Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security Plus Finals > Sec + Finals > Flashcards

Sec + Finals Flashcards

0
Q

What is a decentralized open source FIM that does not require specific software to be installed on the desktop?

A

OpenID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

What is using one authentication credential to access multiple accounts or applications

A

Single Sign On (SSO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is using a single authentic credential that is shared across multiple networks

A

Identity Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Federal Identity Management (FIM)?

A

When multiple networks are owned by different organizations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which Single Sign On (SSO) relies on tokens?

A

OAuth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the name given to a wireless technology that uses short range radio frequency transmissions and provides for rapid ad hoc device pairings?

A

Bluetooth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Personal Area Network (PAN)?

A

Technology designed for data communications over short distances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the two types of Bluetooth network topologies?

A

Piconet and Scatternet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which Bluetooth topology is it when two Bluetooth devices come within range of each other, they automatically connect with one another?

A

Piconet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A group of piconets in which connections exists between different piconets is called a?

A

Scatternet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the two Bluetooth attacks?

A

Bluejacking and bluesnarfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which Bluetooth attack is it that sends unsolicited messages to Bluetooth enabled devices but is considered more annoying than normal because no data is stolen?

A

Bluejacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which Bluetooth attack is an attack that accesses unauthorized information from a wireless device through a Bluetooth connection, often between cell phones and laptop computers?

A

Bluesnarfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the most common type of Authentication Services?

A

RADIUS (does not encrypt)
Kerberos (tickets)
TACACS (Unix)
LDAP (big phone book)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which Authentication service is suitable for what are called “high volume service control expectations” such as dial-in access to a corporate network?

A

Remote Authentication Dial In User Service (RADIUS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which authentication service client is typically a device such as a wireless access point (ap) or dial-up server that is responsible for sending user credentials and connections in the form of a RADIUS message to a RADIUS server?

A

RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which authentication system utilizes a ticket?

A

Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which authentication device is commonly used on Unix devices?

A

Terminal Access Control Access Control System (TACACS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which authentication service is referred to the big phone book since it works as a directory service and sometimes called X.500?

A

Lightweight Directory Access Protocol (LDAP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the attack that can occur when user input is not properly filtered?

A

LDAP injection attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the defense against LDAP injection attacks?

A

Examine all user input before processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the two categories of symmetric algorithms?

A

Stream Cipher

Block Cipher

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is stream cipher?

A

Takes one character and replaces it with another character

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is block cipher?

A

Manipulates an entire block of plaintext at one time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the three protections in information security?

A

Confidentiality
Integrity
Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Ensures that only authorized parties can view the information

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Ensures that the information is correct and no unauthorized person or malicious software has altered the data

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Ensures that the data is accessible to authorized users

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the steps of risk management?

A 
Asset identification 
Threat identification 
Vulnerability appraisal
Risk assessment 
Risk mitigation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A standard network device for connection multiple Ethernet devices together by using twisted-pair copper or fiber-optic cables in order to make them function as a single network segment?

A

Hub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What layer in the OSI model is the hub?

A

Layer 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A device that connects network segments

A

Switch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What layer in the OSI model is the switch

A

Layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Network device that can forward packets across computer networks

A

Router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What layer in the OSI model is the router?

A

Layer 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Granting or denying approval to use specific resources

A

Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Duties in access control:

Determines the level of security needed for the data and delegates security duties as required

A

Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Duties in access control:

Periodically reviews security settings and maintains records of access by end users

A

Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Duties in access control:

Follows organizations security guidelines and does not attempt to circumvent security

A

End user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the two basic types of fingerprint scanners?

A

Static fingerprint scanner

Dynamic fingerprint scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What scanner requires the user to place the entire thumb or finger on a small oval window on the scanner?

A

Static fingerprint scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What scanner has a small slit or opening?

A

Dynamic fingerprint scanner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What has no encryption when voice protocol is used?

A

IP Telephony

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

This layer is to send the signal to the network or receive the signal from the network

A

Layer 1

Physical Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

The function of this layer involves with encoding and signaling, data transmission, and reception

A

Later 1

Physical Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

This layer is responsible for dividing the data into packets; includes error detection and correction

A

Layer 2

Data Link Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

The function of this layer performs physical addressing, data framing, error detection, and handling

A

Layer 2

Data Link Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

This layer picks the route the packet is to take, and handles the addressing of the packets for delivery

A

Layer 3

Network Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

The function of this layer makes logical addressing, routing, fragmentation, and reassembly available

A

Layer 3

Network Layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are the two basic types of Intrusion Detection System (IDS)?

A

HIDS and NIDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What intrusion detection system is a software based application that runs on a local host computer that can detect an attack as it occurs?

A

Host Intrusion Detection System (HIDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What intrusion detection system watches for attacks on the network?

A

Network intrusion detection system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the (5) steps for securing the Operating System (OS)?

A

1) develop the security policy
2) perform host software baselining
3) configure operating system and settings
4) deploy the settings
5) implement patch management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is sending an email or displaying a web announcement that falsely claims to be from a legitimate enterprise in an attempt to trick the user into surrendering private information?

A

Phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What phishing attack automatically redirects the user to the fake site?

A

Pharming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What phishing attack targets only specific users?

A

Spear phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What phishing attack targets wealthy individuals?

A

Whaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What phishing attack uses telephone call instead of emails?

A

Vishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What are the three categories of authorization credentials?

A

1) what a user has (token or card)
2) what a user is (biometrics)
3) what a user knows (passwords)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Computer typically located in an area with limited security and loaded with software and data files that appear to be authentic, yet they are actually imitations of real data files

A

Honeypot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Software that enters a computer system without the user’s knowledge or consent and then performs an unwanted and usually harmful action

A

Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the two types of malware that have the primary objective of spreading

A

Viruses and worms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

A malicious computer code that, like it’s biological counterpart, reproduces itself on the same computer

A

Computer virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What are the different types of computer viruses?

A
  • program virus
  • macro virus
  • boot virus
  • comparison virus
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Malicious program designed to take advantage of a vulnerability in a application or an operating system in order to enter a computer

A

Worm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

An executable program advertised as performing one activity but actually does something else

A

Trojan horse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Set of software tools used by an attacker to hide actions or presence of other types of malicious software

A

Rootkit

67
Q

Computer code that lies dormant until it is triggered by a specific logical event

A

Logic bomb

68
Q

Software code that gives access to a program or service that circumvents any normal security protection

A

Backdoors

69
Q

General term used to describe software that spies on users by gathering information without consent, thus violating their privacy

A

Spyware

70
Q

Software program that delivers advertising content in a manner that is unexpected and unwanted by the user

A

Adware

71
Q

Captures and stores each keystroke that a user types on the computers keyboard

A

Keyloggers

72
Q

Technique that allows private IP addresses to be used on the public internet

A

Network Address Translation (NAT)

73
Q

Examines the current state of a system or network device before it is allowed to connect to the network

A

Network Access Control (NAC)

74
Q

Functions as a separate network that rests outside the secure network perimeter; untrusted outside users can access but cannot enter the secure network

A

Demilitarized Zone (DMZ)

75
Q

Allows scattered users to be logically grouped together even though they may be attached to different switches

A

VLAN

76
Q

Refers to any combination of hardware and software that enables remote users to access a local internal network

A

Remote access

77
Q

Targets SQL servers by injecting commands

A

SQL injections

78
Q

Attack that injects XLM tags and data into a database

A

XML injection

79
Q

Similar to SQL injection attacks can occur when user input is not properly filtered

A

LDAP injection attacks

80
Q

Difference between symmetric and asymmetric algorithms

A

Symmetric does CIA

Asymmetric does CIA and Authenticity and Nonrepudiation

81
Q

Steps for basic forensic procedures

A

1) Secure crime scene
2) collect the evidence
3) establish a chain of custody
4) examine the evidence

82
Q

System that provide and regulate heating and cooling for data centers

A

HVAC

83
Q

A defense for shielding electromagnetic field

A

Faraday cage

84
Q

Form of eavesdropping in which special equipment is used to pick up telecommunication signals or data within a computer device by monitoring the electromagnetic fields

A

Van Eck phreaking

85
Q

In order for a fire to occur, four entities must be present

A
  • fuel
  • oxygen
  • heat
  • reaction
86
Q

Copying information to a different medium and storing it

A

Data backups

87
Q

Starting point for all backups

A

Full backups

88
Q

Backs up any data that has changed since last full backup

A

Differential backup

89
Q

Backs up any data that has changed since last full backup or last incremental backup

A

Incremental backup

90
Q

Defined as the maximum length of time that any organization can tolerate between backups

A

Recovery Point Objective (RPO)

91
Q

The length of time it will take to recover the data that has been backed up

A

Recovery Time Objective (RTO)

92
Q

What are the different port states?

A
  • Open
  • Closed
  • Blocked
93
Q

Application or service assigned to that port is listening for instructions

A

Open Port

94
Q

No process is listening at this port

A

Closed Port

95
Q

The host system does not reply to any inquiries to this port number

A

Blocked port

96
Q

Process of inventorying item that has positive economic value

A

Asset identification

97
Q

Determining the potential threats against the assets that come from any agents

A

Threat evaluation

98
Q

Determining the current weakness in assets

A

Vulnerability appraisal

99
Q

Determining the damage that would result from an attack and the likelihood that the vulnerability is a risk to the organization

A

Risk assessment

100
Q

Deciding what to do with the risk

A

Risk mitigation

101
Q

Symmetric encryption is also called

A

Private key cryptography

102
Q

This stream cipher simply substitutes one letter or character for another

A

Substitution cipher

103
Q

This stream cipher rearranges letters without changing them

A

Transposition cipher

104
Q

Block cipher that divides plaintext into 64-bit blocks and then executes the algorithm 16 times

A

Data Encryption Standard (DES)

105
Q

Uses three rounds of encryption instead of one

A

Triple Data Encryption Standard (3DES)

106
Q

Set of algorithms set up by Ron Rivest

A

Rivest Cipher (RC)

107
Q

Stream of cipher that accepts keys up to 128 bits in length

A

RC4

108
Q

Asymmetric cryptographic algorithms are also known as

A

Public key cryptography

109
Q

Is known to everyone and can be freely distributed

A

Public Key

110
Q

Is known only to the individual whom it belongs to

A

Private key

111
Q

Electronic verification of the sender

A

Digital signature

112
Q

Most common asymmetric cryptography algorithm

A

RSA

113
Q

Cryptology that uses sloping curves

A

Elliptic Curve Cryptography (ECC)

114
Q

Attempts to use the unusual and unique behavior of microscopic object to enable users to securely develop and share keys as well as to detect eaves dropping

A

Quantum cryptography

115
Q

Uses lattice based cryptography

A

NTRUEncrypt

116
Q

Unsolicited email

A

Spam

117
Q

Variation of spam that targets instead messaging

A

Spim

118
Q

False warning, often contained in an email message claiming to come from IT Department

A

Hoax

119
Q

Attack that injects scripts into a web application server that will then direct attacks at clients

A

Cross-Site Scripting (XSS)

120
Q

Uses the server as a platform to launch attacks on the other computers that access it

A

Cross-Site Scripting (XSS)

121
Q

An XSS attack requires a website to meet what two criteria

A

1) accepts user input without validating it

2) uses that input in an response without encoding it

122
Q

Attack that targets vulnerabilities in client applications that interact with a compromised server or process malicious data

A

Client-side attack

123
Q

Example of an attack:

A users computer becoming compromised just by viewing a web page and not even clicking any content.

A

Drive-by download

124
Q

When an attacker modifies the header

A

HTTP headed manipulation

125
Q

Part of a HTTP packet that is composed of fields that contain the different characteristics of the data being transmitted

A

HTTP header

126
Q

Specific directory on a web servers file system

A

Root directory

127
Q

Programs that provide additional functionality to web browsers

A

Add-ons

128
Q

A random string assigned to that session

A

Session token

129
Q

An attack in which an attacker attempts to impersonate the user by using their session token

A

Session hijacking

130
Q

Occurs when a process attempts to store data in RAM beyond of the fixed length storage buffer

A

Buffer overflow

131
Q

Attacks attempts to prevent system from performing it’s normal functions

A

Denial of service (DoS)

132
Q

Attack uses the Internet Control Message Protocol (ICMP) which is a layer protocol that is part of the Transmission Control Protocol/Internet Protocol (TCP/IP) to flood a victim with packets

A

Ping flood

133
Q

Uses hundreds or thousands of zombie computers in a botnet to flood a device with requests

A

distributed denial of service (DDoS)

134
Q

Attack by intercepting legitimate communication and forging a fictitious response to the sender

A

Man-in-the-middle

135
Q

Makes a copy of the transmission before sending it to the recipient

A

Replay

136
Q

An attacker could modify the MAC address in the ARP cache so that the corresponding IP address points to a different computer

A

ARP poisoning

137
Q

Substitutes DNS addresses so that the computer is automatically redirected to another device

A

DNS poisoning

138
Q

Exploiting a vulnerability in software to gain access to resources that the user would normally be restricted from obtaining

A

Privilege escalation

139
Q

Attack using third party to gain access rights

A

Transitive access

140
Q

Privilege that are granted to users to access hardware and software resources

A

Access rights

141
Q

Different ways to control risk

A
  • privilege management
  • change management
  • incident management
142
Q

The process of assigning and revoking privileges to objects; that is, it covers the procedures of managing object authorization

A

Privilege management

143
Q

Enhanced type of server digital signature

A

Extended validation SSL certificate (EV SSL)

144
Q

Most widely accepted format for digital signatures

A

X.509

145
Q

The framework for all of the entities involved in digital certificates for digital certificate management -including hardware, software, people, policies, and procedures-to create, store, distribute, and revoke digital certificates

A

Public Key Infrastructure (PKI)

146
Q

Refers to the type of trusting relationship that can exist between individuals or entities

A

Trust model

147
Q

Assigns a single hierarchy with one master CA called the root

A

Hierarchal trust model

148
Q

Class 1 digital certificate

A

Personal Digital Certificate

149
Q

Class 2 Digital Certificate

A

Server Digital Certificates

150
Q

Class 3 digital certificate

A

Software digital certificate

151
Q

Trust model with one CA that acts as a facilitator to interconnect all other CA’s

A

Bridge Trust Model

152
Q

Trusted third party agency that is responsible for issuing the digital certificates

A

Certificate Authority (CA)

153
Q

Protocol that guarantees privacy and data integrity between applications communicating over the internet

A

Transport Layer Security (TLS)

154
Q

An encrypted alternative to the Telnet protocol that is used to access remote computers

A

Secure Shell (SSH)

155
Q

Set of protocols developed to support the secure exchange of packets. Because it operates at a low level in the OSI model, considered to be a transparent security protocol

A

IPsec

156
Q

What are the two encryption modes IPsec supports

A

Transport and tunnel

-transport mode encrypts only the data portion

157
Q

Two or more servers that are interconnected to appear as one

A

Server cluster

158
Q

A standby server exists only to take over for another server in the event of failure

A

Asymmetric server cluster

159
Q

Every server in the cluster performs useful work. If one server fails, the remaining servers continue to perform their normal work as well as that of the failed server

A

Symmetric server cluster

160
Q

Uses multiple hard drives for increased reliability and performance

A

RAID

161
Q

Striped desk array so the data is broken down into blocks and each block is written to a separate disk

A

RAID Level 0

162
Q

Data written to separate drives

A

RAID Level 1

163
Q

Each entire data block is written on a data disk and parity for blocks in the same rank as generated and recorded on a separate disk

A

RAID Level 5

164
Q

A mirrored array whose segments are RAID 0 arrays

A

RAID Level 0+1

Security Plus Finals (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions