managerial, operational, and physical.

32
Q

What a technical controls?

A

Control mechanisms implemented using hardware, software, and/or firmware components. These controls can be native or supplemental.

33
Q

What are managerial controls?

A

Controls related to risk management, governance, oversight, strategic alignment, and design making.

34
Q

What are operational controls?

A

Controls that align with a process that are primarily implemented and executed by people.

35
Q

What are physical controls?

A

Controls designed to address physical interactions. These are generally related to buildings and equipment.

36
Q

Examples of managerial controls are:

A

Risk assessments, project management

37
Q

Examples of technical controls are:

A

Firewalls, cryptography, authentication systems

38
Q

Examples of operational controls are:

A

Change management, testing, training

39
Q

Examples of physical controls are:

A

Gates, barricades, locks, security guards, access control vestibules

40
Q

What are the control classifications?

A

Deterrent, preventative, detective, corrective

41
Q

What are deterrent controls?

A

Controls that discourage a threat agent from acting.

42
Q

What are preventative controls?

A

Controls that stop a threat agent from being successful.

43
Q

What are detective controls?

A

Controls that identify and report a threat agent or action.

44
Q

What are corrective controls?

A

Controls that minimize the impact of a threat agent or modify or fix a situation.

45
Q

What are compensating controls?

A

Controls that are implemented in lieu of a recommended control that provides equivalent or comparable protection.

46
Q

What are directive controls?

A

Proactive actions taken to cause or encourage a desirable event or outcome to occur.

47
Q

What are the components of the Information Security CIA Triad?

A

Confidentiality, Integrity, Availability

48
Q

What is confidentiality?

A

The assurance that information is not disclosed to unauthorized persons, processes, or devices. Data is covered in storage, during processing, and in transit.

49
Q

What is integrity?

A

The principle that systems are trustworthy, work as intended, and that data is complete and accurate.

50
Q

What is availability?

A

The principle that information systems and supporting infrastructure are operating and accessible when needed.

51
Q

What is authentication?

A

The process of verifying identity.

52
Q

What is authorization?

A

The process of approving access.

53
Q

What is accounting?

A

The process of tracing actions to the source.

54
Q

What is non-repudiation?

A

The process of assuring the validity and origin of data.

55
Q

What is privacy?

A

The right of an individual to control the use of their personal information.

56
Q

What are data privacy controls?

A

Controls related to actions regarding collection, usage, notification, accuracy, and sharing.

57
Q

What are data security controls?

A

Controls related to the protection mechanisms of confidentiality, integrity, and availability.

Security+ 701 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions