Security+ Flashcards
1
Q
A server that acts as a central repository of all the user accounts and their associated passwords for the network
A
Domain Controller
2
Q
Occurs when an attacker modifies the host file to have the client bypass the DNS server and redirects them to an incorrect or malicious website
A
Altered Hosts File
3
Q
Certain operations that should only be performed once or not at all, such as initializing a memory location
A
Atomic Execution
4
Q
A multi-platform log management tool that helps to easily identify security risks, policy breaches or analyze operational problems in server logs, operation system logs and application logs
A
nxlog - nxlog is a cross-platform, open-source tool that is similar to rsyslog or syslog-ng
5
Q
Process where each user’s rights and permissions are revalidated to ensure they are correct
A
User Access Recertification
6
Q
Conducted between two business partners that establishes the
conditions of their relationship
A
Business Partnership Agreement (BPA)
7
Q
Fire suppression system that relies upon gas (HALON, FM-200, or CO2) instead of water to extinguish a fire
A
Clean Agent System - If you hear a loud alarm in the server room… GET OUT!
8
Q
A one-way cryptographic function which takes an input and produces a unique message digest
A
Hash - Instantly match integrity and hashing on the exam
9
Q
A tool to transfer data from or to a server, using one of the supported protocols (HTTP, HTTPS, FTP, FTPS, SCP, SFTP, TFTP, DICT, TELNET, LDAP, FILE)
A
[curl]
10
Q
The access control policy is determined by the owner
A
Discretionary Access Control (DAC)
1. Every object in a system must have an owner
2. Each owner determines access rights and permissions for each
object
11
Q
Malware is placed on a website that you know your potential victims will access
A
Watering Holes
12
Q
A senior (executive) role with ultimate responsibility for maintaining the confidentiality, integrity and availability of the information asset
A
Data Owner - The data owner is responsible for labeling the asset and ensuring that it is protected with appropriate controls
13
Q
Cloud Threats - Insecure Application Programming Interface (API)
A
An API must only be used over an encrypted channel (HTTPS). Data received by an API must pass service-side validation routines. Implement throttling/rate-limiting mechanisms to protect from a DoS
14
Q
Occurs when an attacker is able to execute or run commands
on a remote computer
A
Remote Code Execution (RCE)
15
Q
A communications network designed to implement an industrial control system rather than data networking
A
Operational Technology (OT)
16
Q
A security component in Windows that keeps every user in standard user mode instead of acting like an administrative user
A
User Account Control (UAC)
1. Eliminates unnecessary admin-level requests for Windows resources
2. Reduces risk of malware using admin-level privileges to cause system
issues
17
Q
Provides redundancy by striping data and parity data across the disk drives
A
RAID 5
18
Q
Storage device that performs whole disk encryption by using embedded hardware
A
Self-Encrypting Drive (SED)
19
Q
Program in Linux that is used to change the permissions or rights of a file or folder using a shorthand number system
A
chmod
R (Read) = 4
W (Write) = 2
X (Execute) = 1
# chmod 760 filename
7 = Owner can RWX
6 = Group can RW
0 = All Users (no access)
20
Q
Contents of a virtual machine that exist as deleted files on a cloud-based server after deprovisioning of a virtual machine
A
Data Remnants
21
Q
Resources and costs are shared among several different organizations who have common service needs
A
Community Cloud
22
Q
Encryption algorithm where different keys are used to encrypt and decrypt the data
A
Asymmetric Encryption (Public Key) - Diffie-Hellman, RSA, and ECC
23
Q
A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications
A
Security Information and Event Management (SIEM)
24
Q
A technique that is used to mitigate a weaker key by increasing the time needed to crack it
A
Key Stretching - WPA, WPA2, PGP, bcrypt, and other algorithms utilize key stretching
25
Enterprise management software designed to mediate access to cloud services by users across all types of devices
Cloud Access Security Broker (CASB)
26
An appliance positioned at the cloud network edge and
directs traffic to cloud services if the contents of that
traffic comply with policy
Reverse Proxy
27
Insecure Components, Insufficient Logging and Monitoring, Weak or Default Configurations
Design Vulnerabilities - Utilize scripted installations and baseline configuration templates to secure applications during installation
28
Cloud Threats - Unprotected Storage
Access control to storage is administered through container
policies, IAM authorizations, and object ACLs. Incorrect permissions may occur due to default read/write permissions
leftover from creation. Incorrect origin settings may occur when using content delivery networks.
29
A digital serial data communications network used within vehicles
Controller Area Network (CAN) - The primary external interface is the Onboard Diagnostics (OBD-II) module
30
A checklist of actions to perform to detect and respond to a specific type of incident
Playbook
31
A refinement of machine learning that enables a machine to develop strategies for solving a task given a labeled dataset and without further explicit instructions
Deep Learning
32
Collection of free and open-source SIEM tools that provides storage, search, and analysis functions
ELK/Elastic Stack
33
A computer security tool that offers information about software vulnerabilities, IDS signature development, and improves penetration testing
Metasploit (MSF) - Exploitation
34
Complete platform designed to replace an entire physical computer and includes a full desktop/server operating system
System Virtual Machine
35
Cross-platform version of the Remote Desktop Protocol for remote user GUI access
Virtual Network Computing (VNC)- VNC requires a client, server, and protocol be configured
36
Utility for viewing and modifying the local Address Resolution Protocol (ARP) cache on a given host or server
arp - Networking Security Tools
37
A restricted version of the BER that only allows the use of only one encoding type
Canonical Encoding Rules (CER)
38
Safeguards and countermeasures used to avoid, detect,
counteract, or minimize security risks to our systems and
information
Technical Controls
39
Symmetric stream cipher using a variable key size from 40-bits to 2048-bits that is used in SSL and WEP
Rivest Cipher (RC4)
40
Process to check the user’s or system’s attributed or characteristics prior to allowing it to connect
Context-aware Authentication - Restrict authentication based on the time of day or location
41
Encryption algorithm in which both the sender and the receiver must know the same secret using a privately-held key
Symmetric Algorithm (Private Key) - Confidentiality can be assured with symmetric encryption, but key distribution can be challenging. Symmetric is 100-1000x faster than asymmetric.
DES, 3DES, IDEA, AES, Blowfish, Twofish, RC4, RC5, RC6
42
A TCP/IP protocol that aids in monitoring network-attached devices and computers
Simple Network Management Protocol (SNMP) - SNMP is incorporated into a network management and monitoring
system
43
A technique used to gain information about servers and inventory the systems or services
Banner Grabbing
44
A library of programming utilities used to enable software developers to access functions of another application
Application Programming Interface (API) - APIs allow for the automated administration, management, and monitoring of a cloud service
45
A database used to centralize information about clients and objects on the network
Lightweight Directory Access Protocol (LDAP) - Active Directory is Microsoft’s version
46
A single identity is created for a user and shared with all of the organizations in a federation
Federated Identity Management (FIdM)
47
A password is computed from a shared secret and is synchronized between the client and the server
HMAC-based One Time Password (HOTP)
48
Provides data striping across multiple disks to increase performance
RAID 0
49
Software that is loaded on a managed device to redirect information to the network management system
Agents
50
The process of ensuring that hardware is procured tamper-free from trustworthy suppliers
Hardware Source Authenticity
51
Focused on providing controlled access to publicly available servers that are hosted within your organizational network
De-Militarized Zone (DMZ)
52
Input and output controls on a PLC to allow a user to configure and monitor the system
Human-Machine Interface (HMI)
53
A software vulnerability that occurs when the code attempts to remove the relationship between a pointer and the thing it points to
Dereferencing
54
Class K Fire Suppresion
Black K Hexagon - fire in cooking appliances including vegetable and animal fat
55
A specialized network scan that sets the FIN, PSH, and URG flags set and can cause a device to crash or reboot
XMAS Attack
56
A microprocessor manufacturing utility that is part of a validated supply chain (one where hardware and software does not deviate from its documented function).
Trusted Foundry - Trusted Foundry Program is operated by the Department of Defense (DoD)
57
A class of security tools that facilitates incident response, threat hunting, and security configuration by orchestrating automated runbooks and delivering data enrichment
Security Orchestration, Automation, and Response (SOAR)
58
An attack that embeds a request for a local resource
XML External Entity (XXE) - To prevent XML vulnerabilities from being exploited, use proper input validation
59
Expected cost of a realized threat over a given year
Annualized Loss Expectancy (ALE)
60
Only conducts a backup of the contents of a drive that has changed since the last full backup
Differential Backup - Differential backups take more time to create but less time to restore
61
An access model that is controlled by the system (like MAC) but
utilizes a set of permissions instead of a single data label to define the permission level
Role-Based Access Control (RBAC) - Power Users is a role-based permission
62
Adding random data into a one-way cryptographic hash to help protect against password cracking techniques
Salting - A “nonce” is used to prevent password reuse
63
An attack that sends an oversized and malformed packet to another computer or server
Ping of Death
64
Software running on one or more servers to control the monitoring of network-attached devices and computers
Network Management System (NMS) - Management should be conducted on an out-of-band network to increase
security
65
A Linux command line utility used for querying and displaying logs from journald, the systemd logging service on Linux
journalctl
66
A computer system that is designed to perform a specific, dedicated function
Embedded Systems - Embedded systems are considered static environments where frequent changes are not made or allowed. Embedded systems have very little support for identifying and correcting security issues
67
Utility that displays all the network configurations of the currently
connected network devices and can modify the DHCP and DNS settings
ipconfig/ifconfig - Networking Security Tools
68
Automated encryption setup for wireless networks at a push of a button, but is severely flawed and vulnerable
WiFi Protected Setup (WPS) - Always disable WPS
69
An open source password security auditing and password recovery tool available for many operating systems
Jack the Ripper - Exploitation
70
Each tape is used once per day for two weeks and then the entire set is reused
10 Tape Rotation
71
Ensure the scene is safe, secure the scene to prevent evidence
contamination, and identify the scope of evidence to be collected
Identification - Forensic Procedures
72
Specialized type of DMZ that is created for your partner organizations to access over a wide area network
Extranet
73
Protects against the loss of the array’s data if a single disk fails (RAID 1 or RAID 5)
Fault-resistant RAID
74
Secured system of cable management to ensure that the wired network remains free from eavesdropping, tapping, data emanations, and other threats
Protected Distribution System (PDS)
75
Signal that are sent between two parties or two device that are sent via a path or method different from that of the primary communication between the two parties or devices
Out-of-band communication
76
Digital serial data communications used in operational technology networks to link PLCs
Fieldbus
77
Router keeps track of requests from internal hosts by assigning them random high number ports for each request
Port Address Translation (PAT)
78
Original 802.11 wireless security standard that claims to be as secure as a wired network
Wired Equivalent Privacy - WEP’s weakness is its 24-bit IV (Initialization Vector)
79
Network-based attack where a valid data transmission is fraudulently or malicious rebroadcast, repeated, or delayed
Replay Attack - Multi-factor authentication can help prevent successful replay attacks
80
A proprietary vulnerability scanner that can remotely scan a computer or network for vulnerabilities
Nessus - Networking Security Tools
81
Occurs when permissions are passed to a subfolder from the parent through inheritance
Propagation - Use Groups for roles and do not assign users directly to a folder’s permissions
If you copy a folder, then permissions are inherited from the parent folder it is
copied into
If you move a folder, then permissions are retained from its
original permissions
82
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures (attack.mitre.org)
MITRE ATT&CK Framework
83
Provides flexible authentication via secure tunneling (FAST) by using a protected access credential instead of a certificate for mutual authentication
EAP-FAST
84
Software development is performed in time-boxed or small increments to allow more adaptivity to change
Agile Software Development
85
Attempt to overwhelm the limited switch memory set aside to store the MAC addresses for each port
MAC Flooding - Switches can fail-open when flooded and begin to act like a hub
86
A universal standard of export for Internet Protocol flow information from routers, probes and other devices that are used by mediation systems, accounting/billing systems and network management systems to facilitate services such as measurement, accounting and billing by defining how IP flow information is to be formatted and transferred from an exporter to a collector
Internet Protocol Flow Information Export (IPfix)
87
A communications protocol used in operational technology networks
Modbus - Modbus gives control servers and SCADA hosts the ability to query and
change the configuration of each PLC
88
Class A Fire Suppresion
Green A Triangle - ordinary combustibles: wood, paper, rubber, fabrics
89
A feature of key agreement protocols (like SAE) that provides assurance that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised
Perfect Forward Secrecy or Forward Secrecy
- The AP and the client use a public key system to generate a pair of
long-term keys
- The AP and the client exchange a one-time use session key using a
secure algorithm like Diffie-Hellman
- The AP sends the client messages and encrypts them using the
session key created in Step 2
- Client decrypts the messages received using the same one-time
use session key
90
A component of AI that enables a machine to develop strategies for solving a task given a labeled dataset where features have been manually identified but without further explicit instructions
Machine Learning (ML) - Machine learning is only as good as the datasets used to train it
91
Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus)
Metamorphic
92
The process of identifying the person responsible for the confidentiality, integrity availability and privacy of information assets
Data Ownership
93
Allows the certificate holder to get the OCSP record from the server at regular intervals and include it as part of the SSL or TLS handshake
OCSP Stapling
94
Symmetric key encryption that supports 128-bit and 256-bit keys
Advanced Encryption Standard (AES)
95
Provides control over what the application should do when faced with a runtime or syntax error
Structured Exception Handling (SEH)
96
A software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats
Endpoint Detection and Response (EDR)
97
Utilizes complex mathematics to create sets of objects and subjects to define how they interact
Lattice-based Access Control - Only in high security systems due to its complex configuration
98
XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it
XML Bomb (Billion Laughs Attack) - To prevent XML vulnerabilities from being exploited, use proper
input validation
99
The length of time in addition to the RTO of individual systems to perform reintegration and testing of a restored or upgraded system following an event
Work Recovery Time (WRT)
100
A connection between two or more computers or device that are not on the same private network
Layer 2 Tunneling Protocol (L2TP) - L2TP is usually paired with IPSec to provide security
101
A suite of reports produced during an audit which is used by service organizations to issue validated reports of internal controls over those information systems to the users of those services
System and Organization Controls (SOC)
102
An international standard that provides best practice recommendations on information security controls for use by those responsible for initiating, implementing, or maintaining information security management systems (ISMS)
ISO 27002
103
An open-source network scanner that is used to discover hosts and services on a computer network by sending packets and analyzing their responses
nmap - Networking Security Tools
104
A type of IDS or IPS that monitors a computer system for unexpected behavior or drastic changes to the system's state on an endpoint
Host-based IDS/IPS (HIDS/HIPS)
105
Software or hardware-based solution that is installed on the perimeter of the network to detect data in transit
Network DLP System
106
Organizations are able to place their trust in a single third-party
(also called the bridge model)
Trusted Third-Party - Trusted third-party model is more efficient than a cross
certification or web of trust model
107
A password is computed from a shared secret and current time
Time-based One Time Password (TOTP)
108
An open standard and decentralized protocol that is used to
authenticate users in a federated identity management system
OpenID - User logs into an Identity Provider (IP) and uses their account at
Relying Parties (RP).
109
Components and protocols that facilitate the centralized configuration and monitoring of security mechanisms within offices and data centers
Physical Access Control System (PACS) - PACS can either be implemented as part of a building automation system or a separate system.
110
Virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer
Multipartite
111
Logs the events for the operating system and third-party applications
Application Logs
112
Standard used PKI for digital certificates and contains the owner/user’s information and the certificate authority’s information
X.509
113
A test that uses active tools and security utilities to evaluate security by simulating an attack on a system to verify that a threat exists, actively test it, bypass security controls, and then finally exploit vulnerabilities on a given system
Penetration Test
114
The attacker couples payload code that will enable access with exploit code that will use a vulnerability to execute on the target system
Weaponization
115
List of precomputed valued used to more quickly break a password since values don’t have to be calculated for each password being guessed
Rainbow Table
116
A stream cipher that encrypts plaintext information with a secret random key that is the same length as the plaintext input
One-Time Pad - not commonly used
117
Measures the average time between failures of a device
Mean Time Between Failures (MTBF)
118
Data is encrypted by an application prior to being placed on the data bus
Bus Encryption - Ensures that the device at the end of the bus is trusted to decrypt the data
119
Attempts to have a non-persistent effect activated by a victim clicking a link on the site
Reflected XSS
120
Method used by an attacker to gain access to a victim’s machine in order to infect it with malware
Attack Vector
121
A specification for hardware-based storage of digital certificates, keys, hashed passwords, and other user and platform identification information
Trusted Platform Module (TPM) - A TPM can be managed in Windows via the tpm.msc console or through group policy
122
Short for “sampled flow”, it provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring
sflow
123
Attempt to exploit the victim’s web browser
DOM-based XSS
124
A processor that integrates the platform functionality of multiple logical controllers onto a single chip
System-on-Chip (SoC) - System-on-Chip are power efficient and used with embedded systems
125
Activity is evaluated based on the previous behavior of applications, executables, and the operating system in comparison to the current activity of the system
Behavior-based Monitoring
126
Translates the information into a format that the sender and receiver both understand
Presentation Layer - Layer 6
127
A network protocol system created by Cisco that collects active IP network traffic as it flows in or out of an interface, including its point of origin, destination, volume and paths on the network
netflow
128
Four key controls for mitigating vulnerabilities in Operational Technology/Industrial Control Systems
1. Establish administrative control over Operational technology networks by recruiting staff with relevant expertise
2. Implement the minimum network links by disabling unnecessary links, services
3. Develop and test a patch management program for Operational
Technology Network
4. Perform regular audits of logical and physical access to systems to detect possible vulnerabilities and intrusion
129
Act of configuring an operating system securely by updating it, creating rules and policies to govern it, and removing unnecessary applications and services
Hardening
130
Insertion of additional information or code through data input from a client to an application
Injection Attack
131
A remote worker’s machine diverts internal traffic over the VPN but external traffic over their own internet connection
Split Tunneling
132
Number of times per year that a threat is realized
Annualized Rate of Occurrence (ARO)
133
Deidentification method where generic or placeholder labels are
substituted for real data while preserving the structure or format of the original data
Data Masking
134
Replacement for WEP which uses TKIP, Message Integrity Check (MIC), and RC4 encryption
WiFi Protected Access (WPA) - WPA was flawed, so it was replaced by WPA2
135
A suite of free open source utilities for editing and replaying previously captured network traffic
tcpreplay - Packet Capture
136
A deidentification method where a unique token is substituted for real data
Tokenization
137
Attack that creates a large number of processes to use up the available processing power of a computer
Fork Bomb
138
Occurs when a computer is placed between the sender and receiver and is able to capture or modify the traffic between them
Active Interception
139
Only conducts a backup of the contents of a drive that have changed since the last full or incremental backup
Incremental Backup
140
A system that can provide automated identification of suspicious activity by user accounts and computer hosts
User and Entity Behavior Analytics (UEBA). UEBA solutions are heavily dependent on advanced computing techniques like artificial intelligence (AI) and machine learning
141
Ensure authorization to collect evidence is obtained, and then document and prove the integrity of evidence as it is collected
Collection - Forensic Procedures
142
Symmetric block cipher that uses 128-bit, 192-bit, or 256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext
Advanced Encryption Standard (AES)
143
Represents the actual network cables and radio waves used to carry data over a network
Physical Layer - Layer 1 - Bits
144
Security technique in which devices are scanned to determine its current state prior to being allowed access onto a given network
Network Access Control (NAC) - If a device fails the inspection, it is placed into digital quarantine. IEEE 802.1x standard is used in port-based NAC
145
Technique used by an attacker to find two different messages that have the same identical hash digest
Birthday Attack
146
Designed to provide fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider
Cloud Security Alliance’s Cloud Control Matrix
147
An ordered set of rules that a router uses to decide whether to permit or deny traffic based upon given characteristics
Access Control List
148
Utility that is used to create an exploitation website that can perform Open port scans in a more stealth-like manner
scanless - Networking Security Tools
149
Attacker adds an additional VLAN tag to create an outer and inner tag
Double Tagging - Prevent double tagging by moving all ports out of the default VLAN group
150
Creates network segment for each client when it connects to prevent them from communicating with other clients on the network
AP Isolation
151
A security framework that divides IT into four domains: Plan and
Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate
Control Objectives for Information and Related Technology (COBIT)
152
A task automation and configuration management framework from Microsoft, consisting of a command-line shell and the associated scripting language
PowerShell - Shell and Scripts
153
An open-source SIEM with an enterprise version focused on compliance and supporting IT operations and DevOps
Graylog
154
Process of configuring workstation or server to only provide essential applications and services
Least Functionality
155
A type of OS that prioritizes deterministic execution of operations to ensure consistent response for time-critical tasks
Real-Time Operating System (RTOS) - Embedded systems typically cannot tolerate reboots or crashes and must have response times that are predictable to within microsecond
tolerances
156
Provides your organization with the hardware and software needed for a specific service to operate
Platform as a Service (PaaS)
157
A tool that can hook one or more browsers and can use them as a beachhead of launching various direct commands and further attacks against the system from within the browser context
Browser Exploitation Framework (BeEF) - Exploitation
158
Variant on a Denial of Service (DOS) attack where attacker initiates multiple TCP sessions but never completes the 3-way handshake
SYN Flood - Flood guards, time outs, and an IPS can prevent SYN Floods
159
Removal of data with a certain amount of assurance that it cannot be reconstructed
Clearing
160
An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level. A shim is placed between two components to intercept calls and redirect
them
Driver Manipulation
161
Utility that is used to view and manipulate the IP routing table on a host or server
route - Networking Security Tools
162
A password recovery tool that can be used through sniffing the network, cracking encrypted passwords using dictionary, brute-force, and cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, and analyzing routing protocols
Cain and Abel - Exploitation
163
Provides two independent zones with full access to the data (RAID 10)
Disaster-tolerant RAID
164
Occurs when an attacker masks their own MAC address to pretend they have the MAC address of another device
MAC Spoofing - MAC Spoofing is often combined with an ARP spoofing attack. Limit static MAC addresses accepted. Limit duration of time for ARP entry on hosts.
165
Securing the BIOS
1. Flash the BIOS
2. Use a BIOS password
3. Configure the BIOS boot order
4. Disable the external ports and devices
5. Enable the secure boot option
166
Used during the event to find out whether something bad might be happening
Detective Controls
167
Provides redundancy by mirroring the data identically on two hard disks
RAID 1
168
A specific string of bytes triggers an alert
Signature-based Detection (IDS)
169
A command line utility used to dump system memory to the standard output stream by skipping over holes in memory maps
Memdump - Forensics
170
Setting when the network adapter is able to capture all of the packets on the network, regardless of the destination MAC address of the frames carrying them
Promiscuous Mode - Protocol Analyzers
171
A piece of software that is installed on the device requesting access to the network
Persistent Agents
172
For data collection procedures, analysts should always follow the order of volatility
* CPU registers and cache memory
* Contents of system memory (RAM), routing tables,
ARP cache, process table, temporary swap files
* Data on persistent mass storage
(HDD/SDD/flash drive)
* Remote logging and monitoring data
* Physical configuration and network topology
* Archival media
173
A digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools
Autopsy - Forensics
174
Attacker configures their device to pretend it is a switch and uses it to negotiate a trunk link to break out of a VLAN
Switch Spoofing
175
Ports 1024 to 49,151 are considered registered and are usually assigned to proprietary protocols
Registered Ports
176
Built to address a specific security issue, such as email privacy, employee termination procedures, or other specific issues
Issue-Specific Policies
177
The science of creating machines with the ability to develop problem solving and analysis strategies without significant human direction or intervention
Artificial Intelligence (AI)
178
Technology like a DVD-R that allows data to be written only once but read unlimited times
Write Once Read Many (WORM)
179
A standardized format used for computer message logging that allows for the separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them
SYSLOG - Used to consolidate all the logs into a single repository. Syslog can refer to the protocol, the server, or the log entries themselves. Newer implementations can use MD-5 or SHA-1 for authentication and integrity
180
Software that isn’t benign nor malicious and tends to behave improperly without serious consequences
Grayware
181
Describes how a connection is established, maintained, and transferred over the physical layer and uses physical addressing (MAC addresses)
Data Link Layer - Layer 2 - Frames
182
Security controls that are installed before an event happens and
are designed to prevent something from occurring
Preventative Controls
183
Provides centralized administration of dial-up, VPN, and wireless authentication services for 802.1x and the Extensible Authentication Protocol (EAP)
Remote Authentication Dial-In User Service (RADIUS) - operates at the application layer
184
A model developed by Lockheed Martin that describes the stages by which a threat actor progresses a network intrusion
Kill Chain
185
An encryption program used for signing, encrypting, and decrypting emails
Pretty Good Privacy (PGP) - The IDEA algorithm is used by PGP. Symmetric functions use 128-bit or higher keys and the asymmetric functions use 512-bit to 2048-bit key sizes
186
An estimation of the amount of damage that a negative risk might achieve
Magnitude of Impact
187
A hardened server that provides access to other hosts within the DMZ
Jumpbox - An administrator connects to the jumpbox and the jumpbox connects to hosts in the DMZ. The jumpbox and management workstation should only have the minimum required software to perform their job and be well hardened
188
Occurs when you are able to exploit a design flaw or bug in a system to gain access to resources that a normal user isn’t able to access
Privilege Escalation
189
An access model that is dynamic and context-aware using IF-THEN statements
Attribute-Based Access Control (ABAC)
190
A cryptographic module embedded within a computer system that can endorse trusted execution and attest to boot settings and metrics
Hardware Root of Trust (ROT) - A hardware root of trust is used to scan the boot metrics and OS files to verify their signatures, which we can then use to sign a digital report
191
Restricted version of the BER which allows one encoding type and has more restrictive rules for length, character strings, and how elements of a digital certificate are stored in X.509
Distinguished Encoding Rules (DER)
192
Allow all of the subdomains to use the same public key certificate and have it displayed as valid
Wildcard Certificates
193
Virus embedded into a document and is executed when
the document is opened by the user
Macro Virus
194
Security controls that are focused on decision-making and the
management of risk
NIST - Management Controls
195
The attacker typically uses the access he has achieved to covertly collect information from target systems and transfer it to a remote system (data exfiltration) or achieve other goals and
motives
Actions on Objectives
196
Symmetric block cipher which uses 64-bit blocks to encrypt plaintext into ciphertext
International Data Encryption Algorithm (IDEA)
197
Allows a certificate owner to specify additional domains and IP addresses to be supported
Subject Alternative Name (SAN)
198
Used to provide authentication but is not considered secure since it transmits the login credentials unencrypted (in the clear)
Password Authentication Protocol (PAP)
199
Provides redundancy by striping and double parity data across the disk drives
RAID 6
200
Used to provide authentication by using the user’s password to encrypt a challenge string of random numbers
Challenge Handshake Authentication Protocol (CHAP)
201
Ports 49,152 to 65,535 can be used by any application without being registered with IANA
Dynamic or Private Ports
202
Attacker sends a ping to subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing
Smurf Attack
203
The CPU's security extensions invoke a TPM and secure boot attestation to ensure that a trusted operating system is running
Trusted Execution
204
An automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities across a network
sn1per - Networking Security Tools
205
Process of changing an IP address while it transits across a router
Network Address Translation (NAT) - Using NAT can help us hide our network IPs
206
Act of creating subnetworks logically through the manipulation of IP addresses
Subnetting
207
Allows the combination of multiple physical hard disks into a single logical hard disk drive that is recognized by the operating system
Redundant Array of Independent Disks (RAID)
208
Supports mutual authentication by using server certificates and Microsoft’s Active Directory to authenticate a client’s password
Protected EAP (PEAP) - LEAP is proprietary to Cisco-based networks
209
Attack which exploits a security flaw to permanently break a networking device by reflashing its firmware
Permanent Denial of Service
210
Create a copy of evidence for analysis and use repeatable methods and tools during analysis
Analysis - Forensic Procedures
211
Attack that breaks apart packets into IP fragments, modifies them with overlapping and oversized payloads, and sends them to a victim machine
Teardrop Attack
212
A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end
OpenSSL - Shell and Scripts
213
A set of industry standards and best practices created by NIST to help organizations manage cybersecurity risks
Cybersecurity Framework (CSF)
214
Phishing attempt to trick a user to access a different or fake website (usually by modifying hosts file)
Pharming
215
Requires each agency to develop, document, and implement an agencywide information systems security program to protect their data
Federal Information Security Management (FISMA) Act of 2002
216
An attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings)
Ping Flood
217
An architecture of input, hidden, and output layers that can perform algorithmic analysis of a dataset to achieve outcome objectives
Artificial Neural Network (ANN) - A machine learning system adjusts its neural network to reduce errors and optimize objectives
218
An attack that combines a deidentification dataset with other data source to discover how secure the deidentification method used is
Reidentification
219
Provides regulations that govern the security, confidentiality, and
integrity of the personal information collected, stored, or processed during the election and voting process
Help America Vote Act (HAVA) of 2002
220
A baseline is established and any network traffic that is outside of the baseline is evaluated
Anomaly-based Monitoring
221
Create a report of the methods and tools used in the investigation and present detailed findings and conclusions based on the analysis
Reporting - Forensic Procedures
222
Occurs when an attacker takes over a TCP session between two computers without the need of a cookie or other host access
TCP/IP Hijacking
223
A default user profile for each user is created and linked with all of the resources needed
Single Sign-On (SSO)
224
Attack consisting of the insertion or injection of an SQL query via input data from the client to a web application
SQL Injection - If you see ` OR 1=1; on the exam, it’s an SQL injection
225
The hostile or attacking team in a penetration test or incident response exercise
Red Team
226
The automation of multiple steps in a deployment process
Orchestration
227
The attacker determines what methods to use to complete the phases of the attack
Reconnaissance
228
Three sets of backup tapes (like the grandfather-father-son) that are rotated in a more complex system
Towers of Hanoi
229
An open source software for automating analysis of suspicious files
Cuckoo - File Manipulation
230
Occurs when a secure copy of a user’s private key is held in case
the user accidently loses their key
Key Escrow
231
Allows two phones to utilize the same service and allows an attacker to gain access to the phone’s data
SIM Cloning
232
The extensions allow a trusted process to create an encrypted container for sensitive data
Secure Enclave
233
Also known as Flash cookies, they are stored in your Windows user profile under the Flash folder inside of your AppData folder
Locally Shared Object (LSO)
234
Address the security needs of a specific technology, application, network, or computer system
System-Specific Policies
235
A piece of code that connects to the Internet to retrieve additional tools after the initial infection by a dropper
Downloader
236
A mechanism for ensuring the confidentiality, integrity, and availability of software code and data as it is executed in volatile memory
Secure Processing
237
Encryption algorithm which breaks the input into 64-bit blocks and uses transposition and substitution to create ciphertext using an effective key strength of only 56-bits
Data Encryption Standard (DES) - DES used to be the standard for encryption
238
Staff administering, evaluating, and supervising a penetration test
or incident response exercise
White Team
239
Breaks the input into fixed-length blocks of data and performs the encryption on each block
Block Cipher
240
Ports 0 to 1023 are considered well-known and are assigned by the Internet Assigned Numbers Authority (IANA)
Well-Known Ports
241
A hash digest of a message encrypted with the sender’s private key to let the recipient know the document was created and sent by the person claiming to have sent it
Digital Signature
242
Attacker sends a UDP echo packet to port 7 (ECHO) and port 19 (CHARGEN) to flood a server with UDP packets
Fraggle Attack
243
Advanced version of an encrypted virus that changes itself
every time it is executed by altering the decryption
module to avoid detection
Polymorphic
244
The process of finding and investigating other computers on the
network by analyzing the network traffic or capturing the packets
being sent
Network Sniffing
245
An encryption method that allows calculations to be performed on data without decrypting it first
Homomorphic Encryption - Homomorphic encryption can be used for privacy-preserving outsourced storage and computation
246
A command line utility that allows you to capture and analyze network traffic going through your system
tcpdump - Packet Capture
247
An international standard that details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS)
ISO 27001
248
A command line tool to transfer data to or from a server, using any of the supported protocols (HTTP, FTP, IMAP, POP3, SCP, SFTP, SMTP, TFTP, TELNET, LDAP or FILE)
curl - Networking Security Tools
249
Occurs when an attacker embeds malicious scripting commands on a trusted website
Cross-Site Scripting (XSS) - Prevent XSS with output encoding and proper input validation
250
Label-based access control that defines whether access should be granted or denied to objects by comparing the object label and the subject label
Rule-based Access Control
251
A process that integrates security and risk management activities into the system development life cycle through an approach to security control selection and specification that considers effectiveness, efficiency, and constraints due to applicable laws, directives, Executive Orders, policies, standards, or regulations
Risk Management Framework (RMF)
252
Software that aggregates and catalogs data from multiple sources within an industrial control system
Data Historian
253
Was introduced in 2018 to strengthen WPA2. Has an equivalent cryptographic strength of 192-bits.
WPA3 - Largest improvement in WPA3 is the removal of the Pre-Shared Key (PSK) exchange
254
A specialized type of file server that is used to host files for distribution across the web
FTP Server - FTP servers should be configured to require TLS connections
255
A command line utility used to copy disk images using a bit by bit copying process
dd - Forensics
256
Occurs when the name resolution information is modified in the DNS server’s cache
DNS Poisoning
257
Methods and technologies that remove identifying information from data before it is distributed
Deidentification
258
Utility that is used for DNS enumeration to locate all DNS servers and DNS entries for a given organization
dnsenum - Networking Security Tools
259
Penetration Testing Process
o Get permission and document info
o Conduct reconnaissance
o Enumerate the targets
o Exploit the targets
o Document the results
260
A cryptographic key that is generated for each execution of a key
establishment process
Ephemeral - Ephemeral keys are short-lived and used in the key exchange for WPA3 to create perfect forward secrecy
261
A technical method used in social engineering to trick users into entering their username and passwords by adding an invisible string before the weblink they click
Prepending
262
A network diagnostic command for displaying possible routes and measuring transit delays of packets across an Internet Protocol network
tracert/traceroute - Networking Security Tools
263
The weaponized code establishes an outbound channel to a remote server that can then be used to control the remote access tool and possibly download additional tools to progress the attack
Command & Control (C2)
264
Designed to only run a single process or application like a
virtualized web browser or a simple web server
Processor Virtual Machine
265
Provides all the hardware, operating system, and backend software needed in order to develop your own software or service
Infrastructure as a Service (IaaS)
266
Exploit techniques that use standard system tools and packages to perform intrusions. Detection of an adversary is more difficult when they are executing malware code within standard tools and processes
Living Off the Land
267
A software development method where application and platform
updates are committed to production rapidly.
Continuous Deployment - Continuous deployment focuses on automated testing and release of code in order to get it into the production environment more quickly
268
Occurs when an attacker redirects one website’s traffic to another website that is bogus or malicious
Pharming
269
Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime
DLL Injection
270
A standard designed to regulate the transfer of secure public information across networks and the Internet utilizing any security tools and services available
Open Vulnerability and Assessment Language (OVAL)
271
Digitally-signed electronic documents that bind a public key with a user’s identity
Certificates
272
Cloud Threats - Insufficient Logging and Monitoring
Software as a service may not supply access to log files or monitoring tools. Logs must be copied to non-elastic storage for long-term retention.
273
Software tool that allows for the capture, reassembly, and analysis of packets from the network
Protocol Analyzer
274
Layer from which the message is created, formed, and originated
Application Layer - Layer 7 - Consists of high-level protocols like HTTP, SMTP, and FTP
275
A popular network analysis tool to capture network packets and display them at a granular level for real-time or offline analysis
Wireshark - Packet Capture
276
Class B Fire Suppresion
Red B Square - flammable liquids and gases: gasoline, oils, paint
277
A logical communication opening created on a client in order to call out to a server that is listening for a connection
Outbound Port
278
Chip residing on the motherboard that contains an encryption key
Trusted Platform Module (TPM)
279
Occurs when virtual machines are created, used, and deployed without proper management or oversight by the system admins
Virtualization Sprawl
280
A newer and updated version of the PGP encryption suite that uses AES for its symmetric encryption functions
GNU Privacy Guard (GPG)
281
Uses logical address to route or switch information between hosts, the network, and the internetworks
Network Layer - Layer 3 - Packets, Routers
282
An interpreted, high-level and general-purpose programming language
Python - Shell and Scripts
283
A market-leading big data information gathering and analysis tool that can import machine-generated data via a connector or visibility add-on
Splunk
284
Uses digital signatures to provide an assurance that the software code has not been modified after it was submitted by the developer
Code Signing
285
An open-source packet generator and analyzer for the TCP/IP protocol that is used for security auditing and testing of firewalls and networks
hping - Networking Security Tools
286
Used whenever you can’t meet the requirement for a normal control
Compensating Control
287
Utility for reading from and writing to network connections using TCP or UDP which is a dependable back-end that can be used directly or easily driven by other programs and scripts
netcat - Networking Security Tools
288
Used after an event occurs
Corrective Controls
289
Analysis and testing of a program occurs while it is being executed or run
Dynamic Analysis
290
A property of IaC that an automation or orchestration action always produces the same result, regardless of the component's previous state
Idempotence
291
A python script that is used to gather emails, subdomains, hosts,
employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN database
the harvester - Networking Security Tools
292
A single operating system kernel is shared across multiple virtual machines but each virtual machine receives its own user space for programs and data
Application Containerization - Containerization allows for rapid and efficient deployment of distributed applications
293
The potential vulnerability that occurs when there is a change between when an app checked a resource and when the app used the resource
Time of Check to Time of Use (TOCTTOU) - Develop applications to not process things sequentially if possible. Implement a locking mechanism to provide app with exclusive
access
294
Cisco’s proprietary version of RADIUS
TACACS+
295
A specialized type of software that allows the restoration of a lost or corrupted key to be performed
Key Recovery Agent
296
Provides integrity, confidentiality, and authenticity of packets by
encapsulating and encrypting them
Encapsulating Security Payload (ESP)
297
A security appliance or host positioned at the client
network edge that forwards user traffic to the cloud
network if the contents of that traffic comply with policy
Forward Proxy
298
Any lightweight code designed to run an exploit on the target, which may include any type of code format from scripting languages to binary code
Shellcode
299
Occurs when an attacker observes the operation of a cipher being used with several different keys and finds a mathematical relationship between those keys to determine the clear text data
IV Attack
300
A logical communication opening on a server that is listening for a connection from a client
Inbound Port
301
Network adapter can only capture the packets directly addressed to itself
Non-promiscuous Mode - Protocol Analyzers
302
Attestation model built upon XML used to share federated identity management information between systems
Security Assertion Markup Language (SAML)
303
A means for software or firmware to permanently alter the state of a transistor on a computer chip
eFUSE
304
Attack that exploits the IP address to MAC resolution in a network to steal, modify, or redirect frames within the local area network
ARP Poisoning - Allows an attacker to essentially take over any sessions within the LAN. ARP Poisoning is prevented by VLAN segmentation and DHCP snooping.
305
Cryptographic protocols that provide secure Internet communications for web browsing, instant messaging, email, VoIP, and many other services
Secure Socket Layer (SSL) and Transport Layer Security (TLS)
306
Attempts to remove, detain, or redirect malicious traffic
Network Intrusion Prevention Systems - NIPS should be installed in-line of the network traffic flow. NIPS can also perform functions as a protocol analyzer.
307
Malicious code that has been inserted inside a program and will execute only when certain conditions have been met
Logic Bomb
308
Methods that make it difficult for an attacker to alter the authorized execution of software
Anti-Tamper - Anti-tamper mechanisms include a field programmable gate array (FPGA) and a physically unclonable function (PUF)
309
A claim that the data presented in the report is valid by digitally
signing it using the TPM’s private key
Attestation
310
A simulated random number stream generated by a computer that is used in cryptography, video games, and more
Pseudo-Random Number Generator (PRNG) - There are no such thing as truly random numbers in computers
311
Method used by programmers to randomly arrange the different address spaces used by a program or process to prevent buffer overflow exploits
Address Space Layout Randomization
312
Exploitation of a computer session in an attempt to gain unauthorized access to data, services, or other resources on a computer or server
Hijacking
313
The attacker identifies a vector by which to transmit the
weaponized code to the target environment
Delivery
314
Utility that supports encrypted data transfer between two computers for secure logins, file transfers, or general purpose connections
SSH - Shell and Scripts
315
Utility used to determine the IP address associated with a domain name, obtain the mail server settings for a domain, and other DNS information
nslookup/dig - Networking Security Tools
316
Cloud Threats - Improper Key Management
APIs should use secure authentication and authorization such as SAML or OAuth/OIDC before accessing data. Do not hardcode or embed a key into the source code. Do not create one key with full control to access an application’s functions. Delete unnecessary keys and regenerate keys when moving
into a production environment.
317
A SIEM log management and analytics software that can be used for compliance reporting for legislation and regulations like HIPPA, SOX, and PCI DSS
ArcSight
318
An operating system that meets the requirements set forth by
government and has multilevel security
Trusted Operating System (TOS)
319
An international standard that acts as a privacy extension to the ISO 27001 to enhance the existing Information Security Management System (ISMS) with additional requirements in order to establish, implement, maintain, and continually improve a Privacy Information Management System (PIMS)
ISO 27701
320
An attack that allows an attacker to break out of a normally isolated VM by interacting directly with the hypervisor
VM Escape
321
Occurs when an attacker forces a user to execute actions on a web server for which they are already authenticated
Cross-Site Request Forgery (XSRF/CSRF) - Prevent XSRF with tokens, encryption, XML file scanning, and cookie verification
322
Focused on changing the behavior of people instead of removing the actual risk involved
Administrative Controls
323
Exposes the hard drive to a powerful magnetic field which in turn causes previously-written data to be wiped from the drive
Degaussing
324
A physical device that allows you to intercept the traffic between
two points on the network
Network Tap
325
Mitigation actions that an organization takes to defend against the risks that have been uncovered during due diligence
Due Care
326
Focused on the things done by people
NIST - Operational Controls
327
Hosts or servers in the DMZ which are not configured with any services that run on the local network
Bastion Hosts
328
A data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with a forensic tool is needed
FTK Imager - Forensics
329
Uses a piece of software that scans the device remotely or is installed and subsequently removed after the scan
Non-Persistent Agents
330
Comparing a precomputed encrypted password to a value in a lookup table
Cryptanalysis Attack
331
Components and protocols that facilitate the centralized configuration and monitoring of mechanical and electrical systems within offices and data centers
Building Automation System (BAS)
332
Source code of an application is reviewed manually or with automatic tools without running the code
Static Analysis
333
Malware designed to install or run other types of malware embedded in a payload on an infected host
Dropper - Droppers are likely to implement anti-forensics techniques to prevent detection and analysis
334
Utility used to determine if a host is reachable on an Internet Protocol network
ping/pathping - Networking Security Tools
335
A protocol that encapsulates PPP packets and ultimately sends data as encrypted traffic
Point-to-Point Tunneling Protocol (PPTP) - PPTP can use CHAP-based authentication, making it vulnerable to attacks
336
Act of removing data in such a way that it cannot be reconstructed using any known forensic techniques
Purging (Sanitizing)
337
A type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographic region
Supervisory Control and Data Acquisition (SCADA) - SCADA typically run as software on ordinary computers to gather data from and manage plant devices and equipment with embedded PLCs
338
Used to verify information about a user prior to requesting that a certificate authority issue the certificate
Registration Authority
339
Microsoft’s proprietary protocol that allows administrators and users to remotely connect to another computer via a GUI
Remote Desktop Protocol (RDP) - RDP doesn’t provide authentication natively
340
U.S. Government standards for the level of shielding required in a building to ensure emissions and interference cannot enter or exit the facility
TEMPEST
341
This mechanism enables the weaponized code to run a remote access tool and achieve persistence on the target system
Installation
342
Analyzes the current traffic against an established baseline and
triggers an alert if outside the statistical average
Anomaly-based Detection (IDS)
343
A container for an emulated computer that runs an entire operating system
Virtual Machine
344
The default file system format for Windows and is more secure because it supports logging, encryption, larger partition sizes, and larger file sizes than FAT32
New Technology File System (NTFS)
345
The original ruleset governing the encoding of data structures for
certificates where several different encoding types can be utilized
Basic Encoding Rules (BER)
346
Sending of unsolicited messages to Bluetooth-enabled devices
Bluejacking
347
A decentralized trust model that addresses issues associated with the public authentication of public keys within a CA-based PKI system
Web of Trust
348
Method used by an attacker to access a victim’s machine
Threat Vector
349
The longest period of time a business can be inoperable without causing irrevocable business failure
Maximum Tolerable Downtime (MTD)
350
A role responsible for handling the management of the system on which the data assets are stored
Data Custodian
351
An access control policy where the computer system determines the access control for an object
Mandatory Access Control (MAC) - MAC relies on security labels being assigned to every user (called a subject) and every file/folder/device or network connection (called an object). Data labels create trust levels for all subjects and objects
352
Attack that targets an individual client connected to a network, forces it offline by deauthenticating it, and then captures the handshake when it reconnects. Used as part of an attack on WPA/WPA2
WiFi Disassociation Attack
353
A specialized type of DoS which attempts to send more packets to a single server or host than they can handle
Flood Attack
354
Any system that is different in its configuration compared to a standard template within an infrastructure as code architecture
Snowflake Systems - Lack of consistency leads to security issues and inefficiencies in support
355
A deidentification technique where data is generalized to protect the individuals involved
Aggregation/Banding
356
Method used by IPSec to create a secure tunnel by encrypting the connection between authenticated peers
Internet Key Exchange (IKE)
357
Utilizes a web of trust between organizations where each one certifies others in the federation
Cross-Certification
358
Logs the events such as successful and unsuccessful user logins to the system
Security Logs
359
Attempts to get data provided by the attacker to be saved on the
web server by the victim
Stored/Persistent XSS
360
Algorithm that creates a fixed-length 128-bit hash value unique to the input file
Message Digest 5 (MD5) - SHA has higher encryption
361
A TCP/IP protocol that authenticates and encrypts IP packets and effectively securing communications between computers and devices using this protocol
IPSec
362
A role focused on the quality of the data and associated metadata
Data Steward
363
Attack that causes data to flow through the attacker’s computer where they can intercept or manipulate the data
Man-in-the-Middle (MITM)
364
Unauthorized access of information from a wireless device over a Bluetooth connection
Bluesnarfing
365
A type of computer designed for deployment in an industrial or outdoor setting that can automate and monitor mechanical systems
Programmable Logic Controller (PLC)
366
Utility that provides an easy way to add messages to the /var/log/syslog file from the command line or from other files
logger - File Manipulation
367
A software architecture that runs functions within virtualized runtime containers in a cloud rather than on dedicated server instances
Serverless - Serverless depends on orchestration
368
Firmware that provides the computer instructions for how to accept input and send output
Basic Input Output System (BIOS) OR Unified Extensible Firmware Interface (UEFI)
369
Class D Fire Suppresion
Yellow D Star - combustible metals and metal alloys
370
A logical communication endpoint that exists on a computer or server
Port
371
The collection of tactical information about an adversary as well as the dissemination of propaganda in pursuit of a competitive advantage over an opponent
Influence Operations or Influence Campaign
372
Seeks to identify any issues in a network, application, database, or other systems prior to it being used that might compromise the system
Vulnerability Assessment
373
Injection of randomized data into a software program in an attempt to find system failures, memory leaks, error handling issues, and improper input validation
Fuzzing
374
Wireless B, G, and N
Use a 2.4 GHz signal
375
An automated version of a playbook that leaves clearly defined interaction points for human analysis
Runbook
376
Measures the average time it takes to repair a network device when it breaks
Mean Time To Repair (MTTR)
377
A UEFI feature that gathers secure metrics to validate the boot
process in an attestation report
Measured Boot
378
Low-level CPU changes and instructions that enable secure processing
Processor Security Extensions
379
Cost associated with the realization of each individualized threat
that occurs
Single Loss Expectancy (SLE)
380
Any security measures that are designed to deter or prevent unauthorized access to sensitive information or the systems that contain it
Physical Controls
381
A technique that allows an attacker to authenticate to a remote server or service by using the underlying NTLM or LM hash instead of requiring the associated plaintext password
Pass the Hash - difficult to defend against
382
Utility that displays network connections for Transmission Control Protocol, routing tables, and a number of network interface and network protocol statistics
netstat - Networking Security Tools
383
A group of policies that can be loaded through one procedure
Security Template
384
Attack which relies on the large amount of DNS information that is sent in response to a spoofed query on behalf of the victimized server
DNS Amplification
385
An authentication protocol used by Windows to provide for two-way (mutual) authentication using a system of tickets
Kerberos - A domain controller can be a single point of failure for Kerberos
386
Attack that exploits a process in the registration process for a domain name that keeps the domain name in limbo and cannot be registered by an authenticated buyer
Domain Name Kiting
387
Consensus-developed secure configuration guidelines for hardening (benchmarks) and prescriptive, prioritized, and simplified sets of cybersecurity best practices (configuration guides)
Center for Internet Security (CIS)
388
Protocol used in IPSec that provides integrity and authentication
Authentication Header (AH)
389
Combination of network security devices and technologies to provide more defense in depth within a single device
Unified Threat Management - UTM may include a firewall, NIDS/NIPS, content filter, anti-malware, DLP, and VPN. Also known as NGFW.
390
Provide general direction and goals, a framework to meet the business goals, and define the roles, responsibilities, and terms
Organizational Policies
391
Occurs when an attacker blindly injects data into the communication stream without being able to see if it is successful or not
Blind Hijacking
392
A single computer (or file, group of files, or IP range) that might be attractive to an attacker
Honeypot
393
A software development method where code updates are tested and committed to a development or build server/code repository rapidly.
Continuous Integration - Continuous integration can test and commit updates multiple times per day. Continuous integration detects and resolves development conflicts early and often.
394
Occurs when an attacker is able to execute or run commands on a victim computer
Arbitrary Code Execution
395
Allows two devices to transmit information when they are within close range through automated pairing and transmission
Near Field Communication (NFC)
396
One or more switch ports are configured to forward all of their packets to another port on the switch
Port Mirroring
397
Manages the distribution of the physical resources of a host machine (server) to the virtual machines being run (guests)
Hypervisor
398
An agreement for the owners and operators of the IT systems to
document what technical requirements each organization must meet
Interconnection Security Agreement (ISA)
399
A standard that provides cryptographic security for electronic messaging
Secure/Multipurpose Internet Mail Extensions (S/MIME)
400
Operates at the session layer and only inspects the traffic during the establishment of the initial session over TCP or UDP
Circuit-Level Gateway
401
An entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption
Public Key Infrastructure (PKI) - PKI and public key encryption are related but they are not the same thing
402
A UEFI feature that prevents unwanted processes from executing during the boot operation
Secure Boot
403
Provides all the hardware, operating system, software, and applications needed for a complete service to be delivered
Software as a Service (SaaS)
404
Type of backup primarily used to capture the entire operating system image including all applications and data
Snapshot Backup
405
Process of measuring changes in the network, hardware,
and software environment
Baselining
406
Physical devices that act as a secure cryptoprocessor during the
encryption process
Hardware Security Module (HSM)
407
The longest period of time that an organization can tolerate lost data being unrecoverable
Recovery Point Objective (RPO) - Recovery Point Objective (RPO) is focused on how long can you be without your data. MTD and RPO help to determine which business functions are critical and to specify appropriate risk countermeasures
408
Logical controls that are put into a system to help secure it
NIST - Logical Controls
409
Occurs when a Trojan infects a vulnerable web browser and modifies the web pages or transactions being done within the browser
Man-in-the-Browser (MITB)
410
Methods used to secure data and information by verifying a user has permissions to read, write, delete, or otherwise modify it
Access Control
411
Network traffic is analyzed for predetermined attack patterns
Signature-based Monitoring
412
An XML schema used to define and describe the information being created by OVAL to be shared among the various programs and tools
OVAL Language
413
Utilizes a keystream generator to encrypt data bit by bit using a mathematical XOR function to create the ciphertext
Stream Cipher
414
A framework of protocols that allows for numerous methods of authentication including passwords, digital certificates, and public key infrastructure
Extensible Authentication Protocol (EAP)
415
A commercial disk editor and universal hexadecimal editor used for data recovery and digital forensics
WinHex - Forensics
416
An international standard for enterprise risk management that provides a universally recognized paradigm for practitioners and companies employing risk management processes to replace the myriad of existing standards, methodologies, and paradigms that differed between industries, subject matters, and regions
ISO 31000
417
A provisioning architecture in which deployment of resources is
performed by scripted automation and orchestration
Infrastructure as Code (IaC) - IaC allows for the use of scripted approaches to provisioning infrastructure in the cloud
418
Uniquely identifies the network and is the name of the WAP used by the clients
Service Set Identifier (SSID) - Disable the SSID broadcast in the exam
419
Logs the events such as a system shutdown and driver failures
System Logs
420
A protocol that allows you to determine the revocation status of a digital certificate using its serial number
Online Certificate Status Protocol (OCSP)
421
A SIEM log management, analytics, and compliance reporting
platform created by IBM
QRadar
422
A cloud service model that supports serverless software architecture by provisioning runtime containers in which code is executed in a particular programming language
Function as a Service (FAAS)
423
A protocol that can create a secure channel between two computers or network devices to enable one device to control the other device
Secure Shell (SSH)
424
Computers and other network-attached devices monitored through the use of agents by a network management system
Managed Devices
425
A firmware update that is digitally signed by the vendor and
trusted by the system before installation
Trusted Firmware Updates
426
Manages the establishment, termination, and synchronization of a session over the network
Session Layer - Layer 5
427
Attempts to detect, log, and alert on malicious network activities
Network Intrusion Detection Systems - NIDS use promiscuous mode to see all network traffic on a segment
428
An online list of digital certificates that the certificate authority has
revoked
Certificate Revocation List (CRL)
429
A software agent and monitoring system that performs multiple security tasks such as anti-virus, HIDS/HIPS, firewall, DLP, and file encryption
Endpoint Protection Platform (EPP)
430
A type of system firmware providing support for 64-bit CPU
operation at boot, full GUI and mouse operation at boot, and
better boot security
Unified Extensible Firmware Interface (UEFI)
431
Firewall installed to protect your server by inspecting traffic being sent to a web application
Web Application Firewall - A WAF can prevent a XSS or SQL injection
432
A processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture
Field Programmable Gate Array (FPGA) - End customer can configure the programming logic to run a specific application instead of using an ASIC (application-specific integrated circuit)
433
IEEE standard that defines Port-based Network Access Control (PNAC) and is a data link layer authentication technology used to connected devices to a wired or wireless LAN
802.1x
434
Attacker guesses the session ID for a web session, enabling them to take over the already authorized session of the client
Session Theft
435
Shielding installed around an entire room that prevents electromagnetic energy and radio frequencies from entering or leaving the room
Faraday Cage
436
Manages and ensures transmission of the packets occurs from a host to a destination using either TCP or UDP
Transport Layer - Layer 4 - Segments (TCP) or Datagrams (UDP)
437
Cloud Threats - Cross Origin Resource Sharing (CORS) Policy
A content delivery network policy that instructs the browser to treat requests from nominated domains as safe. Weak CORS policies expose the site to vulnerabilities like XSS.
438
A software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer
Race Conditions - A race condition vulnerability is found where multiple threads are attempting to write a variable or object at the same memory location
439
Wireless A, N, and AC
Use a 5.0 GHz signal
440
Allows an HTTPS website to resist impersonation attacks by presenting a set of trusted public keys to the user’s web browser as part of the HTTP header
Public Key Pinning
441
A secure password-based authentication and password-authenticated key agreement method
Simultaneous Authentication of Equals (SAE) - (SAE) provides forward secrecy
442
Creates a striped RAID of two mirrored RAIDs (combines RAID 1 & RAID 0)
RAID 10
443
Three sets of backup tapes are defined as the son (daily), the father (weekly), and the grandfather (monthly)
Grandfather-Father-Son Tape Rotations
444
Protects against the loss of the array’s data if a single component fails (RAID 1, RAID 5, RAID 6)
Fault-tolerant RAID
445
802.11i standard to provide better wireless security featuring AES with a 128-bit key, CCMP, and integrity checking
WiFi Protected Access version 2 (WPA2) - WPA2 is considered the best wireless encryption available
446
The method and tools used to create a forensically sound copy of data from a source device, such as system memory or a hard disk
Data Acquisition
447
Occurs when an attacker requests replication of the DNS information to their systems for use in planning future attacks
Unauthorized Zone Transfer
448
Occurs when a process stores data outside the memory range allocated by the developer
Buffer Overflow - Over 85% of data breaches were caused by a buffer overflow
449
A framework for analyzing cybersecurity incidents and intrusions by exploring the relationships between four core features: adversary, capability, infrastructure, and victim
Diamond Model of Intrusion Analysis
450
A network that manages embedded devices
Industrial Control Systems (ICS) - ICS is used for electrical power stations, water suppliers, health services, telecommunications, manufacturing, and defense needs. ICS manages the process automation by linking together PLCs using a fieldbus to make changes in the physical world (values, motors, etc)
451
A methodology and a set of tools that enable security architects,
enterprise architects, and risk management professionals to leverage a common set of solutions that fulfill their common needs to be able to assess where their internal IT and their cloud providers are in terms of security capabilities and to plan a roadmap to meet the security needs of their business
Cloud Security Alliance’s Reference Architecture
452
The length of time it takes after an event to resume normal business operations and activities
Recovery Time Objective (RTO)
453
Class C Fire Suppresion
Blue C Circle - live electrical equipment
454
An appliance for generating and storing cryptographic keys that is less susceptible to tampering and insider threats than software-based storage
Hardware Security Module (HSM)
455
Encryption algorithm which uses three separate symmetric keys to encrypt, decrypt, then encrypt the plaintext into ciphertext in order to increase the strength of DES
Triple DES (3DES)
456
Attack that uses multiple transparent layers to trick a user into clicking on a button or link on a page when they were intending to click on the actual page
Clickjacking
457
A software development method where application and platform
requirements are frequently tested and validated for immediate
availability
Continuous Delivery- Continuous delivery focuses on automated testing of code in order to get it ready for release
458
Occurs when an attacker fills up the buffer with NOP so that the return address may hit a NOP and continue on until it finds the attacker’s code to run
Smash the Stack
459
Specialized hardware device that allows for hundreds of simultaneous VPN connections for remote workers
VPN Concentrator
460
The weaponized code is executed on the target system by this
mechanism
Exploitation
