Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Comptia SEC+ > Section 3.2 Host and Application Security Solutions > Flashcards

Section 3.2 Host and Application Security Solutions Flashcards

1
Q

Where should endpoint detection be focused?

A

Throughout the entire network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What monitors network activity for suspicious behavior and alerts if anything is found?

A

Intrusion Detection Systems (IDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What monitors network activity and attempts to deal with the issue and either disconnects suspicious connections or turn off attacked services?

A

Intrusion Prevention Systems (IPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What monitors network patterns and headers of network patches?

A

Network Intrusion Detection systems (NIDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What component of NIDS collect network data and sends it to the network monitor for analysis?

A

Detection Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What component of NIDS takes data from the detection agent, analyzes it, and sends warning notifications?

A

Network Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What component of NIDS is used for notifications and alarms which are sent to the administrator?

A

Notification system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IDS’s are usually located where on the network?

A

A central point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What mode of IDS deployment analyzes all traffic?

A

In-band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What mode of IDS deployment only analyzes some of the traffic?

A

Out-of-band

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do you call a NIDS that uses active detection methods to take immediate steps to halt an intrusion?

A

NIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What prevention system reroutes network traffic in case of network attacks and terminates suspicious network activity?

A

NIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a disadvantage of active detection systems?

A

False positives can shut down the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What kind of intrusion detection takes steps to mitigate an intrusion?

A

Active Intrusion Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What kind of intrusion detection typically logs the event or generates alarms?

A

Passive Intrusion Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What do you call a deep-packet inspection firewall that moves beyond port/protocol inspection and blocking?

A

Next Generation Firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What kind of monitoring systems contain signature databases that they use to detect attacks?

A

Signature-Based Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What kind of monitoring systems rely on the collective knowledge of security vendors but are unable to detect new attacks that haven’t been recorded?

A

Signature-Based Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What kind of monitoring systems use a known good baseline and looks for anomolies?

A

Behavior/Anomaly-Based Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What kind of monitoring systems are easily and quickly adapted to the environment and can detect new variants of attacks but take time to build a baseline profile?

A

Behavior/Anomaly-Based Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What kind of monitoring systems starts with an initial database of known attack types but changes its alert signatures based on learned behavior?

A

Heuristic-Based Monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What do you call a type of attack that has rarely or never been encountered and takes advantage of previously unknown weaknesses and vulnerabilities in a software program or operating system?

A

A zero-day attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What kind of monitoring systems relies on admin to create rules and determine consequences for breaking those rules?

A

Rule-based monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What kind of monitoring systems require significant manual set-up and continuous updating?

A

Rule-based monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What detection system monitors a specific host for suspicious behavior that could indicate someone is trying to break into the system?

A

Host-based Intrusion Detection System (HIDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What detection system can detect an attack by a malicious user who is physically accessing the system console?

A

Host-based Intrusion Detection System (HIDS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an integrated endpoint security solution that combines: REAL-TIME continuous monitoring and collection of endpoint data with rules-based AUTOMATED RESPONSE AND ANALYSIS capabilities?

A

Endpoint Detection and Response (EDR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What solutions keep sensitive data from leaving a network by a USB, email, etc.?

A

Data Loss Prevention Solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What solutions tag data with labels that say whether data can leave the network and how it can leave the network?

A

Data Loss Preventions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What protects both the computers and the networks to which they connect as well as provide a first level of defense to prevent virus spreading?

A

Antivirus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Most viruses and spyware enter a system how?

A

through email attachments and internet downloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What kind of firewall performs critical functions to protect a user’s host computer?

A

Host-based firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What part of the host system contains the program code and instructions for starting a computer and loading the OS?

A

Basic Input/Output System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What do you call maintaining the BIOS of of a host system?

A

Boot Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Modern systems use what to boot because it is more secure and is needed for a secure boot of the OS?

A

Unified Extensible Firmware Interface (UEFI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What uses an unchangeable piece of hardware that contains cryptographic function keys, and verifies that BIOS is being loaded from a known good version?

A

Hardware Root of Trust

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What do you call adding a suffix of random characters to a password before it is encrypted?

A

Salting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What creates a ‘unique fingerprint’ for a message?

A

Hashing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What prevents someone who gains unauthorized access to a database from being able to read the data without an encryption key?

A

Database Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What makes sure that when applications are deployed, they don’t contain security issues that can expose sensitive data?

A

Secure coding practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What do you call the surrounding infrastructure that supports software applications?

A

Data Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What manages and provisions data centers through machine readable files instead of the physical hardware?

A

Infrastructure as Code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What do you call the small text files saved on your computer to store website data?

A

Cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What kind of cookies only transmit over secure channels?

A

Secure cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What disallow connections through HTTP and protects against attacks?

A

HTTP Strict Transport Security (HSTS) headers

46
Q

HTTP request and response messages have what that include various HTTP commands, directives, site referral information, and address data?

A

Headers

47
Q

What kind of analysis is conducted by executing software on a real or virtual processer to determine how the software will behave in a potentially negative environment?

A

Dynamic code analysis

48
Q

What refers to the process of coding applications to accept only certain valid input for user-entered fields?

A

Input Validation

49
Q

What determines how the software should react to error conditions and exceptions?

A

Error and Exception handling

50
Q

What recognizes specific types of command characters and parses them as simple data rather than executing the text as a command?

A

Escaping

51
Q

What do you call the use of existing source code for a new purpose, either for a new program or for a new environment?

A

Code Reuse

52
Q

What do you call saved subroutines that can be used within applications accessing databases, saving time and memory by combining the execution of several statements into one stored procedure?

A

stored procedures

53
Q

What prevents unauthorized applications from executing by checking each potential execution against a list of applications that have been granted execution rights?

A

Allow list

54
Q

What concept refers to keeping the OS and applications current through regular updates and critical software patches and removing unnecessary software services from the system?

A

Operating system hardening

55
Q

What do you call an OS that has met a set of standards such as the Common Criteria?

A

Trusted OS

56
Q

OS vendors regularly release software updates, which are often rolled into larger software packages called?

A

service packs, updates, or packages

57
Q

User interaction with external Internet users can result in viruses or Trojans being downloaded that allow what to the users computer?

A

Backdoor access

58
Q

To protect against the use of backdoor access, the network admin should do what to these programs on the main network firewall to keep them from communicating with the Internet?

A

block the service ports

59
Q

All software on the workstation should be kept current with what to remove security vulnerabilities from previous versions?

A

Most recent patches and upgrades

60
Q

What disallows the ability to execute code from memory locations that are reserved for Windows and other known to be good programs?

A

Data Execution Prevention (DEP)

61
Q

What do you call a special hardware chip that provides authentication by storing security mechanisms that are specific to that system hardware?

A

TPM

62
Q

What do you call a specialized hardware appliance used to provide onboard cryptographic functions and processing?

A

Hardware Security Module

63
Q

What should be used to secure access to the data of removable media?

A

Encryption and Authentication

64
Q

What is used to open email attachments or other high risk files in an environment that will be less harmful if they do indeed turn out to be malicious?

A

Sandboxing

65
Q

What do you use to protect hosts and applications against a wide variety of malware programs?

A

Antivirus and Anti-malware software

66
Q

What protects web applications by filtering and monitoring HTTP traffic between a web application and the internet?

A

Firewalls

67
Q

What should be used to protect the data of mobile devices?

A

passwords and encryption

68
Q

What should be used to establish a strong, secure foundation for your OS, applications, and web browsers for all your systems, including mobile devices?

A

security baselines and policies

69
Q

What should be used to make sure hackers cannot insert malformed input or command requests in application input forms?

A

Input Validation

70
Q

What should you do to special characters and command characters so that they are processed as data, not actual commands?

A

Use Escaping

71
Q

What should not be displayed in error messages?

A

filename and directory paths

72
Q

What should applications handle without crashing or providing unauthorized access?

A

exceptions

73
Q

What concepts should be used to prevent confidential data loss and interception?

A

DLP concepts

74
Q

What should be used for secure storage of encryption keys and certificates for hardware platforms?

A

TPM’s

75
Q

What are used for high-end security applications that require secure key generation and management on a separate hardware appliance?

A

HSM’s

76
Q

What can secure data in storage on a database server?

A

Database Encryption

77
Q

What is a software program designed to detect and destroy viruses and other malicious software from the system?

A

Antivirus

78
Q

What is a program that protects the system from all kinds of malware including viruses, Trojans, worms, and PUPs?

A

Antimalware

78
Q

What typically protects web applications from common attacks like XSS, CSRF, and SQL Injections?

A

Firewalls

79
Q

What kind of firewall is an application that is built into desktop operating systems, like Windows or Linux?

A

Host-based firewall

80
Q

What two types of firewalls are often used together in a layered defense?

A

Host-based and Network-based

81
Q

What do you call a boot where all components from the firmware, applications, and software are measured and information is stored on a log file?

A

Measured Boot

82
Q

In a measured boot where is the log file stored?

A

on the TPM chip on the motherboard

83
Q

What kind of boot is performed at startup where the OS checks that all of the drivers have been signed?

A

Trusted secure Boot

84
Q

What is it called where during the software integrity is confirmed during the boot process?

A

Boot attestation

85
Q

What is deemed more secure than encryption because it cannot be reversed?

A

Tokenization

86
Q

What is used to index and fetch items from a database?

A

Hashing

87
Q

What function maps data to where the actual records are held?

A

Hash function

88
Q

What renders rainbow tables ineffective?

A

Salting

89
Q

What ensures buffer overflow, integer overflow, and SQL injection attacks cannot be launched against applications and databases?

A

Input validation

90
Q

What can be stolen by attackers to carry out a session hijacking attack?

A

Secure cookies

91
Q

What can help prevent an attacker from carrying out a cross-site scripting attack through HTTP response headers?

A

HTTP Strict Transport Security headers

92
Q

What uses a certificate to digitally sign scripts and executables to verify their authenticity and to confirm they are genuine?

A

Code Signing

93
Q

What do you call it when the developer who creates software writes code in a manner that ensures that there are no bugs or flaws?

A

Secure Coding Practices

94
Q

What concepts intent is to prevent attacks such as buffer overflow or integer injection during code development?

A

Secure Coding Practices

95
Q

What do you call analysis where the code is not executed locally but is analyzed by a static code analyzer tool?

A

Static Code analysis

96
Q

What is the process of running source code inside the tool that reports any flaws or weaknesses?

A

Static code analysis

97
Q

What kind of analysis requires source code access?

A

Static code analysis

98
Q

What do you call analysis where the code is executed and fuzzing is used to inject random input into the application?

A

Dynamic code analysis

99
Q

What kind of analysis exposes flaws in an application before it is rolled out to production?

A

Dynamic code analysis

100
Q

What kind of analysis does not require source code access?

A

Dynamic code analysis

101
Q

What is it called when code is reviewed line by line to ensure that the code is well-written and error free? It tends to be tedious and time consuming,

A

Manual Code Review

102
Q

What is the hardening process of open ports and services?

A

listening ports should be restricted to those necessary, filtered to restrict traffic, and disabled entirely if unneeded. (Block through firewalls, disable by disabling underlying service)

103
Q

What is the hardening process of the registry?

A

access should be restricted, and updates should be controlled through policy where available (always make a backup first)

104
Q

What should be used to prevent unwanted access to data in a variety of circumstances?

A

Drive encryption

105
Q

What is the hardening process of the OS?

A

OS hardening can often be implemented through security baselines, applied through group policies or management tools

106
Q

What kind of device encrypts anything that is written to that drive?

A

Self-encrypting Drive

107
Q

What is used for key storage when certificates are used in Full Disk Encryption?

A

Hardware root of trust

108
Q

What verifies that the keys match before the secure boot process takes place?

A

Hardware root of trust

109
Q

What is often used as the basis for a hardware root of trust?

A

TPM

110
Q

What provides the OS with access to keys, but prevents drive removal and data access?

A

TPM

Comptia SEC+ (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions