Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CompTIA Security+ SY0-501 > Notes From Lynda Course > Flashcards

Notes From Lynda Course Flashcards

1
Q

Port 21

A

FTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Port 22

A

SSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Port 389

A

RDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Ports 137-139

A

NetBIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Port 25

A

SMTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Port 110

A

POP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Port 143

A

IMAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Port 80

A

HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Port 443

A

HTTPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Symmetric Algorithms

A

Encryption and decryption operations use the same key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Asymmetric Algorithms

A

Encryption and decryption operations use different keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Salting

A

Adds a value to the encryption key to make it more complex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Hashing

A

Adds time to the verification process by requiring more math

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

WPA

A

WiFi Protected Access - Uses the Temporal Key Integrity Protocol (TKIP) to implement strong encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

WPA2

A

Wifi Protected Access v2 - Adds time to the verification process by requiring more math

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

LEAP

A

Lightweight EAP - Insecure protocol that relies upon MS-CHAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

EAP

A

Broad framework with many variants, some are secure, some are not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PEAP

A

Protected EAP - Tunnels EAP inside an encrypted TLS session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Spyware

A

Gathers information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Adware

A

Displays advertisements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Ransomware

A

Blocks access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Christmas Tree Attack

A

Uses packet flags to exploit a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

DNS/ARP Poisoning

A

Redirects or intercepts traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Typosquatting

A

Exploits typos to get web traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Two components of every malware

A
  1. Propagation Mechanism

2. Payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Propagation Mechanism

A

The way a malware object spreads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Payload

A

The malicious action that the malware performs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Virus

A

Type of malware that is spread by user interaction (User education is the best preventative measure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Worm

A

Type of malware that spreads by itself - require vulnerable systems to spread (Keeping systems updated is the best preventive measure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Trojan Horse

A

Type of malware that disguise themselves as a beneficial program with a malicious payload (Application control is the best protection from this)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Remote Access Trojans (RAT)

A

Provides backdoors to hacked systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Three types of malware payloads

A

Adware, Spyware, Ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Three types of propagation techniques

A

Virus, Worm, Trojan Horse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Backdoor

A

Provides unregulated workaround access to a system using modified code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Backdoor mechanisms

A

Hardcoded accounts, default passwords, and unknown access channels can provide access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Logic Bomb

A

Uses modified code to deliver a triggered payload

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Three advanced malware concepts

A

Rootkits, Polymorphism, and armored viruses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Rootkits

A

Software techniques used to hide other software on a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Polymorphism

A

Changes signature to avoid detection, they use a different encryption key with each system they infect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Armored Viruses

A

Prevents reverse engineering, sandboxing, and blocks system debuggers to prevent detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Root Account

A

A special superuser account that provides unrestricted access to system resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Rootkit Payloads

A

Backdoors, Botnet agents, Adware/spyware, Antitheft mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

User Mode Rootkits

A

Run with normal user privileges, easy to write and difficult to detect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Kernel Mode Rootkits

A

Run with system privileges, difficult to write, and easy to detect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Signature detection

A

Identifying viruses by detecting known code patterns from a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Christmas Tree Attack

A

All of the flags are set to 1 in the header packet which can crash a system or can be used to do OS fingerprinting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

DNS

A

Domain Name Service - A service that translates common domain names into IP addresses for the purpose of network routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

ARP

A

Address Resolution Protocol - Protocol that translates logical IP addresses into the hardware (MAC) addresses on the LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Typosquatting

A

AKA URL Hijacking - an attack that consists of registered domain names similar to official sites, hoping that users will make a typo and visit their site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Domain Hijacking

A

Steals a domain registration or alter DNS records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

MAC Spoofing Attack

A

Alters hardware addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

IP Spoofing Attack

A

Alters IP Addresses - often used in DoS attacks - not useful in attacks that require return data because receiving data on a spoofed IT is not easy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Ingress Filtering

A

Blocks incoming traffic from external networks bearing an internal source IP address - useful for blocking spoofing attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Egress Filtering

A

Blocks outbound traffic from internal networks bearing a source IP address that you don’t control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Four Common types of password attacks

A
  1. Brute Force,
  2. Dictionary Attack,
  3. Hybrid Attack
  4. Rainbow Table Attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Brute Force Attack

A

Attempts all combinations for a password - only works for short non-complex passwords. AKA Known Ciphertext Attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Dictionary Attack

A

All English language words are attempted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Hybrid Attacks

A

Adds common variations to the Dictionary Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Rainbow Table Attack

A

Pre-computed hashes are used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Keyspace

A

The set of all possible encryption keys usable with an algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Frequency analysis

A

Studies the patterns of letters in cipher text

62
Q

Known-Plaintext Attack

A

Attacker has both the encrypted and unencrypted versions of a password and uses this as a decryption key for other messages

63
Q

Chosen-Plaintext attack

A

The attacker creates an encrypted message and attempts to determine the key that is being used

64
Q

Downgrade Attack

A

When a system supports many different types of encryption, the attacker uses a MITM attack to force two other systems that are attempting to communicate to switch to a weaker algorithm and the attacker can eavesdrop on and crack the password

65
Q

Watering Hole Attacks

A

Client side attack that exploits vulnerabilities in the client accessing the server. Usually using a highly targeted (usually trusted websites) website and bundling a botnet to infect other systems

66
Q

Clickjacking Attack

A

An attack where the attacker hides elements of a webpage behind other elements so that a used cannot see what he or she is actually clicking - Form of CSRF

67
Q

Cursorjacking

A

Specialized form of clickjacking that tricks the used about the cursor’s location on the screen

68
Q

Directory Traversal Attacks

A

Allows an attacker to manipulate the file system structure on a web server - the attacker uses directory navigation references to search for unsecured files on a server

69
Q

Buffer Overflow Attacks

A

If user input exceeds the space allotted for the data

70
Q

Code Execution Attacks

A

An attacker exploits a vulnerability in a system that allows the attacker to run commands on that system.

71
Q

Arbitrary Code Execution

A

Code execution attacks where the attacker runs commands of his or her choice

72
Q

Remote code execution

A

Code execution attacks that take place over a network connection

73
Q

Preventive measures for code exwecution attacks

A
  1. Limit administrative access

2. Patch systems and applications with all available security updates

74
Q

Driver Refactoring

A

Driver manipulation technique that modifies a driver to carry out malicious activities. It requires access to the driver source code

75
Q

Driver Shimming

A

Driver manipulation technique that wraps a malicious driver around the outside of the driver. Does not require access to the legitimate driver’s source code.

76
Q

Six reasons social engineering attacks are successful

A
  1. Authority/Trust
  2. Intimidation
  3. Consensus and Social Proof (Herd mentality)
  4. Scarcity (Act quickly or you will miss out)
  5. Urgency
  6. Familiarity and Liking
77
Q

Spear Phishing

A

Highly targeted phishing attack

78
Q

Whaling

A

Subset of spear phishing - focuses on senior executives

79
Q

Pharming

A

A fake website is sent to users and looks like a familiar website

80
Q

Vishing

A

Voice phishing attacks asking for credentials over the phone or tell them to go to a website to download something

81
Q

SPIM

A

Spam via IMs

82
Q

Bridges

A

Connects two networks together at Layer 2 using MAC address

83
Q

Media Gateways

A

Connect different telecommunications networks together

84
Q

TCP/IP

A

Transmission Control Protocol/Internet Protocol

85
Q

IP (Internet Protocol)

A

Responsible for routing information across the networks
Provides an addressing schema (IP Addresses)
Delivers packets from the source to its destination
Network Layer Protocol

86
Q

Two main transport layer protocols

A

TCP and UDP

87
Q

TCP (Transport Layer Protocol)

A

Responsible for the majority on internet traffic
Connection-oriented protocol
Establishes connections between to systems before transmitting data
Guarantees delivery through acknowledgement
Widely used for critical applications because of its reliability

88
Q

TCP Flags

A

Used to identify packets in the three way handshake process

89
Q

TCP Flag Types

A

SYN - Establish a connection
FIN - Close a connection
ACK - Acknowledges a SYN or FIN request

90
Q

UDP (User Datagram Protocol)

A

More lightweight than TCP
Connectionless/ no handshake
No Acknowledgements or guaranteed delivery
Good for voice and video applications

91
Q

Physical Layer

A

Wires, Radios, Optics

92
Q

Data Link Layer

A

Data transfers between two nodes

93
Q

Network Layer

A

IP

94
Q

Transport Layer

A

TCP and UDP

95
Q

Session Layer

A

Exchanges between two systems

96
Q

Presentation Layer

A

Data translation and encryption

97
Q

Application Layer

A

User programs

98
Q

DNS Servers

A

Translates domain names into IP addresses

99
Q

UDP Port 53

A

DNS

100
Q

Network Ports

A

16-bit binary number
2 to the 16th power or 65,536 possible
Ranges from 0-65,535

101
Q

Port 21

A

FTP

102
Q

Port 22

A

SSH

103
Q

Port 3389

A

RDP

104
Q

Ports 137, 138, 139

A

NetBIOS

105
Q

Port 53

A

DNS

106
Q

Administrative Service Ports

A

21: FTP
22: SSH
53: DNS
137-139: NetBIOS
3389: RDP

107
Q

Port 25

A

SMTP (Simple Mail Transfer Protocol)

108
Q

Port 110

A

POP (Post Office Protocol)

109
Q

Port 143

A

IMAP (Internet Message Access Protocol)

110
Q

Mail Services Ports

A

25: SMTP
110: POP
143: IMAP

111
Q

Port 80

A

HTTP

112
Q

Port 443

A

HTTPS

113
Q

ICMP (Internet Control Message Protocol) Functions

A 
Function shows:
Destination unreachable
Redirects
Time exceeded
Address mask requests and replies
114
Q

ICMP commands

A

ping

traceroute

115
Q

Stateful inspection

A

Tracks open connections

116
Q

Firewall Rule Contents

A

Source system address
Destination system addresses
Destination port and protocol
Action (allow or deny)

117
Q

Implicit Deny

A

Any traffic not explicitly permitted by a rule should be automatically denied

118
Q

Web Application Firewall

A

Specifically protect web applications by using application awareness to peer deep into the application layer and block web attacks

119
Q

Benefits of a Proxy Server

A

Anonymization
Performance boosting because the proxy server caches website
Content filtering increases security

120
Q

Proxy server

A

Sits between the user and web server

121
Q

Forward proxies

A

Work on behalf of the client, web server does not detect the proxy server

122
Q

Reverse proxies

A

Work on behalf of the server, Client does not detect proxy server

123
Q

Transparent proxies

A

Are not seen by the client or server. AKA inline proxies or forced proxies. Sits between the client and the outside network. Causes issues with SSL and TLS encrypted communications

124
Q

Load Balancer Security Functions

A

SSL Cert Mgmt
URL Filtering
Other Web Application Security tasks

125
Q

Round-Robin Scheduling

A

A type of load balancing where each server gets an equal number of requests (Simplest)

126
Q

Session Persistence

A

Type of load balancing that routes an individual user’s requests to the same server every time

127
Q

Load Balancer Approaches

A

Active-Active and Active-Passive

128
Q

Active-Active Load Balancing

A

Tow or more load balancers actively handle network traffic and continue to function with diminished capacity if one fails

129
Q

Active-Passive Load Balancing

A

One load-balancer handles all traffic while a second monitors activity and assumes responsibility of the primary load balancer fails

130
Q

Two important security functions of VPNs

A
  1. They allow secure interconnection of remote networks

2. They provide mobile workers with a way to securely connect from a remote location to an organization’s network

131
Q

IPSec

A

Network layer VPN protocol commonly used for site-to-site VPNs but is difficult to configure. May be blocked by the firewall. Adds security to TCP/IP networks

132
Q

SSL/TLS

A

Application layer VPN protocol commonly user for remote access VPNs and easier to configure. Uses port 443 because it is typically allowed through every firewall

133
Q

Two type of remote access VPNs

A

Full-Tunnel VPN

Split-Tunnel VPN

134
Q

Full-Tunnel VPN

A

Everything is encrypted, including web browsing. All network traffic leaving the connected device is routed through the VPN tunnel. regardless of its final destination.

135
Q

Split-Tunnel VPN

A

Only traffic destined for the corporate network is sent through the VPN tunnel. Other traffic is routed directly over the Internet

136
Q

Always-On VPN

A

All mobile devices are configured automatically to connect to the VPN

137
Q

IPSec’s two protocols

A

ESP (Encapsulating Security Payload) and AH (Authentication Headers)

138
Q

ESP (Encapsulating Security Payload)

A

Provides confidentiality and integrity protection for packet payloads

139
Q

AH (Authentication Headers)

A

Provides integrity protection for packet headers and payloads. Makes sure that no changes are made to the packet while it is in transit

140
Q

SA (Security Association)

A

Each pair of cryptographic protocol and hash function

141
Q

Three common firewall errors

A

Shadowed rules
Promiscuous rules
Orphaned rules

142
Q

Shadowed rules

A

Rules that are placed in a lower priority position and are overlooked by a firewall

143
Q

Promiscuous rules

A

Allow more access than necessary

144
Q

Orphaned rules

A

When something likes a service is decommissioned and the rules are never removed.

145
Q

Router Access Control Lists

A

Restrict network traffic

146
Q

WORM Repository

A

“Write Once, Read Many” - The centralized log repository should be configured this way to prevent log tampering

147
Q

NTP (Network Time Protocol)

A

Standardized way to quickly and easily synchronize all of the system clocks within an organization. Install on a centralized time server.

148
Q

Continuous Security Monitoring

A

Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. (Formal definition from NIST)

149
Q

Three core characteristics of Continuous Monitoring

A
  1. Maps to risk tolerance
  2. Adapts to ongoing needs
  3. Actively involves management providing leadership and resources
150
Q

Six Steps of the Continuous Monitoring Process

A
  1. Define a strategy
  2. Establish a monitoring program
  3. Implement the program as automated as possible to collect the metrics, perform assessments and build reports
  4. Analyze and report the findings from the collected data
  5. Respond by mitigating, avoiding, transferring, or accepting the risk
  6. Review and update the monitoring program to fit needs

CompTIA Security+ SY0-501 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions