Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security > Security+ 3.0 Architecture and Design > Flashcards

Security+ 3.0 Architecture and Design Flashcards

1
Q

Ad Hoc

A

Ad Hoc - zone is created when two or more wireless devices connect to one another creating an on-demand network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Intranet

A

Intranet- is a private company zone established to allow employees the ability to share content and communicate more effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

extranet

A

extranet is a zone created to allow authorized users access to company assets, separate from the intranet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

VLAN

A

Virtual Local Area Network (VLAN) is a logical group of network devices on the same LAN, despite their geographical distribution. It can divide the devices logically on the data link layer, and group users according to departments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Aggregation switches

A

Aggregation switches – a network device that combines multiple ports into a single link in order to enhance redundancy and increase bandwidth

can connect multiple subnets to reduce the number of active ports. When aggregating subnets, the subnets are connected to the switch versus the router.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Air gap

A

Air gap -a type of network isolation that physically separates a network from all other networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Application Containers

A

Application Containers - a virtualization method where applications run in isolated containers on the host operating system instead of in separate VMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Containers

A

Containers use the kernel as a host but do not host an operating system. A container isolates and protects applications from other parts of the system. They require fewer resources than a Type II hypervisor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Deprovisioning

A

Deprovisioning- is the act of removing or disabling access to a resource. Since the application has been replaced, the application should be deprovisioned to preserve resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Provisioning

A

Provisioning is the process of procuring, configuring and making available an application or system on certain services. Provisioning an application allows it to run on its intended platform. Since the new version has already been released in this scenario, this step has already taken place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

DMZ-

A

DMZ- a small section of a private network that tis located behind one firewall or between 2 firewalls and made available for public use.

is between the two firewalls providing a layer of protection for the internet facing servers. It is an area of a network that is designed for public and company use. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DNS

A

DNS- - Domain Name System- the service that maps names of IP addresses on most TCP/IP networks, including the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Elasticity-

A

Elasticity- the property by which a computing environment can instantly react to both increasing and decreasing demands in a workload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

EMI

A

EMI- electromagnetic interference- a disruption of electrical current that occurs when a magnetic field around one electrical circuit interferes with the signal being carried on an adjacent circuit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

EMP

A

EMP- electromagnetic pulse- a short burst of electrical interference caused by an abrupt and rapid acceleration of charged particles, which can short circuit and damage electronic components

are radio frequencies emitted by external sources, such as power lines and lights that disturb data signals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Extranet

A

Extranet- a private network that provides some access to outside parties, particularly vendors, partners and select customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Fault Tolerance

A

Fault Tolerance- the ability of a computing environment to withstand a foreseeable component failure and continue to provide an acceptable level of service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Distributive allocation

A

Distributive allocation provides that multiple nodes are configured to work together on complex problems. A central processor divides the task into smaller pieces and coordinates tasking the nodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SED

A

A self-encrypting drive (SED) includes both the hardware and software to encrypt data on a drive. Keys are securely stored within for decryption. SED requires credentials to be entered for decryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

FDE

A

FED-Full disk encryption- a storage technology that encrypts an entire storage drive at the hardware level.

Full device encryption (FDE) provides encryption for a whole disk and protects the confidentiality of the data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Firewalls

A

Firewalls- a software or hardware device that protects a system or network by blocking unwanted network traffic.

Firewalls allow the network administrator to divide the network into different network segments known as zones. A firewall filters traffic. It can be used for a single host or between networks. It regulates both inbound and outbound traffic, providing a layer of security inbound and out.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Wireless

A

The wireless topology is used to extend a wired local area network through the use of an antenna.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Guest Network

A

Guest Network- a wireless network used to provide non-employees or guests with internet access. This access is limited to certain functions, such as internet surfing and email.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Hardware root of Trust

A

Hardware root of trust- is a known secure starting point by embedding a private key in the system. The key remains private until the public key is matched.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Root of trust

A

Root of Trust- technology that enforces hardware platforms trusted computing architecture through encryption mechanisms designed to keep data confidential and to prevent tampering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

High availability

A

High availability – the property that defines how closely systems approach the goal of providing data availability 100 percent of the time while maintaining a high level of system performance.

High availability refers to a service that needs to remain operational with minimum downtime. A group of servers are referred to as a node. If one node fails, another can take over to reduce or eliminate downtime. Failover cluster

High availability refers to a service that needs to remain operational with minimum downtime. A group of servers are referred to as a node. If one node fails, another can take over to reduce or eliminate downtime.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Distributive allocation

A

Distributive allocation provides that multiple nodes are configured to work together on complex problems. A central processor divides the task into smaller pieces and coordinates tasking the nodes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Honeynet

A

Honeynet- an entire dummy network used to lure attackers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

HSM

A

HSM- hardware security module- a physical device that provides root of trust capabilities

A Hardware Security Module (HSM) is a device used to generate, maintain and store cryptographic keys. It is an external device and can easily be added to a system as needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

IAAS

A

IAAS- Infrastructure as a service- a computing method that uses the cloud to provide any or all infrastructure needs.

provides companies the ability to “rent” hardware and services in a cloud environment. The service provider owns, maintains and manages the equipment while the company pays per use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Immutable systems

A

Immutable systems – a system that is not upgraded in place, but is programmatically destroyed and then recreated from scratch every time the configuration changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Infrastructure as code

A

Infrastructure as code – an information technology strategy that asserts that the organizations infrastructure can be quickly configured and deployed as desired through programming scripts and other code files rather than through standard software tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Integrity-

A

Integrity- the fundamental security goal of keeping organizational information accurate, free of errors and without unauthorized modifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Intranet

A

Intranet- a private network that is only accessible by the organizations own personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Load balancers-

A

Load balancers-a network device that distributes the network traffic or computing workload among multiple devices in a network.

Load balancers can equalize the traffic load between servers, eliminating unscheduled downtimes. Load balancing uses multiple servers to support a single service. Load balancing can ensure system availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Mantrap-

A

Mantrap- a physical security control system that has a door at each end of a secure chamber.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

NAT

A

NAT- Network address translation- a simple form of internet security that conceals internal addressing schemes from public internet by translating between a single public address on the external side of a router and private non-routable addresses internally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Static NAT

A

Static NAT uses a one-to-one approach for disguising IP’s. NAT on the internet facing firewall protects private computers from outside threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Dynamic NAT

A

Dynamic NAT- uses multiple IP addresses to map one private IP to many public IP’s. It chooses which IP to use based on the load presented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Non-persistence

A

Non-persistence- the property by which a computing environment is discarded once it has finished its assigned task.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

PAAS

A

PAAS Platform as a service- a computing method that uses the cloud to provide any platform type services.

provides preconfigured services for developing and managing environments. This service provides on-demand computing.

42
Q

Port Mirror

A

Port mirror - used to monitor network traffic. It forwards a copy of each packet from one switch port to another.

43
Q

Provisioning

A

Provisioning- Provisioning is the process of procuring, configuring and making available an application or system on certain services. Provisioning an application allows it to run on its intended platform. Since the new version has already been released in this scenario, this step has already taken place.

44
Q

Proxy

A

Proxy – a device that acts on behalf of one end of a network connection when communicating with the other end of the connection. A proxy server mediates the communications between a client and another server. It can filter communications and provide caching services to improve performance.

A proxy server can be a caching intermediary to improve the network performance for users visiting the same websites. This is more applicable for internal use so employees may improve their Internet speeds.

45
Q

RAID-

A

RAID- Redundant array of independent disks- a set of vendor-independent specifications that support redundancy and fault tolerance for configurations on multiple-device storage systems.

46
Q

RAID-0

A

RAID-0 offers striping only where data is split across the drives. It does not provide redundancy. RAID-0 has the worst data protection of all of the RAID concepts.

47
Q

RAID-10

A

RAID-10 combines mirroring and striping in a single system. It provides better write performance than any other RAID level providing data protection.

48
Q

Redundancy

A

Redundancy – the property by which a computing environment keeps one or more sets of additional resources in addition to the primary sets of resources.

49
Q

RTOS

A

RTOS- real time operating system- a specialized operating system that uses more consistent processor scheduler than a standard system.

50
Q

SAAS

A

SAAS- software as a service- a computing method that uses the cloud to provide application services to users.

is a full-service product and is pay as you go. It is accessed directly over the internet.

51
Q

Sandboxing

A

Sandboxing- The sandbox is an isolated environment that is often used for testing. Security, patches, and critical updates can be tested in a sandbox without touching the system before implementation.

52
Q

staging environment

A

staging environment mimics that of production and allows for an environment to practice deployment. In the event deployment fails in this environment, it can roll back to the test and development environments.

53
Q

production environment

A

production environment is the final stage of the deployment effort. Testing in this environment would be too late, given it is the operational environment.

54
Q

development environment

A

development environment is a place for creation. Requirements are turned into reality in this environment. It is not a complete copy of production, but just the beginning of an application.

55
Q

SCADA

A

SCADA- supervisory control and data acquisitions- a type of industrial control system that monitors and controls industrial processes such as manufacturing and fabrication, infrastructure processes such as power transmission and distribution and facility processes such as energy consumption and HVAC.

56
Q

Scalability

A

Scalability- the property by which a computing environment is able to gracefully fulfill its ever-increasing resource needs.

57
Q

Attestation

A

Attestation is the process of checking and validating system files during a boot process.

58
Q

Secure boot

A

Secure boot- A UIEFI feature that prevents unwanted processes from executing during the boot operation

a process that validates system files during the startup process to ensure they have not been modified.

59
Q

Proper input validation

A

Proper input validation-limiting what a user can input into specific fields

60
Q

Normalization

A

Normalization- a software development technique that tries to repair invalid input to strip any special encoding and automatically convert the input to a specific format that the application can handle

Normalization is used to optimize database performance by removing duplicates, use of primary keys, and related data contained in separate tables. A database is normalized when it meets the first three forms.

61
Q

Stored procedures

A

Stored procedures – set of pre-compiled database statements that can be used to validate input to a database. Limits kind and format of statements that the user can successfully submit. Stored procedures can deny a user access to the underlying data and force them to work within the procedure itself.

62
Q

Code signing

A

Code signing – a form of digital signature that guarantees source code and application binaries are authentic and have not been tampered with. Helps users verify the legitimacy of app.

63
Q

Encryption

A

Encryption – vital in apps that store and transmit sensitive data.

64
Q

Obfuscation

A

Obfuscation- technique that essentially hides or camouflages code so that it is harder to read by unauthorized users. Attempts to mitigate reverse engineering of software.

65
Q

Compiling code

A

Compiling code occurs when a compiler is necessary to make the files executable. The compiler checks the code for errors, and if an error is found, it will not allow the code to execute.

66
Q

Runtime

A

Runtime is when the application is actually running in its normal state. The code has already been executed and errors can be checked.

67
Q

Server side execution and validation

A

Server side execution and validation- occur on the web server or back-end, and take more time to complete. It ensures the application does not receive invalid data. Server side validation is more secure than client side validation.

Server-side validations occur on the web server or back-end and take more time to complete. Validation on the server side is more secure than client-side validation.

68
Q

Client-side execution and validation

A

Client-side execution and validation- Client-side input validation verifies data is valid upon entry to the system. Proper input validation uses a set of rules to validate entries in fields for proper use. In the event an entry is invalid, the application will reject the entry.

Client-side input validation verifies data is valid upon entry to the system. Proper input validation uses a set of rules to validate entries in fields for proper use. In the event an entry is invalid, the application will reject the entry.

69
Q

Memory management-

A

Memory management- must be aware if the language you’re coding in manages memory automatically or if it needs to be considered in the code.

70
Q

Fuzzing

A

Fuzzing is a dynamic analysis technique that checks code as it is running. When using fuzzing, the system is attacked with random data to check for code vulnerabilities.

71
Q

static code analyzer

A

static code analyzer examines code quality and effectiveness without executing the code. An analyzer can be used in conjunction with development for continued code quality checks, or once the code is in its finalization stages.

72
Q

Continuous integration

A

Continuous integration allows for the merging of code changes into a central repository. The code is built and tested each time it is checked into the environment, providing a more efficient method to code production.

Continuous Integration in a Secure DevOps project allows for the merging of code changes into a central repository. The code is built and tested each time it is checked into the environment providing a more efficient method to code production.

73
Q

immutable system

A

immutable system is the ability to create a secure image and test it in a controlled DevOps environment.

74
Q

Automating security testing

A

Automating security testing in a DevOps environment ensures defects are not introduced in systems. As new code is introduced to an application, security testing is important to check for bugs and vulnerabilities.

75
Q

SECaaS

A

Security as a service -SECaaS- a computing method that enables clients to take advantage of information, software, infrastructure, and processes provided by a cloud vendor in the specific area of computer security.

76
Q

CASB

A

A Cloud Access Security Broker (CASB) is a part of security as a service that monitors network traffic between a company’s network and cloud provider, enforcing security policies.

77
Q

Security automation-

A

Security automation- the ability to easily configure, generate and deploy baselines for computer systems in the organization.

78
Q

Snapshots-

A

Snapshots- the state of a virtual machine at a specific point in time

79
Q

SSL accelerators

A

SSL accelerators - A Secure Socket Layer (SSL) Accelerator is designed to offload tasks from servers allowing network load to be distributed. It can provide a seamless service to consumers of network applications while balancing out session requests.

80
Q

SSL decryptor

A

SSL decryptor provides protection from malicious threats over secure connections and would be placed in the DMZ.

81
Q

SSL/TLS accelerator

A

SSL/TLS accelerator- a hardware interface that helps offload the resource intensive encryption calculations in SSL/TLS to reduce overhead for a server.

82
Q

Software Defined Network (SDN)

A

Software Defined Network (SDN) separates data and control planes in a network. It uses virtualization to route traffic to its intended destination, instead of using proprietary hardware.

83
Q

Network Taps

A

Network Taps – creates a copy of network traffic to forward to a sensor or monitor like an IDS. Often enabled through port mirroring functionality on switches. If you want to monitor any potentially malicious traffic from external sources, place taps outside or alongside the perimeter firewall. Very noisy however. To monitor malicious traffic that may have already made its way into the private network, placed taps alongside switches that provide end-user

84
Q

TPM

A

TPM- trusted platform module- a specification that includes the use of crypto processors to create a secure computing environment

A TPM keeps hard drives locked until proper authentication occurs.

is a hardware-based encryption solution that is embedded in the system and provides secure key storage for full disk encryption. TPM supports secure boot processes.

85
Q

TOS

A

Trusted OS-TOS- The operating system component of the TCB (Trusted computing base) that protects the resources from applications

86
Q

TCB

A

TCB- the hardware, firmware and software components of a computer system that implement the security policy of a system

87
Q

Tunneling

A

Tunneling- a data transport technique in which a data packet is encrypted and encapsulated in another data another order to conceal the information of the packet inside.

88
Q

Type 1 hypervisor

A

Type 1 hypervisor - run directly on the hosts hardware when managing the guest virtual environments.

virtualization solutions that run directly on system hardware. They do not require operating system involvement in order to run.

89
Q

Type 2 hypervisor

A

Type 2 hypervisor – run as an application on top of the host machines OS. Adds another level between the hypervisor and hardware. Typically, slower than type 1 and add an extra layer of complexity to VM

are virtualization solutions that run as software and do require a host operating system.

Typically slower than type 1 and add an extra layer of complexity to VM

90
Q

BIOS

A

BIOS- Basic input/ output systems- a firmware interface that initialized hardware for an operating system boot.

is a combination of hardware and software used to adjust settings in a computer

91
Q

UEFI

A

UEFI—Unified extensible firmware interface- a firmware interface that initializes hardware for an operating system boot.

is a specification for a software program that connects a computer’s firmware to its operating system. UEFI is the replacement for BIOS (Basic Input/output System) and has many advancements to include provisions for secure booting.

92
Q

Virtualization

A

Virtualization- the process of creating a simulation of a computing environment, where the virtualized system can simulate the hardware, operating system, and applications of a typical computer without being a separate physical computer.

93
Q

VPN-

A

VPN- virtual private network- a method of extending a private network by tunneling through a public network, such as the internet.

94
Q

Site-to-site VPN

A

Site-to-site- connects 2 private networks together.

A site to site Virtual Private Network (VPN) connects multiple networks versus one. Remote users can access both locations as if they were onsite without noticing the location separation.

95
Q

Split tunnel

A

Split tunnel is means of encrypting connection on demand for VPN’s. It will only encrypt outbound traffic to private IP addresses.

96
Q

Always on VPNs

A

Always on VPNs allow for a continued connection between the geographically separated servers and the employee.

97
Q

VPN Concentrators

A

VPN Concentrators – a single device that incorporates advanced encryption and authentication methods in order to handle a large number of VPN tunnels

98
Q

VDI

A

VDI-Virtual desktop infrastructure- uses virtualization to separate the personal computing environment from the users’ physical machine. A desktop OS and applications are run inside the VM that are hosted on servers in the virtualization infrastructure.

99
Q

VDE

A

VDE- virtual desktop environment- a VM that runs a desktop OS

100
Q

CASB

A

A Cloud Access Security Broker (CASB) is a part of security as a service that monitors network traffic between a company’s network and cloud provider, enforcing security policies.

Security (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions