Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + > Review Topics > Flashcards

Review Topics Flashcards

Review topics that were missed on practice exams or topics that need more practice

1
Q

a technique used to learn information about a computer system on a network and the services running on its open ports

A

Banner Grabbing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

type of injection in which malicious scripts are injected into otherwise benign and trusted websites

A

Cross-Site Scripting (XSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

occurs when the outcome from execution processes is directly dependent on the order and timing of certain events. Those events fail to execute in the order and timing intended by the developer

A

Race Condition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

a symmetric block cipher with a fixed block size of 128 bits. It can utilize a 128-bit, 192-bit, or 256-bit symmetric key

A

Advanced Encryption Standard (AES)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

provides security as a service (SECaaS)

A

managed security service provider (MSSP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

one of the first public-key cryptosystems and is widely used for secure data transmission. As a public-key cryptosystem, it relies on an asymmetric algorithm

A

RSA (Rivest–Shamir–Adleman)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program

A

Fuzzing or fuzz testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

modification of DAC that provides a set of organizational roles that users may be assigned to gain access rights

A

Role-based access control (RBAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

provides the most detailed and explicit type of access control over a resource because it is capable of making access decisions based on a combination of subject and object attributes, as well as context-sensitive or system-wide attributes

A

Attribute-based access control (ABAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

sends specially crafted packets to the target host(s) and then analyzes the responses to determine the open ports and services running on those hosts. Also can determine the versions of the applications being used on those ports and services

A

Nmap

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

a command-line utility that displays network connections for incoming and outgoing TCP packets, routing tables, and some network interface and network protocol statistics

A

Netstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

the process of extracting user names, machine names, network resources, shares, and services from a system

A

Enumeration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

describes how much risk an organization is willing to accept

A

Risk appetite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

a symmetric-key algorithm for encrypting digital data. Although its short key length of 56 bits makes it too insecure for applications, it was the standard used from 1977 until the early 2000s

A

Data Encryption Standard (DES)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

occurs when an attacker sends a ping to a subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing power

A

smurf attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The access control policy is determined by the owner. Every object in a system must have an owner and each owner determines access rights and permissions for each object

A

Discretionary Access Control (DAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An access control policy where the computer system determines the access control for an object. To access something, you need to meet the minimum level and
have a “need-to-know”

A

Mandatory Access Control (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Label-based access control that defines whether access should be granted or denied to objects by comparing the object label and the subject label

A

Rule-based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Utilizes complex mathematics to create sets of objects and

subjects to define how they interact

A

Lattice-based Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An access model that is dynamic and context-aware using IF-THEN
statements

A

Attribute-Based Access Control (ABAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An access model that is controlled by the system but
utilizes a set of permissions instead of a single data label to define
the permission level

A

Role-Based Access Control (RBAC)

22
Q

Encryption algorithm which uses three separate symmetric keys to
encrypt, decrypt, then encrypt the plaintext into ciphertext in order to
increase the strength of DES

A

Triple DES (3DES)

23
Q

Symmetric block cipher which uses 64-bit blocks to encrypt plaintext into ciphertext

A

International Data Encryption Algorithm (IDEA)

24
Q

Symmetric block cipher that uses 128-bit, 192-bit, or 256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext

A

Advanced Encryption Standard (AES)

25
Q

Symmetric block cipher that uses 64-bit blocks and a variable length encryption key to encrypt plaintext into ciphertext

A

Blowfish

26
Q

Symmetric block cipher that replaced blowfish and uses 128-bit blocks
and a 128-bit, 192-bit, or 256-bit encryption key to encrypt plaintext into
ciphertext

A

Twofish

27
Q

Symmetric stream cipher using a variable key size from 40-bits to 2048-bits that is used in SSL and WEP

A

Rivest Cipher (RC4)

28
Q

Symmetric block cipher with a key size up to 2048-bits

A

Rivest Cipher (RC5)

29
Q

Symmetric block cipher that was introduced as a replacement for DES but
AES was chosen instead

A

Rivest Cipher (RC6)

30
Q

Asymmetric algorithm used to conduct key exchanges and secure key distribution over an unsecured network. Used for the establishment of a VPN tunnel using IPSec

A

Diffie-Hellman (DH)

31
Q

Asymmetric algorithm that relies on the mathematical difficulty of factoring large prime numbers. widely used for key exchange, encryption, and digital signatures and can use key sizes of 1024-bits to 4096-bits

A

RSA (Rivest, Shamir, and Adleman)

32
Q

Algorithm that is based upon the algebraic structure of elliptic curves over finite fields to define the keys. with a 256-bit key is just as secure as RSA with a 2048-bit key. most commonly used for mobile devices and low-power computing device

A

Elliptic Curve Cryptography (ECC)

33
Q

An encryption program used for signing, encrypting, and decrypting emails. The IDEA algorithm is used by this encryption program.

A

Pretty Good Privacy (PGP)

34
Q

A newer and updated version of the PGP encryption suite that uses AES
for its symmetric encryption functions

A

GNU Privacy Guard (GPG)

35
Q

A simulated random number stream generated by a computer that is used in
cryptography, video games, and more

A

Pseudo-Random Number Generator (PRNG)

36
Q

The science and art of hiding messages within other messages

A

Steganography

37
Q

A standard designed to regulate the transfer of secure public information across networks and the Internet utilizing any security tools and services available

A

Open Vulnerability and Assessment Language (OVAL)

38
Q

A function that converts an arbitrary length string input to a fixed length string
output

A

Hash

39
Q

A cryptographic hashing algorithm created to address possible weaknesses in the
older MD5 hashing algorithm. Uses a 160-bit hash digest, but isn’t considered strong

A

Secure Hash Algorithm 1 (SHA-1)

40
Q

A cryptographic hashing algorithm created to address possible weaknesses in the
older MD5 hashing algorithm. Uses a 256-bit or 512-bit hash digest and is the current version in used in modern forensics

A

Secure Hash Algorithm 2 (SHA-2)

41
Q

Uses a 128-bit hash digest, but is susceptible to collisions should only be used as a second-factor of integrity checking.

A

Message Digest Algorithm (MD5)

42
Q

Technique used by an attacker to find two different messages that have
the same identical hash digest

A

Birthday Attack

43
Q

An entire system of hardware, software, policies, procedures, and people that is
based on asymmetric encryption

A

Public Key Infrastructure (PKI)

44
Q

Cost associated with the realization of each individualized threat
that occurs

A

Single Loss Expectancy (SLE)

45
Q

Single Loss Expectancy (SLE) Formula

A

Asset Value x Exposure Factor

46
Q

Number of times per year that a threat is realized

A

Annualized Rate of Occurrence (ARO)

47
Q

Expected cost of a realized threat over a given year

A

Annualized Loss Expectancy (ALE)

48
Q

Annualized Loss Expectancy (ALE) Formula

A

SLE x ARO

49
Q

Relies on the physical characteristics of a person to identify them

A

Biometrics

50
Q

Rate that a system authenticates a user as authorized or valid when they should not have been granted access to the system

A

False Acceptance Rate (FAR)

51
Q

Rate that a system denies a user as authorized or valid when they should
have been granted access to the system

A

False Rejection Rate (FRR)

52
Q

measures the effectiveness of a biometric system

A

Crossover Error Rate (CER)

Security + (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions