SEC+

Question 1

802.1x

Answer 1

A port-based authentication protocol. Wireless can use 802.1x. For example, WPA2 Enterprise mode uses an 802.1x server (implemented as a RADIUS server). Enterprise mode requires an 802.1x server. PEAP and EAP-TTLS require a certificate on the 802.1x server. EAP-TLS also uses TLS, but it requires certificates on both the 802.1x server and each of the clients.

Question 2

3DES

Answer 2

Triple Digital Encryption Standard. A symmetric algorithm used to encrypt data and provide confidentiality. It is a block cypher that encrypts data in a 64-bit blocks. It was originally designed as a replacement for DES, and is still used in some applications, such as when hardware doesn’t support AES.

Question 3

AAA

Answer 3

Authentication, Authorization, and Accounting. AAA protocols are used in remote access systems. For example, TACACS+ is an AAA protocol that uses multiple challenges and responses during a session. Authentication verifies a user’s identification. Authorization determines if a user should have access. Accounting tracks a user’s access with logs.

Question 4

ACE

Answer 4

Access Control Entry. Identifies a user or group that is granted permission to a resource. AECs are contained within a DACL in NTFS.

Question 5

ACK

Answer 5

Acknowledge. A packet in a TCP handshake. In a SYN flood attack, attackers send the SYN packet, but don’t complete the handshake after receiving the SUN/ACK packet.

Question 6

ACL

Answer 6

Access Control List. Routers and packet-filtering firewalls perform basic filtering using an ACL to control traffic based on networks, subnets, IP addresses, ports, and some protocols. In NTFS, a list of ACEs makes up the ACL for a resource.

Question 7

AES

Answer 7

Advanced Encryption Standards. A symmetric algorithm used to encrypt data and provide confidentiality. AES is a block cipher and it encrypts data in 128-bit blocks. It is quick, highly secure, and used in a wide assortment of cryptography schemes. It includes key sizes of 128 bits, 192 bits, or 256 bits.

Question 8

AES-256

Answer 8

Advanced Encryption Standard 256 bit. AES sometimes includes the number of bits used in the encryption keys and AES-256 uses 256-bit encryption keys. Interestingly, Blowfish is quicker than AES-256.

Question 9

AH

Answer 9

Authentication Header. IPsec includes both AH and ESP. AH provides authentication and integrity using HMAC. ESP provides confidentiality, integrity, and authentication using HMAC, and AES or 3DES. AH is identified with protocol ID number 51.

Question 10

ALE

Answer 10

Annual (or annualized) Loss Expectancy. The ALE identifies the expected annual loss and is used to measure risk with ARO and SLE in a quantitative risk assessment. The calculation is SLE x ARO = ALE.

Question 11

AP

Answer 11

Access Point, short for Wireless Access Point (WAP). APs provides access to a wired network to wireless clients. Many APs support Isolation mode to segment wireless users form other wireless users.

Question 12

API

Answer 12

Application Programming Interface. A software module or component that identifies inputs and outputs for an application.

Question 13

APT

Answer 13

Advanced Persistent Threat. A group that has both the capability and intent to launch sophisticated and targeted attacks.

Question 14

ARO

Answer 14

Annual (or annualized) rate of occurrence. The ARO identifies how many times a loss is expected to occur in a year and it is used to measure risk with ALE and SLE in a quantitative risk assessment. The calculation is
SLE x ARO = ALE.

Question 15

ARP

Answer 15

Address Resolution Protocol. Resolves IPv4 addresses to MAC addresses. ARP poisoning attacks can redirect traffic through an attacker’s system by sending false MAC address updates. NDP is used with IPv6 instead of ARP.

Question 16

ASCII

Answer 16

American Standard Code for Information Interchange. Code used to display characters.

Question 17

ASP

Answer 17

Application Service Provider. Provides an application as a service over a network.

Question 18

AUP

Answer 18

Acceptable Use Policy. An AUP defines proper system usage. It will often describe the purpose of computer systems and networks, how users can access them, and the responsibilities of users when accessing the system.

Question 19

BAC

Answer 19

Business Availability Center. An application that shows availability and performance of applications used or provided by a business.

Question 20

BCP

Answer 20

Business Continuity Plan. A plan that helps an organization predict and plan for potential outages of critical services or functions. It includes disaster recovery elements that provide the steps used to return critical functions to operation after an outage. A BIA is a part of a BCP and the BIA drives decisions to create redundancies such as failover clusters to alternate sites.