Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

security and assurance > quiz 2 > Flashcards

quiz 2 Flashcards

1
Q

Denial-of-service (DoS) attack

A

an attack against a network resource that aims to prevent, disrupt, or delay authorized users from accessing the network resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Distributed Denial-of-Service (DDoS) attack

A

a DoS attack that is simultaneously launched from multiple systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Network-based DDoS attack

A

a DDoS attack that aims to exhaust the target system’s network bandwidth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Protocol-based DDoS attack

A

a DDoS attack that aims to exhaust the target system’s network resources or the resources of a network infrastructure equipment, such as a firewall or a load balancer. Exploits the weaknesses of network layer (OSI layer 3) and transport layer (OSI layer 4) protocols to create maliciously configured protocol packets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Application layer DDoS attack

A

a DDoS attack that aims to exhaust specific functions or features of a program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Domain name system (DNS)

A

a hierarchical and decentralized naming system for identifying and locating the resources connected to a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

DNS resolution

A

process of translating or resolving a domain name to an IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

DNS zone

A

a portion of a DNS namespace that is managed by an administrator or specific organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

authoritative name server

A

a DNS server that manages a domain’s configuration, also known as the domain’s DNS record.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Domain reputation

A

a measure of a domain’s trustworthiness based on historical data on the domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Domain hijacking

A

the act of changing the registration information of a domain without the knowledge or consent of the domain owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

URL redirection

A

the act of using a URL to divert a user to a malicious website

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

DNS poisoning

A

an attack that aims to redirect a user to a malicious website by modifying the user’s DNS query

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data origin authentication

A

A DNS client is assured that DNS data originated from the zone owner.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Domain Name System Security Extensions

A

a set of extensions to DNS that provide a DNS resolver cryptographic authentication of DNS data using digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data integrity

A

A DNS client is assured that DNS data has not been modified in transit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

data link layer

A

facilitates data transfer between two connected devices on the same network. responsible for flow control and the detection and correction of errors that may occur in the physical layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

media access control (MAC) address

A

a unique 48-bit identifier assigned to a network device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

address resolution protocol (ARP)

A

a protocol used for resolving an internet address (Layer 3) into a MAC address (Layer 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ARP cache table

A

a table that maps an internet address to the internet address’ corresponding MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Address resolution protocol (ARP) poisoning

A

an attack in which an attacker sends spoofed ARP messages on a local area network (LAN) to associate the attacker’s MAC address with the IP address of a target host on the LAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Media access control (MAC) flooding

A

an attack in which a large number of invalid MAC addresses are sent to a network switch with the aim of overwriting the switch’s MAC table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

MAC cloning

A

the act of changing the factory-assigned MAC address of a network device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Man-In-The-Middle (MITM) attack

A

an attack in which an attacker eavesdrops or modifies the communications between two parties. operates at the network layer (Layer 3)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

MAC table

A

a table that maps each network device’s MAC address to a physical port on a switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Unicast flooding

A

a switch’s broadcast of a packet on all the switch’s ports. Unicast flooding enables an attacker to gain access to all data packets on a LAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

secure channel

A

a communication channel that guarantees data authenticity and data confidentiality.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Man-In-The-Browser (MITB) attack

A

a type of MITM attack that uses malware to intercept or modify messages exchanged between a web browser and a web server.most often used to steal financial information by modifying a user’s communications with an Internet banking website.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

POPS

A

uses SSL/TLS to secure communications between a POP client and a POP server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Post office protocol (POP)

A

an Internet standard protocol used by an email client to retrieve an email from a mail server. does not support the sending of an email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Internet message access protocol (IMAP)

A

an Internet standard protocol used by an email client to retrieve an email from a mail server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

IMAPS

A

uses SSL/TLS to secure communications between an IMAP client and an IMAP server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Multipurpose Internet Mail Extensions (MIME)

A

an Internet standard that extends the format of an email message to support non-ASCII character sets and multimedia attachments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Secure/Multipurpose Internet Mail Extensions (S/MIME)

A

an Internet standard for signing and encrypting MIME data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Secure shell protocol (SSH)

A

a cryptographic network protocol for securely operating a network service over an insecure network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Protocol tunneling

A

the encapsulation of a protocol’s packets within the packets of another protocol.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

FTPS

A

an extension to the file transfer protocol (FTP) that uses SSL/TLS to provide communication security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

SSH file transfer protocol (SFTP)

A

an extension of the SSH protocol that enables secure file transfer capabilities between networked hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Secure real-time transport protocol (SRTP)

A

a protocol for secure delivery of voice and video services over an IP network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Lightweight directory access protocol (LDAP)

A

a protocol for accessing and maintaining distributed directory information services over an IP network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

LDAPS

A

uses SSL/TLS to protect LDAP transmissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

LDAP injection attack

A

an attack in which an attacker exploits input validation vulnerabilities to construct and execute an unauthorized LDAP query

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Hypertext transfer protocol secure (HTTPS)

A

an extension of the hypertext transfer protocol (HTTP) that uses SSL/TLS to establish an authenticated and encrypted connection between a client and a server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Internet Protocol Security (IPSec)

A

a protocol suite for securing data communications over an IP network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Authentication Header (AH)

A

an IPSec protocol that provides authentication and integrity for an IP packet and protection against a replay attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Encapsulating Security Protocol (ESP)

A

an IPSec protocol that provides authentication, integrity, and confidentiality for an IP packet and protection against a replay attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Transport mode

A

an IPSec mode in which only an IP payload is authenticated and encrypted, not the IP header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Tunnel mode

A

an IPSec mode in which an IP packet (IP header and IP payload) is authenticated, encrypted, and encapsulated in a tunneling protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Network segmentation

A

the act of partitioning a network into segments. Network segmentation is used to create security zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

security zone

A

a network segment that has specific security requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

trusted zone

A

a security zone that contains protected network resources that should only be accessible by an authorized user or system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

untrusted zone

A

a security zone that is outside an organization’s control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

virtual local area network (VLAN)

A

a broadcast domain that is segmented at the data link layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

jump server

A

a minimally configured server in a security zone that is used for managing the hosts in the security zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

demilitarized zone

A

a security zone that lies between a trusted and an untrusted zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Port-based VLAN

A

a VLAN in which a host is connected to a specific switch port that is assigned to a VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Protocol-based VLAN

A

a VLAN in which protocol types are used to assign a host to a VLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

MAC-based VLAN

A

a VLAN in which a host’s MAC address is used to assign the host to a VLAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

firewall

A

a network device or a software program that controls inbound and outbound traffic based on a set of rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

hardware firewall

A

a firewall that is implemented in a physical device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

software firewall

A

a firewall that is implemented in software and runs on a general-purpose computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

open-source firewall

A

software firewall with freely available source code that can be modified and redistributed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

proprietary firewall

A

a firewall that is built by an entity that has exclusive rights to the firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

stateless firewall

A

a firewall that allows or blocks a packet based on the information in the packet header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

access control list (ACL)

A

a list of rules used by a firewall to control inbound and outbound network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

stateful firewall

A

a firewall that monitors and tracks active network connection sessions and blocks a packet that does not belong to an active session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

unified threat management (UTM)

A

a security appliance that provides multiple security functions at a single point on a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

next-generation firewall (NGFW)

A

a firewall that combines the functionality of a packet filtering firewall with other technologies to detect and block a network attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

virtual firewall

A

a software or hardware firewall that provides packet filtering within a virtualized environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Hypervisor mode

A

a virtual firewall mode in which a firewall resides in a host’s hypervisor kernel and monitors and controls inbound/outbound traffic on the virtual machines running on the host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Bridge mode

A

a virtual firewall mode in which a firewall runs on a virtual machine and monitors and controls inbound/outbound traffic on the virtual machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

host-based firewall

A

a software firewall that runs on a host and controls the host’s inbound and outbound network traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

network address translation (NAT) gateway

A

a device that enables multiple hosts with private IP addresses to connect to the Internet using a single public IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

web application firewall (WAF)

A

a specific form of application firewall that monitors and filters HTTP and HTTPS traffic between a web application and the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

application firewall

A

a firewall that controls an application’s input and output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

URL filtering

A

he act of blocking access to a URL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

intrusion detection system (IDS)

A

a device or a software application that detects a malicious activity or a security policy violation in a system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Content filtering

A

the act of blocking access to content based on predefined criteria.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Network Intrusion Detection System (NIDS)

A

an IDS that detects a threat to a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Network Intrusion Prevention system (NIPS)

A

a NIDS that blocks a threat to a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

host-based intrusion detection system (HIDS)

A

an IDS that detects a threat to a host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Inline mode

A

a NIDS/NIPS deployment mode in which network traffic is passed through a NIDS/NIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Passive mode

A

a NIDS/NIPS deployment mode in which a NIDS/NIPS receives a copy of network traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Signature-based detection

A

a detection method that detects an attack by using the attack’s pattern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Anomaly-based detection

A

a detection method that detects an attack by identifying a network state that is different from the network’s normal state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Behavior-based detection

A

a detection method that detects an attack by searching for a specific pattern that matches a threat behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Heuristic-based detection

A

a detection method that detects an attack by adaptive techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

virtual private network (VPN)

A

a service using encryption to connect devices over a public network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

site-to-site VPN

A

a connection between two or more networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

client-to-site VPN

A

a connection between a client computer and a remote router.

83
Q

Transport Layer Security (TLS)

A

Communication on HTTPS is encrypted through the use of

83
Q

full tunnel

A

routes and encrypts all network traffic through the VPN, regardless of where the VPN service is hosted

84
Q

split tunnel

A

routes and encrypts all non-internet network traffic over the VPN

85
Q

HTTPS (Hypertext Transfer Protocol Secure)

A

Security on the web is provided through the use of

86
Q

Secure Sockets Layer

A

In the past, communication was encrypted through the use of the

87
Q

Layer 2 Tunneling Protocol (L2TP

A

a mechanism for setting up VPN tunnels at the data link layer.

87
Q

broadcast storm

A

the occurrence of a large number of broadcast and multicast packets on a network within a short time period.

88
Q

bridge protocol data unit (BPDU)

A

a packet exchanged between switches on a local area network (LAN) to detect the network’s loops

88
Q

bridge protocol data unit (BPDU) guard

A

a control mechanism for preventing a BPDU packet from entering a switch port.

88
Q

Broadcast storm prevention

A

the act of preventing or reducing packet rebroadcasts on a LAN.

89
Q

network loop

A

a network topology in which more than one path exists between two network endpoints

90
Q

Dynamic host configuration protocol (DHCP)

A

a network management protocol used for automating the assignment of IP addresses and network configuration parameters to devices on an IP network.

91
Q

Dynamic host configuration protocol (DHCP) snooping

A

a Layer 2 control for preventing an unauthorized or rogue DHCP server from offering network configuration parameters to a DHCP client

92
Q

DHCP spoofing attack

A

an attack in which an attacker configures a rogue DHCP server to send a forged DHCP response to a DHCP request.

93
Q

DHCP starvation attack

A

an attack that aims to deplete a DHCP server’s IP address pool

94
Q

load balancer

A

a hardware device or a software program that performs load balancing

95
Q

Load balancing

A

the act of distributing network or application traffic across multiple servers in a server group

96
Q

Active/active

A

a load balancer mode in which two load balancers share the workload and distribute traffic across multiple servers.

97
Q

Active/passive

A

a load balancer mode in which a primary load balancer distributes traffic across multiple servers and a standby load balancer that is activated when the primary load balancer fails.

98
Q

Least connection load balancing

A

a scheduling algorithm in which data traffic is distributed to a server with the fewest number of active connections.

99
Q

IP hash load balancing

A

a scheduling algorithm in which data traffic is routed to a specific server based on a client’s IP address.

99
Q

Least response time load balancing

A

a scheduling algorithm in which data traffic is distributed to a server with the fewest number of active connections and the lowest average response time

100
Q

Round robin load balancing

A

a scheduling algorithm in which data traffic is distributed across a group of servers sequentially.

101
Q

East-west traffic

A

the traffic between a data center’s network components.

102
Q

North-south traffic

A

the traffic that enters or leaves a data center

103
Q

Southbound traffic

A

the traffic that enters a data center

104
Q

Northbound traffic

A

the traffic that leaves a data center.

105
Q

intranet

A

a private network that can only be accessed by an organization’s authorized internal users

106
Q

extranet

A

a controlled private network that allows access to a subset of an organization’s intranet to the organization’s external partners, vendors, suppliers, and customers

107
Q

Cross-site scripting

A

a web server security vulnerability that enables the injection of client-side scripts into a web server’s web pages.

108
Q

reflected cross-site scripting

A

a cross-site scripting attack in which an injected script is returned to a client in response to an HTTP request by the client.

109
Q

Document object model (DOM)

A

a standard object model and programming interface for HTML. DOM defines how to get, change, add, or delete HTML elements.

109
Q

stored cross-site scripting

A

a cross-site scripting attack in which a malicious script is stored on a web server’s back-end database and returned to all clients that request the web pages containing the script

110
Q

DOM-based cross-site scripting

A

a cross-site scripting attack in which the source and destination of the attack is the client web browser

111
Q

cross-site request forgery (CSRF)

A

an attack in which an attacker sends a forged request to a web application on behalf of an authenticated user.

112
Q

server-side request forgery (SSRF)

A

an attack in which an attacker sends forged requests from a web application’s server to other servers. In an SSRF attack, an attacker tricks a server into making an unauthorized request.

113
Q

data buffer

A

a memory region used for temporarily storing data while the data is being transferred from one memory location to another

114
Q

buffer overflow

A

a programming error condition that occurs when the size of the data to be stored in a buffer is larger than the buffer size.

115
Q

Improper input handling

A

a program’s insufficient validity checking of user input

116
Q

data type

A

a data attribute that specifies how the data is intended to be used in a program

117
Q

integer overflow

A

a programming error condition that occurs when the result of an integer operation is greater than the maximum size, or less than the minimum size of the integer type used to store the result.

118
Q

Memory management

A

the process of controlling and coordinating a computer’s memory

119
Q

Stack

A

memory that stores local variables and is used for static memory allocation

120
Q

Heap

A

memory that stores global variables and is used for dynamic memory allocation

121
Q

memory leak

A

an occurrence in which a program allocates heap memory but does not deallocate the memory when the memory is no longer needed

122
Q

pointer

A

a program variable that stores a memory address.

123
Q

pointer dereferencing

A

the act of obtaining the value stored at the memory location pointed to by the pointer.

124
Q

Error handling

A

the process of responding and recovering from error conditions in a program

125
Q

replay attack

A

a network attack in which a data transmission is intercepted and maliciously repeated or delayed.

126
Q

session ID

A

a unique number assigned to an authenticated user by a web application

127
Q

session replay attack

A

a replay attack in which a user’s session ID is used to impersonate the user and perform a fraudulent transaction or activity.

128
Q

New technology LAN manager (NTLM)

A

a challenge-response authentication protocol.

129
Q

Pass the hash

A

an attack in which an attacker authenticates to a server or service using the NTLM’s password hash of a user.

130
Q

SQL injection

A

an injection attack in which an application’s user input fields are used to insert a malicious SQL statement into the application.

130
Q

injection attack

A

an attack that injects or inserts malicious input into a program or database query.

131
Q

Extensible Markup Language (XML)

A

a markup language that defines a set of rules for encoding documents in a text-based format.

132
Q

XML injection

A

an attack that manipulates the logic of an XML-based application

133
Q

dynamic link library

A

a library of code and data for commonly used functions in a Windows computer.

134
Q

DLL injection

A

an injection attack in which a process is forced to load and execute malicious DLL code within the process’s address space

135
Q

Lightweight directory access protocol (LDAP)

A

a protocol for accessing and maintaining distributed directory information services over an IP network.

135
Q

LDAP injection

A

an attack in which an attacker exploits input validation vulnerabilities to manipulate an LDAP statement executed on an LDAP server

136
Q

race condition

A

a software event in which multiple concurrently executing processes access a shared resource at the same time

137
Q

Time-of-check (TOC)

A

the time at which a process checks a shared resource’s state

137
Q

Time-of-check to time-of-use

A

a class of software errors that are caused by a race condition.

138
Q

Time-of-use (TOU)

A

the time at which a process uses a shared resource.

139
Q

resource exhaustion attack

A

an attack that aims to slow down or disable an application by using up the application’s limited resources

140
Q

driver shim

A

a software library that intercepts and modifies calls to a device driver

141
Q

device driver

A

a program that controls a computer-connected hardware device.

142
Q

shim attack

A

an attack in which malicious code is added to a driver shim

143
Q

Refactoring

A

a set of techniques used for improving a program’s internal structure without changing the program’s behavior.

144
Q

refactoring attack

A

an attack in which malicious code is added to a device driver through refactoring without changing the device driver’s desired behavior.

145
Q

vertical privilege escalation

A

privilege escalation in which a lower privilege user or application gains privileges assigned to another user or application with higher privileges

145
Q

Privilege escalation

A

the act of gaining account privileges beyond those assigned to the account.

145
Q

horizontal privilege escalation

A

privilege escalation in which a user or application gains privileges assigned to another user or application with the same privileges.

146
Q

root directory

A

a directory on a web server’s file system that the web server’s users can access

147
Q

Directory traversal

A

a web application security vulnerability that allows unauthorized users to access files outside of a web server’s root directory

148
Q

system disk

A

any media that contains part or all of an operating system.

149
Q

application programming interface (API)

A

a set of functions and protocols for building and integrating different applications and data sets.

150
Q

application programming interface (API) attack

A

an attack that exploits the vulnerabilities in an application’s API to attack the application or a service

151
Q

development environment

A

the environment where an application is created, debugged, modified, and improved

151
Q

Secure socket layer stripping (SSL stripping)

A

an attack that aims to downgrade an attempted HTTPS connection between a web server and client to an HTTP connection

152
Q

environment

A

the collection of hardware and software used to build an application

153
Q

test environment

A

the environment where an application is tested against the application’s specification requirements.

154
Q

staging environment

A

a pre-production environment that mirrors a production environment and contains the final release version of an application

155
Q

Quality assurance

A

the process of testing an application’s various aspects, including an application’s stability, usability, security, functionality, and performance to ensure that the application meets user requirements

156
Q

production environment

A

an environment where the release version of an application is deployed and made available to the application’s users.

157
Q

Code signing

A

the act of digitally signing software by the software’s publisher.

158
Q

Provisioning

A

the process of moving an application to a production environment and customizing the application configurations.

159
Q

Deprovisioning

A

the process of removing an application from a production environment.

160
Q

software development kit (SDK)

A

a collection of software development tools in one package

160
Q

Software versioning

A

the process of assigning names or numbers to unique states of released software.

161
Q

Secure coding

A

the practice of developing software in a way that minimizes the risk of creating software vulnerabilities

161
Q

Secure coding techniques

A

methods designed to improve code security.

161
Q

Version control

A

the practice of tracking and managing a software’s versions.

161
Q

Dead code

A

code that can never be executed at run-time, or is executed but whose result is never used in any other computation.

161
Q

third-party library

A

a reusable software component developed by an entity other than the original publisher of a software development platform

162
Q

Obfuscation

A

a secure coding technique that makes code difficult to read and harder to understand by modifying the code appearance.

162
Q

Code reuse

A

the use of existing software to build new software

163
Q

Elasticity

A

the degree to which a system is able to adapt to workload changes by automatically provisioning and deprovisioning resources.

164
Q

Scalability

A

the measure of a system’s ability to handle increased demands.

165
Q

Horizontal scalability

A

scalability which entails adding new systems to an existing infrastructure

166
Q

Vertical scalability

A

scalability which entails adding resources to existing systems

167
Q

Software diversity

A

the practice of creating diversity within the software development process with the aim of reducing the extent of software vulnerability exploits

168
Q

Data Exposure

A

the intentional or unintentional disclosure of information to an unauthorized user or application

169
Q

Database normalization

A

the process of organizing data in a relational database

170
Q

stored procedure

A

a group of SQL statements created to perform a specific task.

171
Q

Salting

A

the process of adding a unique string of characters to a password before hashing the password

171
Q

token vault

A

a secure storage mechanism that stores a mapping between sensitive data and tokens

171
Q

Hashing

A

the process of transforming a variable length string to a fixed-size value

172
Q

parameterized query

A

a query in which placeholders are used for parameters and the parameter values are supplied at execution time

173
Q

Tokenization

A

the process of substituting a sensitive data element with a non-sensitive data element

173
Q

code review

A

the process of systematically examining code with the aim of improving code quality.

173
Q

Dynamic code analysis

A

a code review method that examines code during the code execution.

173
Q

Static code analysis

A

a code review method that examines code without executing the code

174
Q

Manual code review

A

the process of performing static code analysis by one or more code reviewers.

175
Q

Fuzzing

A

an automated software testing technique for finding software bugs and vulnerabilities by feeding invalid and random data into software.

175
Q

Development operations

A

a set of practices and tools that automate and integrate software development and IT operations.

176
Q

fuzzer

A

a program that automatically generates random data for software testing.

177
Q

Continuous integration

A

the practice of frequently merging new and modified code from multiple developers into a single software project.

178
Q

Continuous delivery

A

the practice of frequently releasing new software that is ready to be deployed into a stage environment.

179
Q

Continuous deployment

A

the practice of frequently deploying new software into a production environment.

180
Q

Continuous validation

A

the practice of frequently verifying that new and existing software is tested.

181
Q

Continuous monitoring

A

the practice of frequently monitoring released software to detect errors, security risks and compliance issues.

182
Q

open web application security project (OWASP)

A

a non-profit foundation that publishes methodologies, documentation, tools, and technologies for raising awareness and improving web application security.

183
Q

Web application security

A

the set of practices and technologies that enable the creation of secure web applications.

184
Q

Input validation

A

a secure coding technique that ensures only valid input is entered into software.

185
Q

OWASP Top 10

A

a regularly-updated list of the 10 most common web application security risks.

186
Q

Allow list

A

an input validation method that ensures an input matches a set of known good values.

187
Q

Block list

A

an input validation method that ensures an input does not contain known bad values.

188
Q

Server-side validation

A

input validation that is performed by a server after input has been sent to the server.

189
Q

Client-side validation

A

input validation that is performed by a client before input is sent to a server

190
Q
A
191
Q
A
192
Q
A

security and assurance (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions