Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ > Módulo 08 - Network and Endpoint Security > Flashcards

Módulo 08 - Network and Endpoint Security Flashcards

1
Q

Define: OS Hardening

A

Enhancing an operating system’s security by removing unnecessary components, limiting access, and applying best practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define: Access Control Lists (ACLs)

A

Rules defining user permissions to resources, such as files or networks, based on identifiers and associated privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define: Full Disk Encryption (FDE)

A

Encryption that protects all data on a hard drive, including system files and user data, even when the OS is off.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Acronym:
PoLP

A

Principle of Least Privilege.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Acronym:
S/MIME

A

Secure/Multipurpose Internet Mail Extensions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Compare:
Endpoint Protection vs. Patch Management

A

Endpoint Protection: Focuses on safeguarding devices against malware and threats.

Patch Management: Addresses vulnerabilities by applying updates and patches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

List:
Key elements of endpoint hardening.

A
  1. Remove unnecessary software.
  2. Change default passwords.
  3. Apply configuration enforcement.
  4. Implement encryption techniques.
  5. Use access control policies.
  6. Monitor for changes and compliance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

List:
Types of encryption techniques.

A
  1. Full Disk Encryption (FDE).
  2. Removable Media Encryption.
  3. Virtual Private Networks (VPNs).
  4. Email Encryption.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define:
Implicit Deny ACLs

A

A rule that denies access unless explicitly allowed, ensuring tighter security by default.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define:
Authorization Creep

A

Gradual accumulation of unnecessary privileges by a user due to improper privilege management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define:
Deprovisioning

A

The process of removing access rights and permissions when an employee or contractor leaves or a project ends.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Acronym:
FSRM

A

File Server Resource Manager.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Acronym:
FTPS

A

FTP Secure

which adds SSL/TLS to FTP for secure logon and data transfer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Acronym:
SFTP

A

Secure Shell File Transfer Protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Define:
FSRM Quotas

A

Storage limits on a directory.

Hard (Block further storage) or Soft (Only alerts)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define:
File Screens on FSRM

A

Rules tha restrict file types that might be saved on a directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define:
NetBIOS

A

Network protocol for file and printer sharing, quite unsecure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define:
Tombstone File

A

File replaced that informs about a violation, keeping the original unaccessible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Acronym:
IPSec

A

Internet Protocol Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Acronym:
SCP

A

Secure Copy Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define:
Administrative Share

A

Hidden directory that only admins have access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Compare:
SFTP vs. FTPS

A

SFTP: Secure Shell-based, not related to FTP, uses SSH2 for secure data transfer.

FTPS: FTP with SSL/TLS, requires server certificates for encrypted communication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Compare:
Hard Limit vs. Soft Limit in Quotas

A

Hard Limit: Prevents users from exceeding the data quota.

Soft Limit: Allows exceeding the quota but sends a warning message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

List:
DLP Remediation methods

A
  1. Alert only: Registra o incidente sem bloquear o acesso.
  2. Block: Impede a cópia, mas mantém o arquivo acessível.
  3. Quarantine: Restringe o acesso ao arquivo original.
  4. Tombstone: Substitui o arquivo por uma mensagem de violação de política.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Acronym:
NTFS

A

New Technology File System.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define:
NTFS Permissions

A

Permissions that control access to files and folders on drives formatted with NTFS, applying both locally and over a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define:
Share Permissions

A

Permissions that control access to shared folders over a network but do not apply to local access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define:
Inheritance

A

A feature where folders pass down their permissions to subfolders and files, unless explicitly overridden.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define:
Octal Notation in Permissions

A

A numeric representation of file permissions where read = 4, write = 2, and execute = 1.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define:
Chmod Command

A

A Linux command used to change file permissions in symbolic or absolute (octal) mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Acronym:
DACL

A

Discretionary Access Control List.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

True or False:
NTFS permissions apply only to files accessed over the network.

A

False.
NTFS permissions apply to both local and network access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

True or False:
Share permissions can be assigned to individual files.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

True or False:

In Linux, a file with permissions 755 means the owner has read, write, and execute permissions.

A

A: True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Compare:
Share Permissions vs. NTFS Permissions

A

Share Permissions: Apply only to network access; control at the folder level; limited to Reader, Contributor, and Co-owner.

NTFS Permissions: Apply to both local and network access; can control at the file level; highly granular.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Compare:
Symbolic vs. Absolute Mode in chmod

A

Symbolic Mode: Uses letters (e.g., u=rwx) to specify permissions.

Absolute Mode: Uses octal numbers (e.g., 755) to represent permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Example:
Interpret this permission string: drwxr-xr-x.

A

d: Directory.
Owner: Read, write, execute.
Group: Read, execute.
Others: Read, execute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Define:
Physical Port Hardening

A

The process of disabling unused physical interfaces, such as USB or HDMI, to reduce physical attack vectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Define:
Logical Ports

A

Software-based communication endpoints used for data exchange between applications or services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Define:
Host-Based Firewalls

A

Firewalls installed on individual devices to control incoming and outgoing network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Define:
Intrusion Prevention System (IPS)

A

A system that monitors network traffic to detect and prevent potential intrusions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Define:
Service Hardening

A

Configuring services to minimize vulnerabilities by disabling unnecessary features and applying security updates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Define:
Default-Deny Policy

A

A security policy that blocks all traffic unless explicitly permitted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Acronym:
UEFI

A

Unified Extensible Firmware Interface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Acronym:
BIOS

A

Basic Input/Output System.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Acronym:
nmap

A

Network Mapper

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Acronym:
ss (Linux Command)

A

Socket Statistics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Compare:
Host-Based Firewalls vs. Network Firewalls

A

Host-Based Firewalls: Protect individual devices and filter traffic specific to that host.

Network Firewalls: Protect an entire network and filter traffic entering or leaving the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Compare:
nmap vs. netstat

A

nmap: Scans for open TCP/UDP ports on a network.

netstat: Displays active network connections and listening sockets on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Example:
What command scans for open TCP ports using nmap?

A

nmap -sT ipaddress.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Example:
How to disable a service in Linux?

A

Use systemctl disable servicename to prevent the service from starting on boot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Define:
Wireless Access Point (WAP)

A

A device that broadcasts wireless signals, connects wireless clients to a network, and may link to a wired network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Define:
Thin Access Point

A

A WAP that relies on a wireless controller for management and client handling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Define:
Wireless LAN Controller (WLC)

A

A device used to manage multiple access points in an enterprise environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Define:
Service Set Identifier (SSID)

A

The name of a wireless network that allows users to identify and connect to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Define:
WPA2-PSK

A

A Wi-Fi security protocol using a pre-shared key for group authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Define:
Simultaneous Authentication of Equals (SAE)

A

A WPA3 protocol for secure password exchange, resistant to offline brute force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Define:
Heat Map

A

A visual representation showing wireless signal strength across an area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Acronym:
WAP

A

Wireless Access Point.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Acronym:
WLC

A

Wireless LAN Controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Acronym:
WDS

A

Wireless Distribution System.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Acronym:
WPS

A

Wi-Fi Protected Setup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Acronym:
DPP

A

Device Provisioning Protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Acronym:
RADIUS

A

Remote Authentication Dial-In User Service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Acronym:
EAP

A

Extensible Authentication Protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

True or False:
A thin access point can manage clients independently without a WLC.

A

False.
Thin access points rely on a WLC for client management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

True or False:
WPA3-Enterprise requires the use of 192-bit AES encryption.

A

True.
WPA3-Enterprise mandates 192-bit AES encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

True or False:
WPA2-PSK uses a group-shared passphrase for authentication.

A

True.
WPA2-PSK uses a pre-shared key for group authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

True or False:
Site surveys are unnecessary for optimizing WAP placement.

A

False.
Site surveys are essential for ensuring optimal WAP placement and coverage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Compare:
Fat vs. Thin Access Points

A

Fat Access Points: Standalone devices that manage clients and broadcast the network independently.

Thin Access Points: Require a wireless LAN controller for client and network management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Compare:
WPA2 vs. WPA3

A

WPA2: Uses AES with CCMP for encryption and is vulnerable to handshake attacks.

WPA3: Introduces SAE for secure password exchange and enhanced encryption protocols.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Compare:
PSK vs. SAE Authentication

A

PSK: Uses a shared passphrase, vulnerable to brute force attacks.

SAE: Uses a secure handshake resistant to offline attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

List:
Key features of WPA3.

A
  1. Simultaneous Authentication of Equals (SAE).
  2. Enhanced Open for encryption on open networks.
  3. Updated cryptographic protocols using AES-GCMP.
  4. Support for Wi-Fi Easy Connect for simplified configuration.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

List:
Wi-Fi authentication methods.

A
  1. Personal (PSK or SAE).
  2. Open (unencrypted or Enhanced Open).
  3. Enterprise (RADIUS with unique credentials).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Example:
What does WPA3-SAE improve over WPA2-PSK?

A

WPA3-SAE uses a secure handshake to prevent offline attacks, unlike WPA2-PSK, which is vulnerable to brute force.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Example:
How is a wireless bridge implemented?

A

By connecting two wireless networks through a wired or wireless distribution system (WDS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Example:
What is a heat map used for in wireless networks?

A

To visualize signal strength and channel overlap for optimizing WAP placement.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Define:
KRACK Attack

A

A replay attack targeting the WPA and WPA2 4-way handshake, allowing offline brute-force attempts to recover keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Define:
Evil Twin Attack

A

An attack where a rogue access point mimics a legitimate network to intercept user data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Define:
Initialization Vector (IV) Attack

A

A cryptographic attack exploiting the reuse of initialization vectors in WEP encryption to decrypt keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Define:
Bluejacking

A

Sending unsolicited messages to nearby Bluetooth devices in discovery mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Define:
Bluesnarfing

A

Exploiting vulnerabilities in Bluetooth to access sensitive data on a paired device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Define:
RFID Eavesdropping

A

Using an RFID reader to intercept communication between a tag and a legitimate scanner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Define:
Relay Attack

A

Capturing NFC data in transit to impersonate the original device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Acronym:
WEP

A

Wired Equivalent Privacy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Acronym:
NFC

A

Near Field Communication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

Acronym:
RFID

A

Radio Frequency Identification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

True or False:
WPA3 is vulnerable to KRACK attacks.

A

False. WPA3 addresses the vulnerabilities exploited in KRACK attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

True or False:
A jamming attack can be non-malicious.

A

True. Non-malicious interference can come from devices like microwave ovens or cordless phones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

True or False:
Disassociation attacks exploit encrypted management frames.

A

False. Disassociation attacks exploit unencrypted management frames.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

True or False:
Passive RFID tags require external power to operate.

A

True. Passive RFID tags rely on energy from the scanner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Compare:
Rogue Access Point vs. Evil Twin

A

Rogue Access Point: Any unauthorized access point on a network.

Evil Twin: A rogue access point designed to mimic a legitimate one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Compare:
RFID vs. NFC

A

RFID: One-way communication; longer range.

NFC: Two-way communication; very short range.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

List:
Common wireless attacks.

A
  1. Wireless denial-of-service (DoS).
  2. Evil twin attack.
  3. Initialization vector (IV) attack.
  4. Jamming attack.
  5. Disassociation/deauthentication attack.
  6. Replay and key recovery attacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Define:
What is a rogue access point?

A

An unauthorized device providing wireless access, potentially used for malicious purposes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Define:
What is a KRACK attack?

A

A replay attack exploiting weaknesses in WPA2’s 4-way handshake.

97
Q

Define:
How does an evil twin attack work?

A

By creating a rogue access point with the same SSID as a legitimate one to capture user data.

98
Q

Define:
SSID Suppression

A

Disabling the broadcast of the network’s SSID to make it less visible to nearby devices, though determined hackers can still detect it.

99
Q

Define:
MAC Address Filtering

A

Restricting network access to specific MAC addresses, which can be bypassed by spoofing a valid MAC address.

100
Q

Define:
Wi-Fi Signal Strength Adjustment

A

Reducing a WAP’s broadcast strength to limit signal emanation outside the intended area, enhancing security.

101
Q

Define:
WPA2

A

A wireless security protocol using AES-CCMP for encryption and a 4-way handshake for authentication.

102
Q

Define:
WPA3

A

A wireless security protocol that replaces WPA2’s 4-way handshake with Simultaneous Authentication of Equals (SAE), providing Perfect Forward Secrecy.

103
Q

Acronym:
SSID

A

Service Set Identifier.

104
Q

Acronym:
MAC

A

Media Access Control

105
Q

Acronym:
SAE

A

Simultaneous Authentication of Equals.

106
Q

Compare:
WPA2-Personal vs. WPA2-Enterprise

A

WPA2-Personal: Uses a pre-shared key for authentication.

WPA2-Enterprise: Uses a RADIUS server to authenticate individual users.

107
Q

Compare:
WPA2 vs. WPA3

A

WPA2: Uses a 4-way handshake, vulnerable to offline attacks.

WPA3: Uses SAE for secure authentication and Perfect Forward Secrecy.

108
Q

Compare:
SSID Broadcast vs. SSID Suppression

A

SSID Broadcast: Makes the network easily discoverable.

SSID Suppression: Hides the network’s SSID but does not make it entirely undetectable.

109
Q

Define Pre-shared Key (PSK).

A

A passphrase used for wireless network access; the most commonly used access method.

110
Q

What is Wi-Fi Protected Setup (WPS)?

A

A method to connect devices securely to a network using PSK and WPA2 by pushing buttons or entering a unique PIN.

111
Q

Define Open Network.

A

A wireless network with no authentication, allowing unrestricted access; suitable for public spaces.

112
Q

What is a Captive Portal?

A

A mechanism forcing users to interact with a web page before granting network access, often for agreement or payment.

113
Q

What is Extensible Authentication Protocol (EAP)?

A

A framework supporting multiple authentication methods, enabling secure communication between client and server.

114
Q

What is EAP-PEAP?

A

EAP with SSL/TLS tunnel for secure authentication using a server-side certificate.

115
Q

Define EAP-FAST.

A

EAP with a Protected Access Credential (PAC) to authenticate users in a TLS tunnel; mitigates PAC compromise risks.

116
Q

What is EAP-TLS?

A

An EAP standard requiring client- and server-side certificates, known for its robust security.

117
Q

Define EAP-TTLS.

A

An updated version of EAP-TLS that simplifies deployment by only requiring a server-side certificate.

118
Q

Define MAC Filtering.

A

Restricting network access to specific MAC addresses; prone to spoofing but adds an extra layer of control.

119
Q

What is 802.1X Port-based Network Access Control?

A

A standard requiring authentication when a device connects to a switch port, using EAP and RADIUS for validation.

120
Q

Define Supplicant in 802.1X.

A

The device requesting access, such as a PC or laptop.

121
Q

What is the role of the Authenticator in 802.1X?

A

A network device like a switch that forwards authentication requests between the supplicant and the authentication server.

122
Q

What is a RADIUS Server?

A

The server validating authentication requests and managing authorization decisions in 802.1X.

123
Q

Define Air-Gapped Host.

A

A host physically isolated from any network to prevent unauthorized access, often used in high-security environments.

124
Q

What is an Air-Gapped Network?

A

A network isolated from others, allowing communication only within itself; used in military or industrial facilities.

125
Q

Example:
How does WPS connect devices?

A

By pushing buttons on the access point and device or entering a PIN.

126
Q

Example:
How does a Captive Portal secure public networks?

A

It redirects users to a page for terms agreement or payment before granting internet access.

127
Q

Example:
What happens in 802.1X authentication?

A

The supplicant’s credentials are sent to the authentication server via the authenticator for validation.

128
Q

Compare:
PSK vs. WPS

A

PSK: Requires manual entry of a passphrase.

WPS: Automates connection using buttons or PIN.

129
Q

Compare:
Air-Gapped Host vs. Air-Gapped Network

A

Air-Gapped Host: A single device isolated from any network.

Air-Gapped Network: A group of devices communicating only within their isolated network.

130
Q

What is a remote access VPN?

A

A secure tunnel over a public network connecting a user’s PC or smartphone to a private network.

131
Q

Acronym:
(RDP)

A

Remote Desktop Protocol

132
Q

What is Microsoft’s Remote Desktop Protocol (RDP) used for?

A

Accessing a physical machine on a one-to-one basis by transferring screen, audio, and input data.

133
Q

Define HTML5 VPN.

A

A clientless remote desktop gateway using a web browser and WebSocket protocol for bidirectional communication.

134
Q

What is SSH?

A

A secure protocol for remote administration and file transfer, widely implemented via OpenSSH.

135
Q

What is an SSH Host Key?

A

A public/private key pair identifying an SSH server for secure client-server communication.

136
Q

What is public key authentication in SSH?

A

A method where a remote user’s public key is authorized on the server for secure access.

137
Q

Which SSH command connects to a server?

A

ssh username@host

138
Q

How do you generate an SSH key pair?

A

ssh-keygen -t rsa

139
Q

How do you copy an SSH key to a server?

A

ssh-copy-id username@host

140
Q

What is HTTP?

A

A protocol for exchanging web content; uses plaintext and is unsecured.

141
Q

Define HTTPS.

A

HyperText Transfer Protocol Secure; uses SSL/TLS to encrypt data and operates on TCP port 443.

142
Q

How is HTTPS identified in a browser?

A

By the “https://” URL prefix or a lock icon in the address bar.

143
Q

What is S-HTTP?

A

Secure HyperText Transfer Protocol; provides message security but is not widely used or as secure as HTTPS.

144
Q

Compare
HTTPS and S-HTTP.

A

HTTPS: Encrypts the entire session, uses port 443, and is stateful.
S-HTTP: Secures only messages, does not use port 443, and is connectionless.

145
Q

List:
What are the SSH client authentication methods?

A

Username/Password – Standard credentials.

Public Key Authentication – Using a public key authorized on the server.

Kerberos – Authentication via Ticket Granting Tickets.

146
Q

List:
What are the three main VPN topologies?

A

Client-to-Site VPN: Allows individual users to connect securely to a corporate network.
Site-to-Site VPN: Connects two private networks automatically via secure gateways.
Host-to-Host Tunnel: Secures traffic between two specific computers.

147
Q

Why are legacy VPN protocols like PPTP deprecated?

A

They do not provide adequate security compared to modern protocols like TLS and IPsec.

148
Q

How does a TLS VPN authenticate users?

A

Using digital certificates, with server certificates identifying the VPN gateway and optionally client certificates for mutual authentication.

149
Q

What is Datagram TLS (DTLS)?

A

A version of TLS over UDP, offering improved performance for latency-sensitive traffic like voice and video.

150
Q

Acronym:
DTLS

A

Datagram TLS

151
Q

What are the supported TLS versions?

A

TLS 1.3 and TLS 1.2. Versions earlier than TLS 1.2 are deprecated.

152
Q

What layer of the OSI model does IPsec operate at?

A

Layer 3

153
Q

What are the two core IPsec protocols, and what do they do?

A

Authentication Header (AH): Provides packet integrity but not confidentiality.

Encapsulating Security Payload (ESP): Encrypts packet data and provides confidentiality and integrity.

154
Q

What are the two IPsec modes?

A

Transport Mode: Encrypts only the payload, leaving the IP header intact.

Tunnel Mode: Encrypts the entire packet, including the IP header.

155
Q

What is the role of the Internet Key Exchange (IKE) protocol in IPsec?

A

It establishes mutual authentication, negotiates cryptographic settings, and creates a secure channel for key exchange.

156
Q

What are the two phases of IKE negotiations?

A

Phase I: Establishes identity, performs key agreement, and creates a secure channel.

Phase II: Negotiates ciphers and key sizes for the IPsec session.

157
Q

What is the difference between IKEv1 and IKEv2?

A

IKEv2 supports EAP authentication, NAT traversal, and MOBIKE multihoming, making it more suited for remote access VPNs.

158
Q

How do TLS and IPsec differ in terms of application?

A

TLS: Operates at the application layer, suitable for specific applications like HTTPS.

IPsec: Operates at the network layer, providing broader support for all traffic types.

159
Q

What authentication mechanisms are supported by IKE?

A

Digital Certificates and Pre-Shared Key (PSK)

160
Q

What is Perfect Forward Secrecy (PFS), and why is it important?

A

A cryptography method that generates unique keys for each session, ensuring that past communications remain secure even if a key is compromised.

161
Q

Define:
EAP Authentication

A

A framework supporting multiple methods

Used in:
- WPA2/WPA3-Enterprise
- 802.1X.

162
Q

Define:
NAT Traversal

A

Method of establishing direct communication between two network endpoints over a network utilizing NAT

UDP punching hole

163
Q

Define:
MOBIKE Multihoming

A

An IKEv2 feature that maintains VPN connections during network changes (e.g., Wi-Fi to cellular) and supports multiple active interfaces.

164
Q

Define:
Packet Overhead

A

Extra data (e.g., headers, encryption) added to packets for transmission, affecting payload size and bandwidth usage.

165
Q

What is a web browser’s primary function?

A

A web browser retrieves and displays internet information, but it can also pose security risks to a network.

166
Q

What are common indicators of an unsecured browser connection or attack?

A
  • Unexpected domain names in URLs
  • Altered menu bars
  • Unlocked status line when SSL should be in use.
167
Q

What types of private data can be cleared from a browser?

A
  1. Browsing and download histories,
  2. Cookies
  3. Cached files
  4. Passwords
  5. Auto-fill data
  6. Site permissions
  7. Hosted app data.
168
Q

What are cookies, and why can they pose a privacy risk?

A

Cookies store preferences and identify you to websites but can be misused to collect personal data or track activities.

169
Q

What is the difference between first-party and third-party cookies?

A

First-party cookies come from the visited site; third-party cookies come from linked sites like ads.

170
Q

What is a browser cache, and why should it be cleared?

A

A cache stores reusable data like images and passwords. It should be cleared on public computers to protect personal information.

171
Q

How can browser security be increased?

A
  1. Enable warnings for site add-ons
  2. Web filtering,
  3. No storing passwords.
  4. Block pop-ups
  5. No third-party cookies
  6. Ask where to save files.
172
Q

What are add-ons, and how should they be managed?

A

Add-ons add browser functionality but can be malicious. Review and uninstall unnecessary or inappropriate ones.

173
Q

What are the two types of privilege escalation?

A

Horizontal: Accessing another user’s data with the same privilege level.

Vertical: Gaining elevated privileges, such as administrative access.

174
Q

What is pointer dereferencing?

A

Retrieving a value stored in memory via a pointer.

175
Q

What can happen if a pointer has a NULL value?

A

It can lead to a denial-of-service (DoS) attack or kernel exploitation. (NullPointer)

176
Q

What is a buffer overflow?

A

An overflow occurs when more data is stored than a buffer can handle, potentially allowing arbitrary code execution or DoS.

177
Q

What is resource exhaustion?

A

Depleting system resources, like memory or CPU, to cause a denial-of-service.

178
Q

How can memory leaks cause problems?

A

They lead to resource exhaustion and can enable exploitation under low-memory conditions.

179
Q

What is a race condition?

A

A vulnerability where multiple processes are exploited to perform unauthorized actions.

Such as multiple process accessing the same data simultaneously

180
Q

How do you mitigate race conditions?

A

Lock files, use file handles instead of names, and prevent changes between system calls.

181
Q

What is improper error handling?

A

Displaying detailed error messages that reveal sensitive information attackers can exploit.

182
Q

What is improper input handling?

A

Failing to validate or sanitize input data, leading to vulnerabilities like SQL injection or buffer overflows.

183
Q

What is a replay attack?

A

Intercepting and replaying network traffic to impersonate the sender.

184
Q

How can replay attacks be mitigated?

A

Use strong digital signatures, timestamps, and sequence numbers.

185
Q

What is a “pass the hash” attack?

A

Using stored password hashes from a compromised machine to access other systems.

186
Q

How do you mitigate pass the hash attacks?

A
  1. Limit domain admin access
  2. Disable remote desktop
  3. Use separate accounts for admin tasks.
187
Q

What are API attacks?

A

Exploiting vulnerabilities in APIs to gain unauthorized access or data.

188
Q

How can API attacks be mitigated?

A

Implement rate limiting, monitor logs, and validate input data.

189
Q

What is SSL stripping?

A

Downgrading an HTTPS connection to HTTP to intercept user data.

190
Q

How can SSL stripping be mitigated?

A

Use HSTS, encrypt all site elements, and add the domain to the HSTS preload list.

191
Q

What is driver manipulation?

A

Altering or adding malicious functionality to device drivers.

192
Q

What is “refactoring” in driver manipulation?

A

Modifying driver code internally without changing its external behavior to hide malicious actions.

193
Q

What is “shimming” in driver manipulation?

A

Using or modifying intermediary code between older APIs and updated systems to inject malicious functionality.

194
Q

What is the role of client-side and server-side validation?

A

Client-side: Prevent errors locally.

Server-side: Validate data after submission to prevent bypassing safeguards.

195
Q

What are DNSSEC and HTTPS used for?

A

DNSSEC: Ensures secure connections with digital certificates.

HTTPS: Encrypts HTTP traffic for secure communication.

196
Q

What is the Waterfall Development Life Cycle?

A

A linear model where each step (Requirements, Design, Implementation, Testing, Deployment, Maintenance) must be completed before moving to the next.

197
Q

What are key characteristics of the Waterfall model?

A

Sequential steps, slow progress, limited flexibility, and fixed requirements.

198
Q

What is the Agile Development Life Cycle?

A

A model that breaks development into smaller, iterative cycles called Sprints, focusing on continuous updates and testing.

199
Q

How do Agile Sprints work?

A

Each Sprint lasts 2–3 weeks, focuses on a specific feature, and includes regular testing and iterative improvement.

200
Q

What are compile-time errors?

A

Errors during the code-building phase, preventing the program from running.

201
Q

What are runtime errors?

A

Errors that occur when a program is running, often called bugs.

202
Q

What is error handling?

A

Programming techniques to manage unexpected issues without crashing or exposing vulnerabilities.

203
Q

Why is custom error handling better than default handlers?

A

It limits the information disclosed to attackers, avoiding exposure of sensitive details.

204
Q

What is static code analysis?

A

Reviewing source code for vulnerabilities and errors before deployment.

205
Q

What are the benefits of static code analysis?

A

Early bug detection, improved security, enforced coding standards, and developer education.

206
Q

What is dynamic application security testing (DAST)?

A

Black-box testing of applications after deployment to find vulnerabilities externally.

207
Q

What is static application security testing (SAST)?

A

White-box testing that analyzes source code early in development to find vulnerabilities like SQL injection.

208
Q

What is interactive application security testing (IAST)?

A

A hybrid testing method combining runtime and static analysis to identify vulnerabilities during runtime.

209
Q

What is software sandboxing?

A

Isolating processes to restrict their access to the system, preventing widespread damage from malicious or faulty software.

210
Q

How do browsers implement sandboxing?

A

Each tab and extension runs in an isolated process, preventing one from affecting others.

211
Q

How do operating systems use sandboxing?

A

Apps are confined to their own data and resources, limiting access to other apps or system resources.

212
Q

What role do VMs and containers play in sandboxing?

A

They isolate environments, ensuring a breach in one does not affect others or the host.

213
Q

What is normalization in databases?

A

A process that reorganizes data to eliminate redundancy, improve performance, and reduce exploitation risks.

214
Q

What are stored procedures?

A

Predefined database statements that centralize logic, prevent code duplication, and mitigate injection attacks.

215
Q

What is code obfuscation?

A

Deliberate creation of hard-to-understand code to prevent reverse engineering and tampering.

216
Q

What are the risks of code reuse?

A

Vulnerabilities in reused code can propagate if not tested thoroughly before sharing or adapting.

217
Q

What is dead code?

A

Unused or non-executable code that should be removed to eliminate security risks.

218
Q

What is memory management?

A

Allocating and releasing memory efficiently to prevent vulnerabilities like buffer overflows or memory leaks.

219
Q

What are common memory vulnerabilities?

A

Incorrect buffer size calculation, unchecked input size, and uncontrolled format strings.

220
Q

What are third-party libraries and SDKs?

A

Prewritten code or tools from external sources, which must be tested for flaws and unnecessary code.

221
Q

How can sensitive data exposure be mitigated?

A

Encrypt data in transit and at rest, disable form caching, and use salted, hashed passwords.

222
Q

What is fuzz testing?

A

A technique providing random or unexpected input to applications to identify vulnerabilities.

223
Q

What is code signing?

A

Digital signatures verify a software’s integrity and origin but don’t guarantee its security.

224
Q

What are secure cookies?

A

Cookies configured with attributes like Secure, HttpOnly, and SameSite to prevent attacks like session hijacking and CSRF.

225
Q

What is the ‘Secure’ attribute for cookies?

A

Ensures cookies are sent only over HTTPS connections, protecting them from interception.

226
Q

What is the ‘HttpOnly’ attribute for cookies?

A

Prevents client-side scripts from accessing cookies, mitigating XSS attacks.

227
Q

What is the ‘SameSite’ attribute for cookies?

A

Restricts cookies to same-site requests, mitigating CSRF attacks.

228
Q

Why should cookies have expiration limits?

A

To restrict their usable life and reduce the risk of long-term exploitation.

229
Q

What is the primary assumption for application hardening?

A

Assume all installed applications are flawed.

230
Q

What should be done with unused applications?

A

Remove all unused applications from the system.

231
Q

Why should administrative privileges be limited?

A

To reduce the potential attack surface and prevent unauthorized access.

232
Q

What is process spawning, and why block it?

A

Process spawning creates a new child process; blocking it prevents process-spawning attacks.

233
Q

Why control access to executable files?

A

To protect them from modification by removing Write permissions for applications.

234
Q

What is Data Execution Prevention (DEP)?

A

A feature that prevents applications from executing code in memory designated for data storage.

235
Q

What do exception rules in application hardening allow?

A

Administrators can bypass specific hardening rules for legitimate application needs.

236
Q

What is the purpose of application hardening tools like AppArmor?

A

To apply specific hardening rules to applications, libraries, and SDKs.

237
Q

What is the role of logging in application security?

A

Captures important events for audits, incident response, and system troubleshooting.

238
Q

Why integrate real-time alerting in applications?

A

To detect potential threats, such as repeated failed login attempts or unusual data transfers.

239
Q

How does error handling improve security?

A

Masks sensitive debugging information to minimize risks of exploitation.

Security+ (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions