Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comptia+ > Security + > Flashcards

Security + Flashcards

1
Q

Information Security

A

Act of protecting data and information from unauthorized access, unlawful modification and disruption, disclosure, corruption, and destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information Systems Security

A

Act of protecting the systems that hold and process the critical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

C.I.A. Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Confidentiality

A

Ensures that information is only accessible to those with the appropriate authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Integrity

A

Ensure that the data remains accurate, unaltered, and trustworthy unless modifications required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Availability

A

Ensures that information and resources are accessible and functional when needed by authorized users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Non-repudiation

A

Guaranteeing that a specific action or event has taken place and cannot be denied by the parties involved

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

AAA Security

A

Authorization, Authentication, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Control Plane

A

The overarching framework and set of components are responsible for defining, managing, and enforcing the policies related to user and system access within an organization.
Consists of adaptive identity, threat scope reduction, policy-driven access control, and secured zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Data Plane

A

Ensures that the policies and procedures are properly executed.
Focused on the subject/system, policy engine, policy administrator, and establishing policy enforcement points

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Hashing

A

Process of converting data into a fixed-size value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Checksum

A

Method to verify the integrity of the data during transmission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Regular Audits

A

Involve reviewing logs and operations to ensure that only authorized changes have been made and any discrepancies are addressed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Digital Signature

A

Created first by hashing a particular message or communication to be digitally signed and encrypting the hash digest with the user’s private key using asymmetric encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Managerial Controls

A

Involve the strategic planning and governance side of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Operational Controls

A

Procedures and measures that are designed to protect data on a day-to-day basis and are mainly governed by internal processes and human actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Physical Controls

A

Tangible real-world measures taken to protect assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Preventative Controls

A

Proactive measures implemented to thwart potential security threats or breaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Deterrent Controls

A

Aim to discourage potential attackers by making the effort seem less appealing or more challenging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Detective Controls

A

Monitor and alert organizations to malicious activities as the occur or shortly thereafter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IDS

A

Intrusion Detection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Corrective Controls

A

Mitigate any potential damage and restore the systems to their normal state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Compensating Controls

A

Alternative measures that are implemented when primary security controls are not feasible or effective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Directive Controls

A

Policies or procedures that dictate specific actions or behaviors by users or systems.
Often rooted in policy or documentation and set the standards for behavior within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Gap Analysis

A

Process of evaluating the differences between an organization’s current performance and its desired performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Technical Gap Analysis

A

Involves evaluating an organization’s current technical infrastructure and identifying any areas where it falls short of the technical capabilities required to fully utilize their security solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Business Gap Analysis

A

Involves evaluating an organization’s current business processes and identifying any areas where they fall short of the capabilities required to fully utilize cloud-based solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

POA&M- Plan of Action and Milestones

A

Outlines the specific measures to address each vulnerability, allocate resources, and set up timelines for each remediation task that is needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Control Plane

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Adaptive Identity

A

Use adaptive identities that rely on real-time validation that takes into account the user’s behavior, device, location, and other factors like that

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Threat Scope Reduction

A

Limit the users’ access to only what they need for their work tasks because this drastically reduces the network potential attack surface

32
Q

Policy-Driven Access Controls

A

This entails developing, managing, and enforcing user access policies based on their roles and responsibilities

33
Q

Secured Zones

A

Isolated environments within a network that are designed to house sensitive data

34
Q

Subject/System

A

Refers to the individual or entity attempting to gain access

35
Q

Policy Engine

A

Cross-references the access request with its pre-defined policies

36
Q

Policy Administrator

A

Used to establish and manage the access policies

37
Q

Policy Enforcement Point

A

Allow or restrict access, and it will effectively act as a gatekeeper to the sensitive areas of the systems or networks

38
Q

Threat Actor

A

An individual or entity responsible for incidents that impact security and data protection

39
Q

Unskilled Attackers

A

Individuals with limited technical expertise who use readily available tools like downloaded scripts or exploits to carry out attacks

40
Q

Hacktivists

A

Cyber attackers who carry out their activities are driven by political. social, or environmental ideologies who often want to draw attention to a specific cause

41
Q

Organized Crime

A

Well-structured groups that execute cyberattacks for financial gain, usually through methods like ransomware, identity theft, or credit card fraud

42
Q

Nation-state Actors

A

Highly skilled attackers that are sponsored by governments to carry out cyber espionage, sabotage, or cyber warfare against other nation-states or specific targets in a variety of industries

43
Q

Insider Threats

A

Security threats that originate from within the organization

44
Q

Shadow IT

A

IT systems, devices, software, applications, and services that are managed and utilized without explicit organizational approval

45
Q

Honeypots

A

Decoy systems or servers designed to attract and deceive potential attackers, simulating real-world IT assets to study their techniques

46
Q

Honeynets

A

Network of Honeypots to create a more complex system that is designed to mimic an entire network of systems, including servers, routers and switches
Creates an entire network of decoy systems to observe complex, multi-stage attacks

47
Q

Honeyfiles

A

Decoy files placed within systems to detect unauthorized access or data breaches

48
Q

Honey Tokens

A

Fake pieces of data, like a fabricated user credential, are inserted into databases or systems to alert administrators when they are accessed or used

49
Q

National-State Actors

A

Groups that are sponsored by a government to conduct cyber operations against other nations, organizations, or individuals

50
Q

False Flag Attack

A

Attack that is orchestrated in such a way that it appears to originate from a different source or group to mislead organizations or groups

51
Q

Attack Surface

A

Encompasses all the various points where an unauthorized user can try to enter data or extract data from an environment

52
Q

Images- Threat Vectors

A

Image-based threat vectors involve the embedding of the malicious code inside of an image file by the threat actor

53
Q

Files- Threat Vectors

A

File-based threat vectors involve the use of malicious files to deliver a cyber attack

54
Q

Voice Calls- Threat Vectors

A

Voice call-based threat vectors involve the use of voice calls to trick victims into revealing their sensitive information

55
Q

BlueBorne

A

Set of vulnerabilities in Bluetooth technology that can allow an attacker to take over devices or spread malware

56
Q

Blue Smack

A

Type of Denial of service attack that targets Blue-tooth-enabled devices by sending a specially crafted Logical Link Control and Adaptation Protocol packet to a target device

57
Q

Tactics, Techniques, and Procedures (TTPs)

A

Specific methods and patterns of activities or behaviors associated with a particular threat actor or group of threat actors

58
Q

Port Triggering

A

Security mechanism where specific services or ports on a network device remain closed until a specific outbound traffic pattern is detected

59
Q

FAR- False Acceptance Rate

A

The rate that the system authenticates a user as valid, even though that person should not have been granted access to the system

60
Q

FRR- False Rejection Rate

A

Occurs when biometrics denies a user who should have access

61
Q

EER- Equal Error Rate

A

More commonly called Crossover Error Rate (CER), it uses a measure of the effectiveness of a given biometrics system to achieve a balance

62
Q

Typosquatting

A

A form of cyber attack where an attacker registers a domain name that is similar to a popular website but contains some kind of typographical error

63
Q

Water Hole Attacks

A

Targeted form of cyber attack where attackers compromise a specific website or service that their target is known to use

64
Q

Threat Vector

A

Specific method used by an attacker to infiltrate a victims machine

65
Q

Attack Vector

A

A means by which an attacker gains access to a computer to infect the system with malware

66
Q

Macro Virus

A

A form of code that allows a virus to be embedded inside another document so that when that document is opened by the user, the virus is executed

67
Q

Program Virus

A

Tries to find executables or application files to infect their malicious code

68
Q

Multipartite Virus

A

A combination of a boot sector type virus and a program virus

69
Q

Polymorphic Virus

A

Advanced version of an encrypted virus, but instead of just encrypting the contents, it will change the virus’s code each time it is executed by altering the decryption module for it to evade detection

70
Q

Metamorphic Virus

A

Able to rewrite itself entirely before it attempts to infect a given file

71
Q

Stealth Virus

A

A technique used to prevent the virus from being detected by the anti-virus software

72
Q

Armored Virus

A

Have a layer of protection to confuse a program or person who’s trying to analyze it

73
Q

Remote Access Trojan (RAT)

A

This type of Trojan is widely used by modern attackers because it provides the attacker with remote control of the victims machine

74
Q

DLL Injection

A

A technique used to run arbitrary code within the address space of another process by forcing it to load a dynamic-link library

75
Q

Logic Bomb

A

Malicious code that’s inserted into a program, and will only execute when certain conditions have been met

76
Q
A

comptia+ (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions