Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec+ > Sec Two > Flashcards

Sec Two Flashcards

1
Q

What is a use case?

A

A goal that an organization wants to achieve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is confidentiality?

A

ensuring data is only viewable by authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is steganography

A

hiding data inside other data, such as hiding messages inside a picture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is integrity?

A

ensuring that data has not been modified, tampered with, or corrupted through unauthorized or unintended changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is non-repudiation?

A

prevents entities from denying they took an action

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is availability?

A

Ensuring data and services are available when needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is risk?

A

the possibility of a threat exploiting a vulnerability and resulting in loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a threat?

A

any circumstance or event that has the potential to compromise CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a vulnerability?

A

a weakness in hardware, software, configuration, or users operating the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is risk mitigation?

A

Reduces risk by reducing the chances that a threat will exploit a vulnerability or reducing impact of the risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are security controls

A

things that reduce risk, such as antivirus software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 primary security control types

A

technical (implemented w/ tech)
administrative (implemented w/ admin or management methods)
physical (controls you can physically touch)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are preventive controls

A

controls that attempt to prevent security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are detective controls?

A

controls that attempt to detect when a vulnerability has been exploited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are corrective controls

A

controls that attempt to reverse the impact of an incident after it has occurred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are deterrent controls

A

controls that attempt to prevent incidents by discouraging threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what are compensating controls

A

alternative controls used when it isn’t feasible to use a primary control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what is authentication

A

allows entities to prove their identity by using credentials known to another entity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is identification

A

occurs when a user claims or professes an identity with username, email, PIV, biometrics, etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the five factors of authentication?

A

something you know (username/password)
something you have (smart card, token)
something you are (fingerprint, retina scan)
somewhere you are (geolocation, MAC address)
something you do (gestures)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the open source standards used for one-time passwords?

A

HOTP - creates OTP that doesn’t expire

TOTP - creates OTP that expires after 30 seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are FAR, FRR, and CER in regards to biometrics?

A

FAR - false acceptance rate (false positive match)
FRR - false rejection rate (false negative match)
CER - crossover error rate (the point on a sensitivity vs. rate graph where FAR and FRR cross - indicates quality of biometric system)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is kerberos?

A

network authentication protocol using tickets issued by KDC or TGT server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is LDAP?

A

specifies formats and methods to query directories such as Active Directory. LDAPS encrypts transmissions with SSL or TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is SAML?

A

an XML based standard used to exchange authentication and authorization info between parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

what is a federated identity?

A

links a user’s credentials from different networks or OSs, but treats it as one identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is shibboleth?

A

open source federated identity solution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

what is OAuth and OpenID Connect?

A

commonly used authentication solutions allowing users to log on to many web sites with another account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the general account management best practices?

A
  • Least privilege
  • No account sharing
  • Admin should have 2 accounts (one non-admin account)
  • Account disablement policy for users that leave
  • routinely delete accounts that are no longer needed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are common access control models?

A

role-BAC (RBAC) - grants access based on user roles such as jobs, functions, or assigned tasks

  • rule-BAC (RBAC) - grants access based on approved instructions such as rules triggered in response to detected attack
  • discretionary (DAC) - every object has an owner, that owner can determine everyone else’s access - major flaw is susceptibility to trojan horses
  • Mandatory access control (MAC) - uses sensitivity labels to identify objects and users, users with matching labels can access
  • attribute-based (ABAC) evaluates attributes and grants access based on the value of the attributes. often used in software-defined networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which protocols are used for voice and video?

A

Real time transport protocol (RTP) and secure real time transport protocol (SRTP) - SRTP provides encryption, message authentication, and integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What protocol is commonly used to transfer files over networks?

A

File transfer protocol (FTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the encryption protocols used to encrypt data-in-transit?

A

File Transfer Protocol Secure (FTPS - uses TLS)
Secure File Transfer Protocol (SFTP - uses SSH)
Secure Shell (SSH)
Secure Socket Layer (SSL - Deprecated)
Transport Layer Security (TLS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What port does SMTP use to send mail?

A

TCP 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What port does POP3 use to receive mail?

A

TCP 110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What port does IMAP4 use?

A

TCP 143

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What port does Secure POP use?

A

995 (legacy) or with STARTTLS on port 110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What port does IMAP use TLS?

A

port 993 (Legacy) or with STARTTLS on port 143

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What port does HTTP use?

A

80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

what port does HTTPS use?

A

443

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What port does LDAP use?

A

TCP 389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What port does LDAP secure use?

A

TCP 636

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What port does RDP use?

A

TCP 3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What do admins typically use to remote into systems?

A

SSH or RDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does network time protocol (NTP) do?

A

provides time synchronization services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What does DNS zone A records contain?

A

IPv4 addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What do DNS zone AAAA records contain?

A

IPv6 addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How is DNS Zone data updated?

A

zone transfers and secure zone transfers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What port does DNS use?

A

TCP 53 for zone transfers and UDP 53 for DNS Client queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the purpose of DNSSEC?

A

provides validatin for DNS responses and helps prevent DNS poisoning attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What are the command line commands for querying DNS?

A

nslookup (windows) and dig (Linux)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

what does the axfr switch do?

A

download all zone data from DNS server, unless it is blocked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What do switches do?

A

map MAC addresses to physical ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are two examples of port security?

A

limiting number of MAC addresses per port, and disabling unused ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

what is an aggregation switch?

A

connects multiple switches together in a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What do routers do?

A

connect networks and direct traffic based on the destination IP address

use rules within access control lists (ACLs) to allow or block traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is implicit deny?

A

indicates that unless something is explicitly allowed, it is denied. it is the last rule in an ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What do network-based firewalls do?

A

filter traffic in and out of a network

placed on border of network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is a stateless firewall?

A

controls traffic between networks using rules within an ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is a stateful firewall?

A

filters traffic based on the state of a packet within a session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is a web application firewall?

A

protects a web server against web application attacks. Typically placed in the DMZ and alerts admins of suspicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is a demilitarized zone (DMZ)?

A

provides a layer of protection for servers that are accessible from the internet
typically sits between two different firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is an intranet?

A

an internal network used to communicate and share content with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

what is an extranet?

A

part of a network that can be accessed by authorized entities from outside the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is NAT?

A

translates public IP addresses to private IP addresses and vice versa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What is an airgap?

A

a metaphor for physical isolation, indicating a system or network is completely isolated from another system or network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are forward proxy servers?

A

forward requests for services from a client

can cache and record users’ internet activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a transparent vs nontransparent proxy server?

A

transparent accepts and forwards requests without modifying them
nontransparent can modify or filter requests, such as filtering based on the URL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is a reverse proxy server?

A

proxy server which accepts traffic from the internet and forwards it to one or more internal servers, then returns the result to the requester

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a UTM?

A

unified threat management. a security appliance which includes multiple layers of protection, such as URL filters, content inspection, malware inspection, and DDoS mitigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is a mail gateway?

A

gateway placed between an email server and the internet. examines and analyzes all traffic and can block unsolicited email. may include data loss prevention (DLP) and encryption capabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is loop protection?

A

protects against switching loop problems, such as when a user connects two switch ports together with a cable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

what protocol protects against loops?

A

Spanning Tree Protocol (STP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

what are flood guards?

A

prevent MAC flood attacks on switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What are VLANs

A

logically separated computers or logically grouped computers regardless of their physical location. can be created with layer 3 switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What network device has antispoofing capabilities?

A

router using rules within ACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is SNMPv3?

A

used to monitor and configure network devices and uses notification messages known as traps. Uses strong authentication mechanisms and uses UDP ports 161 and 162

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Which network device can Linux iptables be configured to replaces?

A

firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What are IDSs and IDPs?

A

intrusion detection systems and intrusion prevention systems

inspect traffic using the same functionality as a protocol analyzer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What’s the difference between HIDS and NIDS?

A

HIDS can detect attacks on local systems and protect local resources on the host. Can also detect some malware not detected by traditional antivirus

NIDS detects attacks on the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

How do signature-based IDS/IPS work?

A

uses a signatures to detect known attacks or vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

How do heuristic-based or behavioural IDSs work?

A

require a baseline and detect attacks based on anomalies or when traffic is outside of expected boundaries compared to the baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

What’s the difference between an IPS and an active IDS?

A

IPS is placed inline with traffic while an active IDS is out of band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What is a SSL/TLS accelerator?

A

dedicated hardware device that handles TLS traffic, allowing other devices to offload TLS traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

What is an SSL decryptor?

A

allows an organization to inspect traffic, even when traffic is using SSL or TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

What is a software defined network?

A

(SDN) uses virtualization tech to route traffic instead of using hardware routers or switches. separates the data and control planes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What are honeypots/honeynets?

A

servers that appear to have valuable data in an attempt to divert attackers from live networks. honeynet is a group of honeypots that looks like a full network

can also be used to observe current attack methodologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is an 802.1x server?

A

provides strong port security using port-based authentication. prevents rogue devices from connecting to a network by ensuring only authorized clients can connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What’s difference between fat AP and thin AP?

A

fat AP has everything needed to connect wireless clients to wireless network.

thin AP is controller-based. multiple thin APs are typically configured and managed by one controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What is a weakness of MAC filtering?

A

attackers can easily discover authorized MACs and spoof an authorized MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

how do directional antennas differ from omnidirectional antennas?

A

they have narrower beams and longer ranges

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What is an ad hoc wireless network?

A

network set up between two or more devices connected together without an AP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

what encryption protocol does WPA use?

A

TKIP (temporal key integrity protocol)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

what encryption protocol does WPA2 use?

A

counter mode cipher block chaining message authentication code protocol (CCMP) which is based on AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

what protocol do 802.1x servers use?

A

one of the extensible authentication protocol (EAP) versions such as Protected EAP (PEAP), EAP Tunneled TLS (EAP-TTLS), EAP-TLS, or EAP-Flexible Authentication via Secure Tunneling (EAP-FAST)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Which EAP version is most secure?

A

EAP-TLS - requires a certificate on the server and each of the wireless clients

PEAP and EAP-TTLS only require certificate on the server
PEAP is often implemented with MS-CHAPv2
LEAP is proprietary to Cisco and does not require a certificate. EAP-FAST replaces LEAP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What is a captive portal?

A

forces wireless clients to complete a process such as acknowledging a policy or paying for access before being granted access to the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What is a dissociation attack?

A

effectively removes a wireless client from a wireless network, forcing it to reauthenticate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

What is WPS?

A

allows users to set up a WAP to allow access by pressing a button or entering a short PIN. WPS PINs can be discovered within hours and are not secure. The PIN can then be used to discover the passphrase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

What is a rogue AP?

A

an AP placed within a network without official authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

what is an evil twin?

A

a rogue AP with the same SSID as a legitimate access point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What is a jamming attack?

A

floods a wireless frequency with noise, blocking wireless traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

what is an IV attack?

A

initialization vector attack. Attempts to discover the IV and uses it to discover the passphrase. WPA2 isn’t susceptible to an IV attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

What is an NFC attack?

A

near field communication attack. uses an NFC reader to read data from mobile devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What is bluejacking?

A

the practice of sending unsolicited messages to a phone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

What is bluesnarfing?

A

the unauthorized access to, or theft of information from, a bluetooth device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

What is a wireless replay attack?

A

an attacker captures data sent between two entities, modifies it, and then impersonates one of the parties by replaying the data. WPA2 using CCMP and AES prevents wireless replay attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

What is RFID attack?

A

radio frequency identification attack. includes eavesdropping, replay, and DoS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

What is a vpn?

A

provides secure access to private networks via a public network, such as the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

What are VPN concentrators?

A

dedicated devices that provide secure remote access to remote users

111
Q

what is IPsec?

A

a common tunneling protocol used with VPNs. Secures traffic within a tunnel. provides authentication with an Authentication Header (AH). Encapsulating security payload (ESP) encrypts traffic and provides CIA

112
Q

What are differences between IPsec tunnel mode and transport mode?

A

tunnel mode encrypts the entire IP packet used in the internal network.

Transport mode only encrypts the payload and is commonly used in private networks, but not with VPNs

113
Q

What are differences between full tunnel and split tunnel?

A

full tunnel encrypts all traffic after a user has connected to a VPN.

Split tunnel encrypts only traffic destined for the VPNs private network

114
Q

what are site-to-site VPNS

A

provide secure access between two networks. Can be on-demand or always-on VPNs

115
Q

What is NAC?

A

network access control. inspects clients for specific health conditions such as up to date antivirus, and can redirect unhealthy clients to a remediation or quarantine network

116
Q

what are differences between permanent NAC agent and dissolvable NAC agent?

A

permanent is installed on client and stays on clinet

dissolvable is downloaded and run, then deleted when the session ends. commonly used for BYOD devices

117
Q

when is remote access authentication used?

A

when a user accesses a private network from a remote location, such as with a VPN

118
Q

What is PAP?

A

password authentication protocol. uses password or PIN for authentication. weakest authentication protocol because it sends passwords as cleartext

119
Q

what is CHAP?

A

challenge handshake authentication protocol. mroe secure than PAP and uses a handshake process when authenticating clients

120
Q

What is MS-CHAP and MS-CHAPv2?

A

microsoft versions of CHAP. CHAPv2 provides mutual authentication

121
Q

What is RADIUS?

A

provides central authentication for multiple remote access services. relies on the use of shared secrets and only encrypts the PW during authentication procses. uses UDP

122
Q

What is TACACS+?

A

used by some Cisco systems as an alternative to RADSIUS. uses TCP, encrypts the entire authentication process, and supports multiple challenges and responses

123
Q

What is Diameter?

A

an improvement over RADIUS. uses TCP, encrypts the entire authentication process, and supports many additional capabilities

124
Q

What are AAA protocols?

A

protocols when provide authentication, authorization, and accounting. examples include RADIUS, TACACS+, and Diameter

125
Q

What is least functionality?

A

core system design principle stating that systems should only be deployed with the applications, services, and protocols needed to function

126
Q

What is a trusted OS?

A

one which meets a set of predetermined requirements such as those defined in the Common Criteria

127
Q

What is a master image?

A

a secure starting point for systems, created with a template or other baseline

128
Q

What is patch management?

A

procedures which ensure OS’s and applications are kept up to date with current patches to ensure protection against known vulnerabilities

129
Q

What is sandboxing?

A

creating virtual machines or using chroot(on linux) to test security controls and patches in an isolated environment

130
Q

What is EMI?

A

electromagentic interference. comes from sources such as motors, power lines, and flourescent lights, and can be prevented with shielding

131
Q

What is EMP?

A

electromagnetic pulse. a short burst of electromagnetic energy

132
Q

What is FDE?

A

full disk encryption. encrypts an entire disk

133
Q

What is SED?

A

self-encrypting drive. includes hardware and software necessary to automatically encrypt a drive

134
Q

What is a TPM?

A

Trusted Platform Module. A chip included in many laptops and mobile devices that provides full disk encryption, a secure boot process, and supports remote attestation. Have an encryption key burned into them that provides hardware root of trust

135
Q

What is an HSM?

A

hardware security module. kind of like a removable TPM. generates and stores RSA encryption keys and can be integrated with servers to provide hardware based encryption

136
Q

What is a CASB?

A

cloud access security broker. A software tool or service deployed between an organization’s network and cloud provider. Monitors all network traffic and can enforce security policies acting as Security as a Service

137
Q

What is COPE?

A

corporate-owned, personally enabled. Refers to mobile devices owned by the organization but used by an employee for personal use

138
Q

What is CYOD?

A

choose your own device. employer provides a list of acceptable devices and allows employees with one of those devices to connect to the network

139
Q

What is VDI in regards to mobile devices?

A

virtual desktop infrastructure. provides a virtual desktop that users can access from their mobile devices

140
Q

What is MDM?

A

mobile device management. Tools which help ensure that devices meet minimum security requirements. Can monitor devices, enforce security policies, and block network access if req’s/policies are not met. Can restrict apps on devices, segment nad encrypt data, enforce strong authentication methods, and implement securtiy methods such as screen lock and remote wipe

141
Q

What is a SCADA?

A

supervisory control and data acquisition system. controls an industrial control system (ICS) typically used in large facilities like power plants or water treatment facilities. Should be in isolated networks without access to the internet, and sometimes are protected by NIPS

142
Q

What is an RTOS?

A

real-time operating system. OS which reacts to input within a specific time

143
Q

how is data encrypted within a database?

A

individual columns, entire database, individual files, entire disks, and removable media

144
Q

what are the primary methods of protecting the confidentiality of data?

A

encryption and strong access controls

145
Q

which command is used on Linux to change permissions?

A

chmod

146
Q

What is data exfiltration?

A

unauthorized transfer of data outside an organization

147
Q

What is DLP?

A

data loss prevention. techniques and technologies which help prevent data loss. Can block transfer of data to USB devices and analyze outgoing data via email to detect unauthorized transfers

148
Q

Define viruses vs worms vs trojans

A

virus: malicious code that attaches itself to a host application. Host app must be executed for the virus to run. Virus tries to replicate by finding other host applications to infect with the code. payload is typically damaging, deleting files, causing random reboots, join computer to botnet, or enable backdoors.

Worm: self-replicating malware that travels without the assistance of a host application. Resides in memory and uses different transport protocols to travel the network. consume network bandwidth and can replicate hundreds of times to spread all over network

trojan: looks like something beneficial but is actually malicious. often delivered via drive-by downloads

149
Q

what is a logic bomb

A

string of code embedded into an app or script that will execute in response to an event.

150
Q

What is a RAT?

A

remote access trojan. allows attackers to take control of systems from remote locations. often delivered via drive-by downloads

151
Q

what is a rootkit?

A

malware with system-level or kernel access and can modify system files and system access. hide their running processes to avoid detection with hooking techniques. tools that can inspect RAM can discover these hooked processes

152
Q

what is hooking, with regards to rootkits?

A

intercepting system-level function calls, events, or messages in order to control the system’s behaviour

153
Q

what is a waterin hole attack?

A

attempts to discover which web sites a group of people are likely to visit and then infects those websites with malware

154
Q

what is Vishing?

A

phishing using the phone system to trick users into giving up personal and financial information

155
Q

What’s the difference between DoS and DDoS?

A

DoS is an attack from a single source

DDoS attacks include multiple computers attacking a single target and are typically sustained abnormally high network traffic

156
Q

What are two common types of spoofing?

A

MAC address and IP address

157
Q

What is a SYN flood attack?

A

attacker sends a flood of SYN packets but never returns a SYN/ACK packet in response to the ACK packet, leaving the full TCP session unistablished and the server with multiple half-open connections

158
Q

What is one way to prevent a MITM attack?

A

Kerberos using mutual authentication

159
Q

How can ARP poisoning be used in a DoS attack?

A

attacker sends ARP reply with a bogus MAC address for the default gateway. without the correct default gateway address, traffic can never leave the network

160
Q

what is a pharming attack?

A

manipulates the DNS process. tries to corrupt the DNS server or the DNS client. redirects users to a different site.

161
Q

what is an amplification attack?

A

a type of DDoS attack. typically uses a method that significantly increases the amount of traffic sent to or requested from a victim.

162
Q

What is a smurf attack?

A

spoofs the source address of a directed broadcast ping packet to flood a victim with ping replies

163
Q

what are two effective counter measure against replay attacks?

A

timestamps and sequence numbers

164
Q

what is session hijacking?

A

attackers hijack session ID from cookies and impersonate the user

165
Q

what is domain hijacking?

A

attacker changes the registration of a domain name without permission from the owner

166
Q

What is a man-in-the-browser attack?

A

a proxy trojan horse that infects vulnerable web browsers. can capture browser session data, including keyloggers to captures keystrokes, and all data sent to and from web browser

167
Q

what is driver manipulation?

A

attackers can create shims or rewrite internal code to fool the OS into using a manipulated driver instead of the real driver

168
Q

What is a memory leak?

A

bug in a computer app that causes app to consume more and more memory the longer it runs. can eventually cause system crash.

169
Q

What is integer overflow?

A

attack attempts to use or create a numeric value that is too big for an application to handle resulting in inaccurate results

170
Q

what is a DLL injection?

A

an attack that injects a DLL into a system’s memory and causes it to run

171
Q

What is XSRF/CSRF?

A

cross-site request forger. An attack where an attacker tricks a user into performing an action on a web site

172
Q

what is a framework?

A

a structure used to provide a foundation. in cybersecurity, they typically use a structure of basic concepts and provide guidance to professionals on how to implement security in various systems

173
Q

What are regulatory frameworks?

A

frameworks based on relevant laws and regulations such as HIPAA

174
Q

What are non-regulatory frameworks?

A

frameworks not required by law, but typically identify common standards and best practices that orgs can follow such as COBIT (control objectives for information related technologies)

175
Q

what is a hash collision?

A

when two different passwords produce the same hash. occurs with weak hashing algorithms

176
Q

What is a birthday attack?

A

when an attacker tries to produce a password that produces the same hash as the real password

177
Q

what is password salting?

A

adding additional characters to passwords before hashing them to prevent many types of attacks, including dictionary, brute force, and rainbow table attacks

178
Q

what is a driver shim?

A

additional code that can be run instead of the original driver

179
Q

what is code signing?

A

using a digital signature within a certificate to authenticate and validate software code

180
Q

At a minimum, where should input validation occur?

A

server side.

Client side can be used as well, but can be bypassed, so server side is better

181
Q

What is quantitative risk assessment?

A

measures the risk using a specific monetary amount, making it easier to prioritize risks

182
Q

What is SLE?

A

single loss expectancy. the cost of any single loss

183
Q

what is ARO?

A

annual rate of occurrence. indicates how many times the loss will occur in a year

184
Q

What is ALE?

A

annual loss expectancy. the value of SLE * ARO

185
Q

what is qualitative risk assessment?

A

uses judgment to categorize risks based on likelihood of occurrence

186
Q

what is a risk register?

A

a record of information about identified risks, or a repository for all risks identified and includes additional information abotu each risk

187
Q

What is a supply chain assessment?

A

evaluating the raw materials supply sources and all the processes required to create, sell, and distribute a product

188
Q

what is network mapping?

A

discovering devices on the network and how they are connected to each other

often done as part of a network scan, but a full network scan also includes identifying open ports, running services, and OS details

189
Q

What is banner grabbing?

A

a technique used to gain information about remote systems and is used by many network scanners

often used to identify the OS along w/ information about some applications

190
Q

What are some common vulnerabilities and misconfigurations that can be discovered by a vulnerability scanner?

A 
open ports
weak passwords
default accounts and passwords
sensitive data
security and configuration errors
191
Q

what is passive reconnaissance?

A

collecting information about a targeted system, network, or organization using open-source intelligence such as social media, news, or an org’s website or from passively collecting info from a network such as SSIDs

192
Q

what is active reconnaissance?

A

includes using tools to send data to systems and analyzing the responses

193
Q

What is tcpdump?

A

command-line packet analyzing (protocol analyzer) allowing you to capture packets like with Wireshark, but for Linux

194
Q

What is nmap?

A

a network scanner. its graphical counterpart is zenmap. can identify all active hosts and IP addresses in a network, the protocols and services running on each, and the OS

Has switches Tx (x = 0 through 5, with 0 being slowest and 5 being fastest); -A (indicates the scan should include OS detection, version detection, script scanning, and traceroute); and -v, indicating the verbosity level. can get more data with -vv or -vvv

195
Q

What is netcat?

A

can be used for remotely accessing Linux systems. doesn’t include native encryption but can be used with SSH. can be used for banner grabbing; transferring files; port scanning

196
Q

what are some common Linux logs to view?

A
  • var/log/messages (contains general system messags)
  • var/log/boot.log (log entries created when the system boots)
  • var/log/auth.log (authentication log of logins)
  • var/log/kern.log (information logged by system kernel)
  • var/log/faillog (information on failed login attempts
  • var/log/httpd/ (if system is an apache server, this shows error logs)
  • utmp (info on current status of system, such as who is logged in)
  • wtmp (archive of utmp file)
  • btmp (reords failed login attempts)
197
Q

what is SIEM?

A

security information and event management system.

provides a centralized solution for collecting, analyzing, and managing data from multiple sources

can be used to aggregate and correlate logs

198
Q

which type of scan results in fewer false positives?

A

credentialed scan, because it allowed the scan to see more information

199
Q

how does humidity affect electrical equipment?

A

high humidity can cause condensation on the equipment, causing water damage. low humidity allows a higher incidence of ESD

200
Q

define the different levels of RAID

A

RAID-0 (striping only. requires at least 2 disks. increased R/W speed)

RAID-1 (Mirroring ony. uses at least 2 disks. provides redundency)

RAID-5 and 6 (5 requires 3 or more disks. provides striping similar to 0, but also includes parity for fault tolerance. one drive can fail and the data is not lost. 6 is an extension of 5 with an extra parity block. can recover even if 2 drives fail, but requires min of 4 disks)

RAID-10 (Mirroring and Striping. min of 4 drives.

201
Q

what is a failover cluster?

A

two or more servers in a cluster configuration. at least one is active and at least one is inactive. if one fails, the inactive can take over without interruption

202
Q

What is a load balancer?

A

optimizes and distributes data loads across multiple computers or networks. can be hardware or software

203
Q

what are the different types of backups?

A

full backup (backs up all the selected data)

differential backup (all data that has changed or is different since last full backup)

incremental backup (backs up all data that has changed since the last full OR incremental backup)

snapshots (captures the data at a point in time)

204
Q

What is RTO?

A

recovery time objective. The max amount of time it should take to restore a system after an outage

205
Q

what is RPO?

A

recovery point objective. refers to the amount of data you can afford to lose

206
Q

what is MTBF?

A

mean time between failures. the average time between failures

207
Q

what is MTTR?

A

mean time to recover. average time it takes to restore a failed system.

208
Q

what is DRP?

A

disaster recovery plan. includes a hierarchical list of critical systems and often prioritizes services to restore after an outage

209
Q

what is affinity?

A

load spreading technique in which users are directed to servers based on their IP

210
Q

What are some common hashing algorithms?

A

MD5 an SHA

211
Q

what size hash does MD5 produce?

A

128 bits - MD5 is considered cracked and is now only used for verifying file integrity

212
Q

what size of hashes can SHA create?

A

SHA-1: 160 bit

SHA-2 & 3: 224, 256, 384, and 512 bit

213
Q

What is HMAC?

A

hash-based message authentication code.

a fixed-length string of bits similar to those from hashing algorithms. however, it also uses a shared secret key to add some randomness to the result and only the sender and receiver know the secret key

provides integrity through hashing, and authenticity by using the secret key

often used by IPsec and TLS

HMAC-MD5 creates 128 bit hashes
HMAC-SHA1 creates 160 bit hashes

214
Q

What is RIPEMD?

A

RACE integrity primitives evaluation message digest.

Another hash function used for integrity, but not widely used. can create 128, 160, 256, and 320 bit hashes

215
Q

what is key stretching?

A

a technique used to increase the strength of stored passwords and can help thwart brute force and rainbow table attacks

salts passwords with additional random bits to make them more complex

two common techniques are bcrypt and Password-Based Key Derivation Function 2 (PBKDF2)

216
Q

what is bcrypt?

A

a key stretching technique based on the Blowfish block cipher. used on Unix and Linux distributions to protect passwords.

217
Q

What is PBKDF2?

A

a key stretching technique that uses salt of at least 64 bits and uses a pseudo-random function such as HMAC.

used by WPA2, iOS, and Cisco OSs, among others. Hash size can be 128, 256, or 512, most commonly

218
Q

what is an initialization vector?

A

IV

starting value for cryptographic algorithm. fixed size random or pseudorandom number that helps create random encryption keys

219
Q

what is XOR?

A

logical operation used in some encryption schemes. compares two inputs. outputs false if they are they same, true if they are the different

220
Q

what are confusion and diffusion in regards to encryption?

A

confusion: ciphertext is significantly different than plaintext
diffusion: ensures that small changes in plaintext result in large changes in ciphertext

221
Q

what is resiliency?

A

the security of an encryption key even if an attacker discovers part of the key

222
Q

what’s the difference between stream and block ciphers?

A

stream encrypt bit by bit and are more efficient when encrypting data in a continuous stream such as video or audio.
block encrypt data in specific sized block and are more efficient when the size of data is known

223
Q

what are the different cipher modes used for block ciphers?

A

ECB: electronic codebook (simplest cipher mode. divide plaintext into blocks and encrypt each block using the same key)
CBC: Cipher Block Chaining (uses an IV for randomization when encrypting the first block. then combines each subsequent block with previous block using an XOR operation. sometimes less efficient due to pipeline delays)
CTM: counter mode (converts a block cipher into a stream cipher. combines an IV with a counter and uses the result to encrypt each plaintext block. runs faster on multiprocessor or multicore systems. widely used and respected as a secure mode)
GCM: Galois/Counter mode (combines counter mode with Galois mode. doesn’t authenticate users or systems, but provides integrity and confidentiality. includes hashing techniques for integrity)

224
Q

what is symmetric encryption?

A

uses same key to encrypt and decrypt data

225
Q

what is AES?

A

advanced encryption standard. strong symmetric block cipher that uses 128 bit blocks

can use 128, 192, or 256 bit keys

226
Q

what is DES?

A

data encryption standard. symmetric block cipher that was widely used dating back to the 70s. encrypts data in 64 bit blocks. uses 56 bit key. not used today

227
Q

what is 3DES?

A

triple DES. a symmetric block cipher designed as an improvement over DES. encrypts data using DES in 3 separate passes and uses multiple keys. still uses 64 bit blocks. can use keys of 56, 112, or 168 bits

228
Q

what is RC4?

A

Rivest Cipher. symmetric stream cipher using between 40 and 2,048 bits.

it is speculated that agencies such as NSA can break RC4, so it is recommended to disable RC4 and use AES instead.

229
Q

What are Blowfish and Twofish?

A

blowfish: strong symmetric block cipher encrypting 64-bit blocks and supporting keys between 32 and 448 bits. still widely used today and actually faster than AES in some instances.
twofish: related to blowfish, but encrypts in 128 bit blocks and supports 128, 192, or 256 bit keys

230
Q

what is asymmetric encryption?

A

uses two different keys, a public and a private key, to encrypt and decrypt data

231
Q

what is a certificate?

A

a digital document that typically includes the public key and information on the owner of the certificate

232
Q

what is RSA?

A

Rivest, Shamir, Adleman. asymmetric encryption method widely used due to its strong security. recommended key sizes of 2,048 bits through 2030, 3,072 bits for beyond 2030

233
Q

what are the two primary categories of asymmetric keys?

A

static: semitransparent and stays the same over long periods of time
ephemeral: has a very short lifetime and is re-created for each session

234
Q

what is ECC?

A

elliptic curve cryptography. doesn’t take as much processing power as other cryptographic methods. often used with small wireless devices. formulates an elliptical curve, then graphs points on the curve to create keys

235
Q

what is DH?

A

diffie-hellman. key exchange algorithm used to privately share a symmetric key between two parties. supports both static and ephemeral keys.

RSA is based on DH using static keys

DHE uses ephemeral keys with a new key each session.

ECDHE uses ephemeral keys generated using ECC

236
Q

Which key encrypts/decrypts in email digital signatures?

A

senders private key encrypts, sender’s public key decrypts

237
Q

Which key encrypts/decrypts in email encryption?

A

recipients public key encrypts, recipients private key decrypts

238
Q

which key encrypts/decrypts in web site encryption?

A

web site’s public key encrypts, web site’s private key decrypts, the symmetric key encrypts data in the web site session

239
Q

what is a digital signatures?

A

encrypted hash of a message. sender’s private key encrypts the hash of the message and the recipient decrypts the hash with the sender’s public key. if successful, it provides authentication, non-repudiation, and integrity

240
Q

what is S/MIME?

A

secure/multipurpose internet mail extensions. standard used to digitally sign/encrypt email. uses RSA for asymmetric encryption and AES for symmetric.

241
Q

what is PGP/GPG?

A

pretty good privacy. method used to secure email communication. can encrypt, decrypt, and digitally sign email.
GPG is GNU Privacy Guard, based on OpenPGP standard
uses RSA algorithm and public/private keys for encrytion/decryption

242
Q

what is a crypto module?

A

a set of hardware, software, and/or firmware that implements cryptographic functions including encryption, hashing, key gen, and authentication techniques

243
Q

what is a crypto service provider?

A

a software library of cryptographic standards and algorithms. typically distributed within crypto modules

244
Q

what is a downgrade attack?

A

an attack which forces a system to downgrade its security. the attacker then exploits the lesser security control. to prevent this, admins should disable weak cipher suites and weak protocols on servers

245
Q

what is a root certificate?

A

the first certificate created by the CA that identifies it. if the root certificate is placed in the root CA store, all certificates issued by the CA are trusted

246
Q

what is a CSR

A

certificate signing request. a request sent to CA including the purpose of the certificate, info on the web site, public key, and the requester. CA validates the request and creates the certificate. first step in CSR is to create the RSA-based private key, which is used to create the public key included in the request

247
Q

what is CRL?

A

certificate revocation list. ncludes a list of revoked certificates and is publicly available.

248
Q

what is an alternate to using the CRL?

A

the Online Certificate Status Protocol (OCSP) which returns answers such as good, revoked, or unknown. OCSP stapling appends a digitally signed OCSP response to a certificate.

249
Q

what is public key pinning?

A

a security mechanism designed to prevent attackers from impersonating a web site using fraudulent certificates.

web server sends a list of public key hashes that clients can use to validate certificates sent to clients in subsequent sessions

250
Q

what is key escrow?

A

the process of placing a copy of a private key in a safe environment.

useful for recovery. if original is lost, organization retrieves a copy of the key to access data

in some cases, a copy of the key is provided to a 3rd party

251
Q

what is a recovery agent?

A

a designated individual who can recover or restore cryptographic keys

252
Q

what is a wildcard certificate?

A

starts with an asterisk and can be sued for multiple domains, but each domain must have the same root domain. for example, *.google.com may be used for all google domains

253
Q

what is a SAN?

A

subject alternative name. used for multiple domains that have different names but are owned by the same org.

254
Q

what are the different certificate formats?

A

CER: .cer extension, ASCII format, used for ASCII certificates
DER: .der extension, binary format, used for binary certificates
PEM: .pem, .cer, .crt, .key; used for binary or ASCII formats, can be used for almost any certificate purpose, can contain server certificates, certificate chains, keys, CRL
P7B: .p7b, .p7c; used to share public key in ASCII format. never holds private key
P12/PFX: .p12, .pfx; commonly used to store private keys in binary format

255
Q

what is a security policy?

A

written documents that lay out a security plan within a company

256
Q

what is an acceptable use policy?

A

defines proper system usage or the rules of behaviour for employees when using IT systems

257
Q

what is the purpose of mandatory vacation?

A

help detect when employees are involved in malicious activity such as fraud or embezzlement

258
Q

what is separation of duties?

A

a principle that prevents any single person or entity from being able to complete all the functions of a critical or sensitive process

259
Q

what are job rotation policies?

A

require employees to change roles on a regular basis to help ensure that employees cannot continue with fraudulent activity indefinitely

260
Q

what is a clean desk policy?

A

directs users to keep their areas organized and free of papers in order to reduce threats of security incidents by ensuring the protection of sensitive data

261
Q

what is an ISA?

A

interconnection security agreement. specifies technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entities

262
Q

What is an SLA?

A

service level agreement. agreement between a company and a vendor that stipulates performance expectations

263
Q

What is a MOU/MOA?

A

memorandum of agreement/understanding. expresses an understanding between two or more parties indicating their intention to work together toward a common goal. often supports an ISA

264
Q

what is a BPA?

A

business partners agreement. a written agreement that details the relationship between business partners including their obligation towards the partnership

265
Q

what is purging?

A

general sanitization term indicating that all sensitive data has been removed from a device

266
Q

what is HIPAA?

A

mandates that organizations protect PHI

267
Q

What is GLBA?

A

Gramm-Leach Bliley Act. also known as Financial Services Modernization Act and includes a Financial Privacy Rule. requires financial institutions to provide consumers with a privacy notice explaining what information they collect and how it is used

268
Q

What is SOX?

A

Sarbanes-Oxley Act. requires that executives within an organization take individual responsibility for the accuracy of financial reports

269
Q

What is GDPR?

A

General Data Protection Regulation. EU directive mandating the protection of privacy data for individuals within the EU

270
Q

what are the common phases of the IRP (incident response plan)?

A
  • Preparation: occurs before an incident, provides guidance to personnel on how to respond
  • Identification: verify that a reported incident is an actual security incident
  • Containment: attempt to isolate or contain the incident through quarantine or removing the device from the network
  • Eradication: remove components of the attack such as installed malware, or deleting/disabling compromised accounts
  • Recover: return all affected systems to normal ops and verify they are operating normally. may include rebuilding systems from images, restoring data from backups, etc.
  • Lessons learned: review the incident for possible lessons learned for future incidents
271
Q

what is the order of volatility?

A

the order in which you should collect evidence. the order from most volatile to least is:

  • data in cache memory including processor and HDD
  • data in RAM including system and network processes
  • A paging file on the system disk
  • data stored on local disk drives
  • logs stored on remote systems
  • archive media
272
Q

which authentication method uses x.500 based phrases to identify components?

A

LDAP

273
Q

which type of firewall can also provide load balancing?

A

web app firewall (WAF)

274
Q

what typically includes data loss prevention capabilities for email and is placed between an email server and the internet?

A

mail gateway

Sec+ (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions