Review Questions Flashcards
What is hashing in the context of cybersecurity?
The practice of transforming a given key or string of characters into another value for the purpose of security . (Think encryption)
What is “M of N” in context of key signing and cybersecurity?
M of N is multi-user access. (You need multiple people to gain access to something think multiple keycards for one door)
Does salting have to be kept secret in context of encryption and or password safety?
Salting does not have to kept secret.
What makes plaintext the most effective?
The length.
What does 3-factor authentication include?
The third factor is including some sort of bio-metrics. (Fingerprints, facial recognition)
When smart cards (key cards) are implemented in security what information is stored on the cards given to employees?
A private key
Does rule based access control include negotiation?
No it does not include negotiation
What security concept uses the idea of minimum permissions.
The concept of least privilege
Give a brief description of identity management.
Ensures that authorized people – and only authorized people – have access to the technology resources they need to perform their job functions
What is deprovisioning.
Removing a former employees access to software and network services.
What does LDAP stand for
Lightweight Directory Access Protocol
What is a distinguised name?
Describes the identifying information in a certificate
What is the Kerebos protocol used for?
A protocol for authenticating service requests between trusted hosts across an untrusted network
Should assets that require high confidentiality and high integrity have network access or connections.
There should be no network connections.
What is the Zero Trust framework.
Zero Trust security means that no one is trusted by default from inside or outside the network, and verification is required from everyone trying to gain access to resources on the network
What is scheduling in context of load balancing?
To determine which back-end server to send a request to
What is used to keep private network secure, encrypted, and at full integrity
ESP (encapsulating security payload)
What does a Real Time Operating System offer when used?
Stability & Speed
What does MTD stand for?
Maximum tolerable downtime (redundancies help this)
What is OSINT?
Open-Source Intelligence (publicly known issues posted for the public to keep up to date with vulnerabilities and practices)
What does CVE stand for?
Common vulnerability and exposure.
What do pre-shared keys rely on?
The strength of the passphrase key
What type of authentication do enterprises use?
RADIUS (Remote Authentication Dial-In User Service)
What is an alternative to password based authentication that uses digital certificates?
EAP-TLS
What is a health check that is executed in the hosts memory and CPU but it is not installed?
Dissolvable agent
What type of attack against HTTPS forces the service to negotiate weak ciphers?
A downgrade attack
What protocol replaced Telnet?
SSH
What does the DNSSEC (DNS) depend on?
Chain of trust from the root server
Give an example of a SIEM and what it does.
Splunk, Microsoft Sentinel, LogRhythm.
They collect, organize security events, and help respond to them in the correct priority by severeness.
What attack framework gives descriptions of specific TTPs
MITREs ATTACK Framework
What are indications of an injection attack?
% percent encoding. (EXAMPLE: Access logs with repeating requests for URLs with %3C, %3E
Forcing requests from the front end to be authenticated prevents what type of attack?
Serverside Request Forgery
Give an example of capabilities that may be included in password management.
Salting, hashing, reset methods
What are some potential issues with automation and orchestration?
Complexity , single point of failure, cost, support
When getting insurance what is the risk mitigation option called?
Risk Transference
What is a risk register?
a document that is used as a risk management tool to identify potential setbacks within a project
What legal contract is a non-binding agreement that outlines intentions shared goals, general cooperation?
Memorandum of understanding (MOU)
What legal document establishes clear guidelines?
Rules of Engagement
What type of data protection is used by payment processing systems?
Tokenization
